PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
nftables 0.9.0-2
Не работает проброс (dnat) трафика из внутренней сети (lan) через внешний адрес (wan) на внутренний ресурс. Лезем по #ssh xx.xx.xx.xx (wan) -p 23020 на 192.168.1.3:22 (lan) снаружи работает, с внутрянки нет.
https://funkyimg.com/i/32xic.jpg
В версии 0.7 nftables работало. Мысли и варианты кончились.
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
ct state {established, related} accept
ct state invalid drop
iifname {"lo","br0"} accept
iifname "ppp0" tcp dport 23020 accept
}
chain forward {
type filter hook forward priority 0; policy drop;
oifname "ppp0" tcp flags syn tcp option maxseg size set rt mtu
ct state {established, related} accept
ct state invalid drop
iifname "br0" accept
tcp dport 22 accept
}
chain output {
type filter hook output priority 0; policy accept;
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority -100; policy accept;
dnat to tcp dport map { 23020 : 192.168.1.3 }:tcp dport map { 23020 : ssh }
}
chain postrouting {
type nat hook postrouting priority 100; policy accept;
oifname "ppp0" counter packets 0 bytes 0 snat to xx.xx.xx.xx
}
chain input {
type nat hook input priority 0; policy accept;
}
chain output {
type nat hook output priority 0; policy accept;
}
}
table ip mangle {
chain input {
type filter hook input priority -150; policy accept;
}
chain forward {
type filter hook forward priority -150; policy accept;
}
chain output {
type filter hook output priority -150; policy accept;
}
chain postrouting {
type filter hook postrouting priority -150; policy accept;
}
}
