我正在嘗試設定遠端 VPN 伺服器以從我的家用電腦存取互聯網。它位於租用的 AWS VPS 上，帶有Debian和Strongswan.它的目的是透過隧道接收我的流量，將其轉發到互聯網，接收來自互聯網的回應，然後透過隧道將它們轉發回我。我的電腦成功連接到它，它接收我的流量並將其轉發到互聯網，但它似乎沒有收到來自互聯網的回應，因此它無法按預期工作。Iptables顯示從隧道到 Internet 的傳出流量，但來自 Internet 的流量為零：
root@internal_aws_ip:/home/admin# iptables -L -nv
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
14667 2284K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
595 56329 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
3 168 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
13 7232 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:500
35 19992 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:4500
14 4592 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
8697 522K ACCEPT all -- * * 10.10.10.0/24 0.0.0.0/0 policy match dir in pol ipsec proto 50
0 0 ACCEPT all -- * * 0.0.0.0/0 10.10.10.0/24 policy match dir out pol ipsec proto 50
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 8639 packets, 3433K bytes)
pkts bytes target prot opt in out source destination
tcpdump也顯示從隧道到網路的流量，但沒有反向流量：
root@internal_aws_ip:/home/admin# tcpdump port not ssh
....
06:46:19.605227 IP #HOME_PC#.ipsec-nat-t > #AWS_VPS#.eu-central-1.compute.internal.ipsec-nat-t: UDP-encap: ESP(spi=0xcbf6e396,seq=0x43), length 100
06:46:19.605227 IP ip-10-10-10-1.eu-central-1.compute.internal.50576 > dns.google.domain: 38403+ A? dns.msftncsi.com. (34)
06:46:19.605284 IP ip-10-10-10-1.eu-central-1.compute.internal.50576 > dns.google.domain: 38403+ A? dns.msftncsi.com. (34)
06:46:20.119576 IP #HOME_PC#.ipsec-nat-t > #AWS_VPS#.eu-central-1.compute.internal.ipsec-nat-t: UDP-encap: ESP(spi=0xcbf6e396,seq=0x44), length 100
06:46:20.119576 IP ip-10-10-10-1.eu-central-1.compute.internal.61302 > dns.google.domain: 42466+ A? dns.msftncsi.com. (34)
06:46:20.119634 IP ip-10-10-10-1.eu-central-1.compute.internal.61302 > dns.google.domain: 42466+ A? dns.msftncsi.com. (34)
06:46:20.122526 IP #HOME_PC#.ipsec-nat-t > #AWS_VPS#.eu-central-1.compute.internal.ipsec-nat-t: UDP-encap: ESP(spi=0xcbf6e396,seq=0x45), length 100
06:46:20.122526 IP ip-10-10-10-1.eu-central-1.compute.internal.53026 > 82.221.107.34.bc.googleusercontent.com.http: Flags [S], seq 2356796043, win 65280, options [mss 1360,nop,wscale 8,nop,nop,sackOK], length 0
06:46:20.122580 IP ip-10-10-10-1.eu-central-1.compute.internal.53026 > 82.221.107.34.bc.googleusercontent.com.http: Flags [S], seq 2356796043, win 65280, options [mss 1320,nop,wscale 8,nop,nop,sackOK], length 0
06:46:20.122773 IP #HOME_PC#.ipsec-nat-t > #AWS_VPS#.eu-central-1.compute.internal.ipsec-nat-t: UDP-encap: ESP(spi=0xcbf6e396,seq=0x46), length 100
06:46:20.122773 IP ip-10-10-10-1.eu-central-1.compute.internal.53027 > 82.221.107.34.bc.googleusercontent.com.http: Flags [S], seq 2988801698, win 65280, options [mss 1360,nop,wscale 8,nop,nop,sackOK], length 0
06:46:20.122791 IP ip-10-10-10-1.eu-central-1.compute.internal.53027 > 82.221.107.34.bc.googleusercontent.com.http: Flags [S], seq 2988801698, win 65280, options [mss 1320,nop,wscale 8,nop,nop,sackOK], length 0
....
IPsec.conf 包含
config setup
uniqueids=never
charondebug="ike 2, knl 2, cfg 3, net 2, esp 2, dmn 2, mgr 2"
conn %default
keyexchange=ikev2
ike=aes128gcm16-sha2_256-prfsha256-ecp256,aes256-sha2_256-prfsha256-modp2048!
esp=aes128gcm16-sha2_256-ecp256,chacha20poly1305-sha512,aes256gcm16-ecp384,aes256-sha256,aes256-sha1!
fragmentation=yes
rekey=no
compress=yes
dpdaction=clear
left=%any
leftauth=pubkey
leftsourceip=#SERVER_IP#
leftid=#SERVER_IP#
leftcert=debian.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightauth=pubkey
rightsourceip=10.10.10.0/24
rightdns=8.8.8.8,8.8.4.4
conn ikev2-pubkey
auto=add
sysctl.conf包含（大多數註解掉的行未顯示）
# /etc/sysctl.conf - Configuration file for setting system variables
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
# Do not accept ICMP redirects (prevent MITM attacks)
net.ipv4.conf.all.accept_redirects = 0
# Do not send ICMP redirects (we are not a router)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.ip_no_pmtu_disc = 1
伺服器本身似乎可以與 Internet 正常運作，透過 IP 位址和網域進行 ping 操作均成功。
除了我正在談論的伺服器之外，我在類似的租賃 AWS VPS 上還有另一個類似的 VPN 伺服器。它與我的另一台家用電腦配合得很好。我找不到兩台伺服器配置之間的任何相關差異。
我對 Linux 伺服器的經驗很少。我還應該檢查什麼來找出原因？哪些其他資訊可以闡明情況？
UPD：iptables -t nat -L回复
....
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
ACCEPT all -- ip-10-10-10-0.eu-central-1.compute.internal/24 anywhere policy match dir out pol ipsec
MASQUERADE all -- ip-10-10-10-0.eu-central-1.compute.internal/24 anywhere
這是對的嗎？
答案1
這是我自己的錯。我在設定時很粗心，沒有檢查該 VPS 上的實際介面名稱就iptables寫了。這是一個不值得一提的愚蠢錯誤，但其他人可能會陷入這個陷阱，因此應用這種情況的答案可能會對某人有所幫助。eth0ens5