Здравствуйте. Подскажите, что пошло не так? две сети связаны по vpn. но траффик идет только в одну сторону. С сети 1 в сети 2 пингуются узлы и к ним есть доступ. наоборот - нет.
сеть 1: iptables-save:
:INPUT ACCEPT [508:50910]
:FORWARD ACCEPT [458550:237778852]
:OUTPUT ACCEPT [78240:11679945]
:f2b-sshd - [0:0]
...
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol none -j DROP
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 445 -j ACCEPT
-A FORWARD -s 10.1.0.0/24 -d 10.0.0.0/24 -i enp10s1 -m policy --dir in --pol ipsec --reqid 19 --proto esp -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -d 10.1.0.0/24 -o enp10s1 -m policy --dir out --pol ipsec --reqid 19 --proto esp -j ACCEPT
-A FORWARD -s 10.1.0.0/24 -d 10.0.0.0/24 -i enp10s1 -m policy --dir in --pol ipsec --reqid 9 --proto esp -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -d 10.1.0.0/24 -o enp10s1 -m policy --dir out --pol ipsec --reqid 9 --proto esp -j ACCEPT
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -m limit --limit 2/min -j LOG --log-prefix "iptables: "
-A FORWARD -s 10.0.0.0/24 -d 10.0.0.0/24 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -d 192.168.88.0/24 -j ACCEPT
-A FORWARD -s 192.168.88.0/24 -d 10.0.0.0/24 -j ACCEPT
-A FORWARD -s 10.1.0.0/24 -d 10.0.0.0/24 -i enp10s1 -j ACCEPT
COMMIT
ip route (enp10s1 - внешний, enp14s0 - локальная сеть):
default via 6.2.3.9 dev enp10s1 onlink
10.0.0.0/24 dev enp14s0 proto kernel scope link src 10.0.0.1
10.1.0.0/24 via 6.2.3.10 dev enp10s1
6.2.3.8/30 dev enp10s1 proto kernel scope link src 6.2.3.10
192.168.88.0/24 via 10.0.0.10 dev enp14s0
ipsec status:
offs[20]: ESTABLISHED 48 minutes ago, 6.2.3.10[6.2.3.10]...2.1.2.1[2.1.2.1]
offs[20]: IKEv2 SPIs: xxxxxxx_i xxxxxxxx_r*, pre-shared key reauthentication in 7 minutes
offs[20]: IKE proposal: AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
offs{73}: INSTALLED, TUNNEL, reqid 19, ESP SPIs: cf361ed5_i ce823a96_o
offs{73}: AES_CBC_128/HMAC_SHA2_256_128, 10646 bytes_i (149 pkts, 0s ago), 9035 bytes_o (158 pkts, 0s ago), rekeying in 12 minutes
offs{73}: 10.0.0.0/24 === 10.1.0.0/24
Сеть 2: iptables-save:
# Generated by iptables-save v1.6.1 on Thu Aug 29 10:25:52 2019
*nat
:PREROUTING ACCEPT [2294:131588]
:INPUT ACCEPT [1671:100935]
:OUTPUT ACCEPT [24:2124]
:POSTROUTING ACCEPT [23:2008]
-A POSTROUTING -s 10.1.0.0/24 ! -d 10.1.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.1.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE
COMMIT
# Completed on Thu Aug 29 10:25:52 2019
# Generated by iptables-save v1.6.1 on Thu Aug 29 10:25:52 2019
*mangle
:PREROUTING ACCEPT [2948941:1992002246]
:INPUT ACCEPT [903119:143837306]
:FORWARD ACCEPT [2034616:1847703202]
:OUTPUT ACCEPT [2275415:1991608559]
:POSTROUTING ACCEPT [4310028:3839311356]
COMMIT
# Completed on Thu Aug 29 10:25:52 2019
# Generated by iptables-save v1.6.1 on Thu Aug 29 10:25:52 2019
*filter
:INPUT ACCEPT [288340:41817735]
:FORWARD ACCEPT [115102:18769946]
:OUTPUT ACCEPT [365171:280763846]
-A FORWARD -s 10.0.0.0/24 -d 10.1.0.0/24 -i ens19 -m policy --dir in --pol ipsec --reqid 28 --proto esp -j ACCEPT
-A FORWARD -s 10.1.0.0/24 -d 10.0.0.0/24 -o ens19 -m policy --dir out --pol ipsec --reqid 28 --proto esp -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -d 10.1.0.0/24 -i ens19 -m policy --dir in --pol ipsec --reqid 3 --proto esp -j ACCEPT
-A FORWARD -s 10.1.0.0/24 -d 10.0.0.0/24 -o ens19 -m policy --dir out --pol ipsec --reqid 3 --proto esp -j ACCEPT
COMMIT
# Completed on Thu Aug 29 10:25:52 2019
ip route:
default via 2.1.2.1 dev ens19 proto dhcp src 2.1.2.1x metric 100
10.0.0.0/24 via 2.1.2.1x dev ens19
10.1.0.0/24 dev ens18 proto kernel scope link src 10.1.0.5
2.1.2.0/24 dev ens19 proto kernel scope link src 2.1.2.1x
2.1.2.1 dev ens19 proto dhcp scope link src 2.1.2.1 metric 100
ipsec status:
offnet[31]: ESTABLISHED 41 seconds ago, 2.1.2.1[2.1.2.1]...6.2.3.10[6.2.3.10]
offnet[31]: IKEv2 SPIs: xxxxxxx_i* xxxxxxxxxxx_r, pre-shared key reauthentication in 52 minutes
offnet[31]: IKE proposal: AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
offnet{90}: INSTALLED, TUNNEL, reqid 32, ESP SPIs: c8ab2758_i c697e929_o
offnet{90}: AES_CBC_128/HMAC_SHA2_256_128, 203032 bytes_i (2352 pkts, 0s ago), 784258 bytes_o (1938 pkts, 0s ago), rekeying in 14 minutes
offnet{90}: 10.1.0.0/24 === 10.0.0.0/24
Где мой бок?...