☰

本機上的 ping 沒有回應

tag-icon • tag-icon networking
本機上的 ping 沒有回應

我正在嘗試 ping 透過 ssh 連接的遠端電腦上的環回，但是我沒有收到任何答案。

$ ping localhost
PING localhost (127.0.0.1) 56(84) bytes of data.
^C
--- localhost ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 100ms

接下來，我運行了一些診斷程序來查看問題所在，但在我未經訓練的眼睛看來，一切似乎都很正常。

$ cat /etc/hosts
# Your system has configured 'manage_etc_hosts' as True.
# As a result, if you wish for changes to this file to persist
# then you will need to either
# a.) make changes to the master file in /etc/cloud/templates/hosts.debian.tmpl
# b.) change or remove the value of 'manage_etc_hosts' in
#     /etc/cloud/cloud.cfg or cloud-config from user-data
#
127.0.1.1 <name_of_device>
127.0.0.1 localhost

# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

$ ifconfig lo
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 52  bytes 4188 (4.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 52  bytes 4188 (4.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

$ sysctl net.ipv4.icmp_echo_ignore_all
net.ipv4.icmp_echo_ignore_all = 0

$ cat /etc/resolv.conf 
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 67.207.67.2
nameserver 67.207.67.3

$ sudo iptables -L 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

$ uname -a
Linux <name_of_device> 4.19.0-10-cloud-amd64 #1 SMP Debian 4.19.132-1 (2020-07-24) x86_64 GNU/Linux

$ cat /etc/nftables.conf 
# /usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0;

        # Always allow SSH access
        tcp dport 22 accept

        ct state established,related log prefix "DROPPING PACKET: " drop

        ip saddr 192.0.2.192/27 accept
        ip saddr 192.0.2.96/27 accept
        ip saddr 192.0.2.0/24 drop

        ip saddr 198.51.100.69/32 accept
        ip saddr 198.51.100.42/32 log prefix "DROPPING PACKET: " drop
        ip saddr 198.51.100.32/28 accept
        ip saddr 199.51.100.0/24 tcp dport { 80, 443 } accept
        ip saddr 199.51.100.0/24 drop

        ip saddr 203.0.113.0/24 tcp dport { 22, 443, 5432 } log prefix "INVALID TRAFFIC NETWORK: " drop
        ip saddr 203.0.113.0/24 tcp dport 80 accept
    }
}

此外，這台機器無法 ping 通 Internet 上的任何內容。

$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 55ms

而且從外部也無法 ping 通它。

$ ping 138.68.93.123
PING 138.68.93.123 (138.68.93.123) 56(84) bytes of data.
64 bytes from 138.68.93.123: icmp_seq=1 ttl=52 time=7.75 ms
^C
--- 138.68.93.123 ping statistics ---
5 packets transmitted, 1 received, 80% packet loss, time 4050ms
rtt min/avg/max/mdev = 7.746/7.746/7.746/0.000 ms

此時我已經沒有想法了。任何幫助將不勝感激！

答案1

原因就在於此 - 規則 ct state [....] 會丟棄所有傳入封包，即使它們與 ping 到 localhost 介面相關。您應該重新考慮該規則...您至少應該允許環回介面上的流量...

相關內容