<div dir="ltr"><div>iptable info :</div><div><br></div><div>root@ubuntu:/usr/local/etc# iptables -L -t nat</div><div>Chain PREROUTING (policy ACCEPT)</div><div>target prot opt source destination </div>
<div><br></div><div>Chain INPUT (policy ACCEPT)</div><div>target prot opt source destination </div><div><br></div><div>Chain OUTPUT (policy ACCEPT)</div><div>target prot opt source destination </div>
<div><br></div><div>Chain POSTROUTING (policy ACCEPT)</div><div>target prot opt source destination </div><div>MASQUERADE tcp -- <a href="http://192.168.122.0/24">192.168.122.0/24</a> !<a href="http://192.168.122.0/24">192.168.122.0/24</a> masq ports: 1024-65535</div>
<div>MASQUERADE udp -- <a href="http://192.168.122.0/24">192.168.122.0/24</a> !<a href="http://192.168.122.0/24">192.168.122.0/24</a> masq ports: 1024-65535</div><div>MASQUERADE all -- <a href="http://192.168.122.0/24">192.168.122.0/24</a> !<a href="http://192.168.122.0/24">192.168.122.0/24</a> </div>
<div>SNAT all -- <a href="http://192.168.5.0/24">192.168.5.0/24</a> anywhere to:10.4.0.1</div><div>root@ubuntu:/usr/local/etc# iptables -L -v</div><div>Chain INPUT (policy ACCEPT 234 packets, 24245 bytes)</div>
<div> pkts bytes target prot opt in out source destination </div><div><br></div><div>Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)</div><div> pkts bytes target prot opt in out source destination </div>
<div> 0 0 ACCEPT all -- eth1 eth0 <a href="http://192.168.5.0/24">192.168.5.0/24</a> anywhere </div><div> 0 0 ACCEPT all -- eth0 eth1 anywhere <a href="http://192.168.5.0/24">192.168.5.0/24</a> </div>
<div><br></div><div>Chain OUTPUT (policy ACCEPT 145 packets, 18811 bytes)</div><div> pkts bytes target prot opt in out source destination </div><div><br></div><div><br></div><div>root@ubuntu:/usr/local/etc# ping 192.168.5.133</div>
<div>PING 192.168.5.133 (192.168.5.133) 56(84) bytes of data.</div><div>^C</div><div>--- 192.168.5.133 ping statistics ---</div><div>7 packets transmitted, 0 received, 100% packet loss, time 6048ms</div><div><br></div></div>
<div class="gmail_extra"><br><br><div class="gmail_quote">2013/9/9 我爱臭豆腐 <span dir="ltr"><<a href="mailto:hao.wangbj@gmail.com" target="_blank">hao.wangbj@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>i change "<span style="font-size:14.399999618530273px;font-family:arial,sans-serif">Alice's physical IP" to 192.168.5.133</span></div><div>root@ubuntu:~# iptables -L -v</div>
<div>Chain INPUT (policy ACCEPT 1218 packets, 120K bytes)</div><div> pkts bytes target prot opt in out source destination </div><div> 0 0 ACCEPT udp -- virbr0 any anywhere anywhere udp dpt:domain</div>
<div> 0 0 ACCEPT tcp -- virbr0 any anywhere anywhere tcp dpt:domain</div><div> 0 0 ACCEPT udp -- virbr0 any anywhere anywhere udp dpt:bootps</div>
<div> 0 0 ACCEPT tcp -- virbr0 any anywhere anywhere tcp dpt:bootps</div><div><br></div><div>Chain FORWARD (policy ACCEPT 2 packets, 142 bytes)</div><div> pkts bytes target prot opt in out source destination </div>
<div> 0 0 ACCEPT all -- any virbr0 anywhere <a href="http://192.168.122.0/24" target="_blank">192.168.122.0/24</a> state RELATED,ESTABLISHED</div><div> 0 0 ACCEPT all -- virbr0 any <a href="http://192.168.122.0/24" target="_blank">192.168.122.0/24</a> anywhere </div>
<div> 0 0 ACCEPT all -- virbr0 virbr0 anywhere anywhere </div><div> 0 0 REJECT all -- any virbr0 anywhere anywhere reject-with icmp-port-unreachable</div>
<div> 0 0 REJECT all -- virbr0 any anywhere anywhere reject-with icmp-port-unreachable</div><div> 0 0 ACCEPT all -- eth1 eth0 <a href="http://192.168.5.0/24" target="_blank">192.168.5.0/24</a> <a href="http://10.4.0.0/24" target="_blank">10.4.0.0/24</a> </div>
<div> 0 0 ACCEPT all -- eth0 eth1 <a href="http://10.4.0.0/24" target="_blank">10.4.0.0/24</a> <a href="http://192.168.5.0/24" target="_blank">192.168.5.0/24</a> </div><div><br></div><div>
Chain OUTPUT (policy ACCEPT 800 packets, 115K bytes)</div>
<div> pkts bytes target prot opt in out source destination </div><div>root@ubuntu:~# ping 192.168.5.133</div><div>PING 192.168.5.133 (192.168.5.133) 56(84) bytes of data.</div><div>^C</div>
<div>--- 192.168.5.133 ping statistics ---</div><div>4 packets transmitted, 0 received, 100% packet loss, time 3000ms</div><div><br></div><div>root@ubuntu:~# ifconfig eth1</div><div class="im"><div>eth1 Link encap:Ethernet HWaddr 00:0b:2f:57:58:24 </div>
<div> inet addr:192.168.5.1 Bcast:192.168.5.255 Mask:255.255.255.0</div><div> inet6 addr: fe80::20b:2fff:fe57:5824/64 Scope:Link</div><div> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1</div>
</div><div> RX packets:4928 errors:0 dropped:0 overruns:0 frame:0</div><div> TX packets:450 errors:0 dropped:0 overruns:0 carrier:0</div><div> collisions:0 txqueuelen:1000 </div><div> RX bytes:303325 (303.3 KB) TX bytes:58532 (58.5 KB)</div>
<div><br></div><div>but Alice's ip cann't connect 192.168.5.1 gw :-(</div><div><br></div></div><div class="gmail_extra"><div><div class="h5"><br><br><div class="gmail_quote">2013/9/9 Martin Willi <span dir="ltr"><<a href="mailto:martin@strongswan.org" target="_blank">martin@strongswan.org</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<div><br>
> Sep 9 13:42:48 14[CHD] updown: iptables v1.4.12: host/network<br>
> `PH_IP_ALICE' not found<br>
<br>
</div>If you copy a raw updown script from the test suite, you'll have to<br>
replace some variables by the IP addresses of these hosts. PH_IP_ALICE<br>
stands for Alice's physical IP. It gets replaced automatically in the<br>
test suite, but you'll have to do this manually when copying such a<br>
file.<br>
<br>
Regards<br>
<span><font color="#888888">Martin<br>
<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div></div></div><div class="im">-- <br>我爱臭豆腐<br>老老实实做人 认认真真做事<br><a href="mailto:email%3Ahao.wangbj@gmail.com" target="_blank">email:hao.wangbj@gmail.com</a>
</div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>我爱臭豆腐<br>老老实实做人 认认真真做事<br><a href="mailto:email%3Ahao.wangbj@gmail.com" target="_blank">email:hao.wangbj@gmail.com</a>
</div>