如何解决无法在AWS中使用Iptables和Strongswan进行NAT IP
我刚刚配置了Strongswan,可以在AWS EC2实例上成功建立VPN隧道,但是流量存在问题,因为我们需要对EC2实例的私有IP地址进行NAT,以便所有流量都通过VPN来自特定的IP。
但是目前,如果我ping [DESTINATION_IP]地址,我的流量仍然来自我的专用IP。我在iptables中尝试了几个PREROUTING和POSTROUTING规则,但似乎没有任何效果。谁能解释这个问题可能是什么?
当前设置
在AWS Source / Destination中已禁用检查。
strongswan状态全部
Listening IP addresses:
[PRIVATE_IP]
Connections:
vpn: %any...[VPN_FIREWALL_IP] IKEv2,dpddelay=10s
vpn: local: [[ELASTIC_PUBLIC_IP]] uses pre-shared key authentication
vpn: remote: [[VPN_FIREWALL_IP]] uses pre-shared key authentication
vpn: child: 0.0.0.0/0 === [DESTINATION_IP]/32 TUNNEL,dpdaction=restart
Security Associations (1 up,0 connecting):
vpn[1]: ESTABLISHED 5 seconds ago,[PRIVATE_IP][[ELASTIC_PUBLIC_IP]]...[VPN_FIREWALL_IP][[VPN_FIREWALL_IP]]
vpn[1]: IKEv2 SPIs: 6055db442ef8607c_i* 3d2ec0bb945e9a2c_r,pre-shared key reauthentication in 7 hours
vpn[1]: IKE proposal: AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA1/MODP_2048
vpn{1}: INSTALLED,TUNNEL,reqid 1,ESP in UDP SPIs: ca9d2ca0_i df70a539_o
vpn{1}: AES_CBC_128/HMAC_SHA1_96,0 bytes_i,0 bytes_o,rekeying in 46 minutes
vpn{1}: [NAT_SOURCE_IP]/31 === [DESTINATION_IP]/32
ipsec.conf
config setup
charondebug="all"
uniqueids=no
conn %default
ikelifetime=28800s
keyexchange=ikev2
keylife=3600s
keyingtries=%forever
mobike=no
conn vpn
authby=psk
auto=start
dpddelay=10s
dpdtimeout=30s
dpdaction=restart
ike=aes128-sha256-prfsha1-modp2048!
esp=aes128-sha256-modp2048,aes128-sha1-modp2048!
left=%defaultroute
leftid=[ELASTIC_PUBLIC_IP]
leftsubnet=0.0.0.0/0
leftfirewall=yes
rightsubnet=[DESTINATION_IP]/32
right=[VPN_FIREWALL_IP]
rightid=[VPN_FIREWALL_IP]
type=tunnel
mark=100
iptables保存
*nat
:PREROUTING ACCEPT [9728:543855]
:INPUT ACCEPT [7882:388791]
:OUTPUT ACCEPT [20219:1527154]
:POSTROUTING ACCEPT [20725:1569658]
COMMIT
*filter
:INPUT ACCEPT [142:30437]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [188:34735]
-A FORWARD -s [DESTINATION_IP]/32 -d [NAT_SOURCE_IP]/31 -i eth0 -m policy --dir in --pol ipsec --reqid 1 --proto esp -j ACCEPT
-A FORWARD -s [NAT_SOURCE_IP]/31 -d [DESTINATION_IP]/32 -o eth0 -m policy --dir out --pol ipsec --reqid 1 --proto esp -j ACCEPT
COMMIT
解决方法
如果我正确理解您的问题,则您正在询问如何使用Strongswan在EC2实例上设置源NAT。我运行相同的设置,在本例中,遵循[1]中的iptables规则可提供所需的功能:
iptables -t nat -A POSTROUTING -s <NAT_SOURCE_IP>/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
iptables -t nat -A POSTROUTING -s <NAT_SOURCE_IP>/24 -o eth0 -j MASQUERADE
[1] https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。