我試圖將 Ubuntu 用作某種路由器，將我的專用網路上的電腦限制為它可以連接到互聯網上的電腦。
Ubuntu 盒子有兩個 NIC，一個面向互聯網 (enp0s3)，一個面向這台私人 PC (enp0s8)。
首先，我想看看是否可以透過 Ubuntu 允許來自私人盒子的 DNS。我按照一些說明添加了一些“路由允許”規則，例如它的結果：
ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), allow (routed)
New profiles: skip
To Action From
-- ------ ----
8.8.8.8 on enp0s3 ALLOW FWD Anywhere on enp0s8
8.8.4.4 on enp0s3 ALLOW FWD Anywhere on enp0s8
10.0.1.5 on enp0s8 ALLOW FWD Anywhere on enp0s3
10.0.1.5 是我的私人電腦。使用 Wireshark，我可以看到 enp0s3 和 enp0s8 上都發出 DNS 請求，但 enp0s3 上的請求沒有回應。
因此，在閱讀了更多內容之後，我發現我需要設定 NAT 和偽裝，因此我將以下內容放入了 Rules.before 中：
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Forward traffic through eth0 - Change to match you out-interface
-A POSTROUTING -s 10.0.1.0/24 -o enp0s3 -j MASQUERADE
# don't delete the 'COMMIT' line or these nat table rules won't
# be processed
COMMIT
這很有效——但是太好了。現在所有流量都流出並返回到我的私人電腦，預設拒絕傳出和其他 UFW 規則似乎都被繞過了。
所以我的問題很簡單 - 我希望私人 PC 透過 Ubuntu 獲得連接，例如提供的 NAT，但具有傳出限制，正如我最初使用 ufw 命令列配置的那樣。有沒有一種方法可以讓 UFW 規則在 NAT 完成其工作後以某種方式應用？
TIA。
這是完整的 before.rules 檔案。我唯一的改變是 NAT 表規則：
#
# rules.before
#
# Rules that should be run before the ufw command line added rules. Custom
# rules should be added to one of these chains:
# ufw-before-input
# ufw-before-output
# ufw-before-forward
#
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Forward traffic through eth0 - Change to match you out-interface
-A POSTROUTING -s 10.0.1.0/24 -o enp0s3 -j MASQUERADE
# don't delete the 'COMMIT' line or these nat table rules won't
# be processed
COMMIT
# Don't delete these required lines, otherwise there will be errors
*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
# End required lines
# allow all on loopback
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT
# quickly process packets for which we already have a connection
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# drop INVALID packets (logs these in loglevel medium and higher)
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
# ok icmp codes for INPUT
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
# ok icmp code for FORWARD
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT
# allow dhcp client to work
-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT
#
# ufw-not-local
#
-A ufw-before-input -j ufw-not-local
# if LOCAL, RETURN
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
# if MULTICAST, RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
# if BROADCAST, RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
# all other non-local packets are dropped
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above
# is uncommented)
-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT
# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above
# is uncommented)
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT
# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT
答案1
看來路由/轉送規則是完全分開到正常的防火牆規則。我將 NAT 內容移至 after.rules，並將「路由」流量的預設規則變更為「拒絕」。似乎發生了 POSTROUTING後應用預設拒絕規則 - 因此，如果預設規則拒絕某些內容，則不會將其路由出去。當然可以新增使用者規則（「ufw 路由允許...」類型），並且它們可以在應用預設拒絕之前允許流量，然後將按預期路由出去。