问题：
我没有使用IPv6的经验，并且遇到了一种奇怪的情况，即我无法通过运行以下curl命令来获取当前的IPv6:curl -6 ifconfig.io
# Generated by ip6tables-save v1.8.4 on Sat Dec 5 22:29:34 2020
*filter
:INPUT DROP [6935:499284]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [7153:517764]
:OUTGOING - [0:0]
:PRIVATE_ADDRS_FILTER - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec -j OUTGOING
-A FORWARD -m policy --dir out --pol ipsec -j ACCEPT
-A OUTGOING -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTGOING -j PRIVATE_ADDRS_FILTER
-A OUTGOING -m conntrack --ctstate NEW -m hashlimit --hashlimit-upto 5/sec --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-name NETSCANv6 -j ACCEPT
-A PRIVATE_ADDRS_FILTER -d fc00::/7 -j DROP
-A PRIVATE_ADDRS_FILTER -d fe80::/10 -j DROP
COMMIT
# Completed on Sat Dec 5 22:29:34 2020
# Generated by ip6tables-save v1.8.4 on Sat Dec 5 22:29:34 2020
*nat
:PREROUTING ACCEPT [22197:4322614]
:INPUT ACCEPT [4:784]
:OUTPUT ACCEPT [16:1296]
:POSTROUTING ACCEPT [16:1296]
-A POSTROUTING -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -m addrtype ! --src-type LOCAL -j MASQUERADE
COMMIT
# Completed on Sat Dec 5 22:29:34 2020
# Generated by ip6tables-save v1.8.4 on Sat Dec 5 22:29:34 2020
*mangle
:PREROUTING ACCEPT [29146:4825050]
:INPUT ACCEPT [6956:503400]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7153:517764]
:POSTROUTING ACCEPT [7153:517764]
-A FORWARD -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
COMMIT
# Completed on Sat Dec 5 22:29:34 2020
也许问题是PRIVATE_ADDRS_FILTER链？
iptables -A PRIVATE_ADDRS_FILTER -d 10.0.0.0/8 -j DROP
iptables -A PRIVATE_ADDRS_FILTER -d 172.16.0.0/12 -j DROP
iptables -A PRIVATE_ADDRS_FILTER -d 192.168.0.0/16 -j DROP
答案1：
你应该把整个PRIVATE_ADDRS_FILTER链都去掉，它阻止了到合法地址的流量，包括默认网关。
相关文章