如何解决如何设置要从 TUN 设备转发到 WAN 的数据包
我正在尝试为学校项目创建 VPN,主机和服务器都在 Ubuntu VM 上运行,并且它们都连接到我的 PC 的 LAN 设备。
本质上,我正在做的是将数据包路由到 TUN 设备 tun_dev0 并将整个数据包作为新数据包的数据发送,并将这个新数据包发送到服务器。 然后,服务器解压该数据包并将其发送到服务器上的 TUN 设备(而数据包目的地是另一个地址),并且该应该通过 WAN 设备转发enp0s3 .
首先,我创建了一个类来处理 TUN 设备的创建/配置/命名......代码非常简单,但如果你不明白,这里是代码。
import os
import fcntl
import struct
TUNSETIFF = 0x400454ca
IFF_TUN = 0x0001
IFF_TAP = 0x0002
IFF_NO_PI = 0x1000
class device:
def __init__(self,mode,name=b'tun%d'):
'''
:param mode: hex array containing the composition of flags
:param name: byte array containing format string of the name
'''
self.mode = mode
if type(name) != bytes:
raise ValueError("'name' must be a byte array type,not %s." % type(name))
# Create the tun interface
self._file_descriptor = os.open("/dev/net/tun",os.O_RDWR)
ifr = struct.pack('16sH',name,mode) # Create C struct of flags and device name
ifname_bytes = fcntl.ioctl(self._file_descriptor,TUNSETIFF,ifr) # Send said C struct to OS Kernel
ifname = ifname_bytes.decode('UTF-8')[:16].strip("\x00") # Get Device Name
self.name = ifname
self.netmask_bytes = -1 # Initialize Value
self.subnet = '' # Initialize Value
def configure(self,subnet,netmask_bytes): # MAKE REGEX CONDITION FOR IP
if type(netmask_bytes) != int:
raise ValueError("'netmask_bytes' must be of type Integer,not %s." % type(netmask_bytes))
if not (netmask_bytes < 33 and netmask_bytes > 0):
raise ValueError(
"'netmask_bytes' value - '%d' is out of bounds,must be between 0 to 32." % (netmask_bytes))
self.subnet = subnet
self.netmask_bytes = netmask_bytes
# set up the tun interface
os.system("sudo ip addr add {}/{} dev {}".format(self.subnet,self.netmask_bytes,self.name))
os.system("sudo ip link set dev {} up".format(self.name))
def read(self,bts):
if type(bts) != int:
raise ValueError("'bts' must be of type Integer,not %s." % type(bts))
return os.read(self._file_descriptor,bts)
def write(self,msg):
if type(msg) != bytes:
raise ValueError("'msg' must be of type Bytes,not %s." % type(msg))
return os.write(self._file_descriptor,msg)
def __str__(self):
return 'Flags: {},Name: {}\nconfiguration: {}/{}'.format(hex(self.mode),self.name,self.subnet,self.netmask_bytes)
请注意,没有超级用户权限,您无法运行 fcntl.ioctl(),为此我使用了脚本:sudo python3 "$@"
并将其设置为解释器在 Pycharm 上
这是客户的代码:
from scapy.all import *
import socket
import pickle
import time
src_ip = '192.168.1.145'
dst_ip = '192.168.1.223'
tun_ip = '10.0.8.0'
port = 1111
client_socket = socket.socket(socket.AF_INET,socket.SOCK_DGRAM) # TCP socket
tun = tuntap.device(tuntap.IFF_NO_PI | tuntap.IFF_TUN,b'tun_dev%d')
tun.configure('10.0.8.0',24)
dev = tun.get_device()
print(tun.name)
def main():
os.system('sudo route add 192.168.1.128 gw {} dev {}'.format(tun.subnet,tun.name))
os.system('sudo route add default gw {} dev {}'.format(tun.subnet,tun.name))
os.system('sudo route del default gw 192.168.1.1 dev enp0s3')
client_socket.connect((dst_ip,port))
print(tun.name)
fds = [client_socket,dev]
while True:
ready,_,_ = select.select(fds,[],[])
for fd in ready:
if fd is client_socket:
data = client_socket.recv(2048)
if fd is dev:
packet = tun.read(2048)
try:
client_socket.send(packet)
except socket.error:
break
os.system('sudo route del 192.168.1.128 gw {} dev {}'.format(tun.subnet,tun.name))
os.system('sudo route del default gw {} dev {}'.format(tun.subnet,tun.name))
os.system('sudo route add default gw 192.168.1.1 dev enp0s3')
client_socket.close()
if __name__ == '__main__':
main()
这是服务器的代码:
import select
import pickle
import socket
from scapy.all import *
import tuntap
import sys
serverinfo = ('0.0.0.0',1111)
server_ip = '192.168.1.223'
client_ip = '192.168.1.145'
server_socket = socket.socket(socket.AF_INET,socket.SOCK_DGRAM) #TCP socket
server_socket.bind(serverinfo)
tun = tuntap.device(tuntap.IFF_NO_PI | tuntap.IFF_TUN,24)
dev = tun.get_device()
def main():
#os.system('sudo route add default gw {} dev {}'.format(tun.subnet,tun.name))
#os.system('sudo route del default gw 192.168.1.1 dev enp0s3')
fds = [server_socket,[])
for fd in ready:
if fd is server_socket:
data = server_socket.recv(2048)
if data == b'stop\n':
sys.exit()
ip = IP(data)
ip.src = '10.0.8.12'
tun.write(bytes(ip))
tun.write(data)
if fd is dev:
packet = tun.read(2048)
server_socket.sendto(packet,(client_ip,1111))
#os.system('sudo route del default gw {} dev {}'.format(tun.subnet,tun.name))
#os.system('sudo route add default gw 192.168.1.1 dev enp0s3')
if __name__ == '__main__':
main()
现在,为了确保当发送到 TUN 设备的数据包到达 WAN 设备时,我认为我必须启用 IP 转发,因此我使用了以下命令:
sysctl -w net.ipv4.ip_forward=1
........ 但它不起作用。我将数据包从客户端发送到服务器,服务器将其写入 TUN 设备,但是当我检查 wirshark 时,“enp0s3”上没有任何显示,即它没有被路由,也没有发送到最终主机。
有人有解决办法吗?谢谢。
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。