MSfree hat geschrieben: 
31.05.2024 08:13:28
kreuzschnabel hat geschrieben: 30.05.2024 23:03:38
Ansonsten läufts perfekt, soweit ich sehe. Ich warte noch etwas auf Ideen, und wenn keiner eine hat und kein Update die Sache richtet, kommt halt wieder stable drauf :/
Oben wird ja geraten, zu prüfen, ob
iptables etwas blockiert.
Wo wird das empfohlen? Ich habe nur im ersten Posting die Ausgabe von iptables angegeben.
Allerdings gilt iptables als veraltet und ist schon länger durch nftables ersetzt worden, iptables exisitiert noch zur Kompatibilität mit alten Filterregeln. Das Äquivalent zum iptables-Befehl wäre:
Damit hab ich mich noch nie befasst (und selbst garantiert nichts dran geschraubt), hier bitte:
Code: Alles auswählen
root@marvin:/home/volker# nft list ruleset
table inet firewalld {
chain mangle_PREROUTING {
type filter hook prerouting priority mangle + 10; policy accept;
jump mangle_PREROUTING_POLICIES
}
chain mangle_PREROUTING_POLICIES {
iifname "enp0s31f6" jump mangle_PRE_policy_allow-host-ipv6
iifname "enp0s31f6" jump mangle_PRE_public
iifname "enp0s31f6" return
jump mangle_PRE_policy_allow-host-ipv6
jump mangle_PRE_public
return
}
chain nat_PREROUTING {
type nat hook prerouting priority dstnat + 10; policy accept;
jump nat_PREROUTING_POLICIES
}
chain nat_PREROUTING_POLICIES {
iifname "enp0s31f6" jump nat_PRE_policy_allow-host-ipv6
iifname "enp0s31f6" jump nat_PRE_public
iifname "enp0s31f6" return
jump nat_PRE_policy_allow-host-ipv6
jump nat_PRE_public
return
}
chain nat_POSTROUTING {
type nat hook postrouting priority srcnat + 10; policy accept;
jump nat_POSTROUTING_POLICIES
}
chain nat_POSTROUTING_POLICIES {
iifname "enp0s31f6" oifname "enp0s31f6" jump nat_POST_public
iifname "enp0s31f6" oifname "enp0s31f6" return
oifname "enp0s31f6" jump nat_POST_public
oifname "enp0s31f6" return
iifname "enp0s31f6" jump nat_POST_public
iifname "enp0s31f6" return
jump nat_POST_public
return
}
chain nat_OUTPUT {
type nat hook output priority dstnat + 10; policy accept;
jump nat_OUTPUT_POLICIES
}
chain nat_OUTPUT_POLICIES {
oifname "enp0s31f6" jump nat_OUT_public
oifname "enp0s31f6" return
jump nat_OUT_public
return
}
chain filter_PREROUTING {
type filter hook prerouting priority filter + 10; policy accept;
icmpv6 type { nd-router-advert, nd-neighbor-solicit } accept
meta nfproto ipv6 fib saddr . mark . iif oif missing drop
}
chain filter_INPUT {
type filter hook input priority filter + 10; policy accept;
ct state { established, related } accept
ct status dnat accept
iifname "lo" accept
ct state invalid drop
jump filter_INPUT_POLICIES
reject with icmpx admin-prohibited
}
chain filter_FORWARD {
type filter hook forward priority filter + 10; policy accept;
ct state { established, related } accept
ct status dnat accept
iifname "lo" accept
ct state invalid drop
ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
jump filter_FORWARD_POLICIES
reject with icmpx admin-prohibited
}
chain filter_OUTPUT {
type filter hook output priority filter + 10; policy accept;
ct state { established, related } accept
oifname "lo" accept
ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
jump filter_OUTPUT_POLICIES
}
chain filter_INPUT_POLICIES {
iifname "enp0s31f6" jump filter_IN_policy_allow-host-ipv6
iifname "enp0s31f6" jump filter_IN_public
iifname "enp0s31f6" reject with icmpx admin-prohibited
jump filter_IN_policy_allow-host-ipv6
jump filter_IN_public
reject with icmpx admin-prohibited
}
chain filter_FORWARD_POLICIES {
iifname "enp0s31f6" oifname "enp0s31f6" jump filter_FWD_public
iifname "enp0s31f6" oifname "enp0s31f6" reject with icmpx admin-prohibited
iifname "enp0s31f6" jump filter_FWD_public
iifname "enp0s31f6" reject with icmpx admin-prohibited
oifname "enp0s31f6" jump filter_FWD_public
oifname "enp0s31f6" reject with icmpx admin-prohibited
jump filter_FWD_public
reject with icmpx admin-prohibited
}
chain filter_OUTPUT_POLICIES {
oifname "enp0s31f6" jump filter_OUT_public
oifname "enp0s31f6" return
jump filter_OUT_public
return
}
chain filter_IN_public {
jump filter_IN_public_pre
jump filter_IN_public_log
jump filter_IN_public_deny
jump filter_IN_public_allow
jump filter_IN_public_post
meta l4proto { icmp, ipv6-icmp } accept
}
chain filter_IN_public_pre {
}
chain filter_IN_public_log {
}
chain filter_IN_public_deny {
}
chain filter_IN_public_allow {
tcp dport 22 accept
ip6 daddr fe80::/64 udp dport 546 accept
}
chain filter_IN_public_post {
}
chain filter_OUT_public {
jump filter_OUT_public_pre
jump filter_OUT_public_log
jump filter_OUT_public_deny
jump filter_OUT_public_allow
jump filter_OUT_public_post
}
chain filter_OUT_public_pre {
}
chain filter_OUT_public_log {
}
chain filter_OUT_public_deny {
}
chain filter_OUT_public_allow {
}
chain filter_OUT_public_post {
}
chain nat_OUT_public {
jump nat_OUT_public_pre
jump nat_OUT_public_log
jump nat_OUT_public_deny
jump nat_OUT_public_allow
jump nat_OUT_public_post
}
chain nat_OUT_public_pre {
}
chain nat_OUT_public_log {
}
chain nat_OUT_public_deny {
}
chain nat_OUT_public_allow {
}
chain nat_OUT_public_post {
}
chain nat_POST_public {
jump nat_POST_public_pre
jump nat_POST_public_log
jump nat_POST_public_deny
jump nat_POST_public_allow
jump nat_POST_public_post
}
chain nat_POST_public_pre {
}
chain nat_POST_public_log {
}
chain nat_POST_public_deny {
}
chain nat_POST_public_allow {
}
chain nat_POST_public_post {
}
chain filter_FWD_public {
jump filter_FWD_public_pre
jump filter_FWD_public_log
jump filter_FWD_public_deny
jump filter_FWD_public_allow
jump filter_FWD_public_post
}
chain filter_FWD_public_pre {
}
chain filter_FWD_public_log {
}
chain filter_FWD_public_deny {
}
chain filter_FWD_public_allow {
oifname "enp0s31f6" accept
}
chain filter_FWD_public_post {
}
chain nat_PRE_public {
jump nat_PRE_public_pre
jump nat_PRE_public_log
jump nat_PRE_public_deny
jump nat_PRE_public_allow
jump nat_PRE_public_post
}
chain nat_PRE_public_pre {
}
chain nat_PRE_public_log {
}
chain nat_PRE_public_deny {
}
chain nat_PRE_public_allow {
}
chain nat_PRE_public_post {
}
chain mangle_PRE_public {
jump mangle_PRE_public_pre
jump mangle_PRE_public_log
jump mangle_PRE_public_deny
jump mangle_PRE_public_allow
jump mangle_PRE_public_post
}
chain mangle_PRE_public_pre {
}
chain mangle_PRE_public_log {
}
chain mangle_PRE_public_deny {
}
chain mangle_PRE_public_allow {
}
chain mangle_PRE_public_post {
}
chain filter_IN_policy_allow-host-ipv6 {
jump filter_IN_policy_allow-host-ipv6_pre
jump filter_IN_policy_allow-host-ipv6_log
jump filter_IN_policy_allow-host-ipv6_deny
jump filter_IN_policy_allow-host-ipv6_allow
jump filter_IN_policy_allow-host-ipv6_post
}
chain filter_IN_policy_allow-host-ipv6_pre {
}
chain filter_IN_policy_allow-host-ipv6_log {
}
chain filter_IN_policy_allow-host-ipv6_deny {
}
chain filter_IN_policy_allow-host-ipv6_allow {
icmpv6 type nd-neighbor-advert accept
icmpv6 type nd-neighbor-solicit accept
icmpv6 type nd-router-advert accept
icmpv6 type nd-redirect accept
}
chain filter_IN_policy_allow-host-ipv6_post {
}
chain nat_PRE_policy_allow-host-ipv6 {
jump nat_PRE_policy_allow-host-ipv6_pre
jump nat_PRE_policy_allow-host-ipv6_log
jump nat_PRE_policy_allow-host-ipv6_deny
jump nat_PRE_policy_allow-host-ipv6_allow
jump nat_PRE_policy_allow-host-ipv6_post
}
chain nat_PRE_policy_allow-host-ipv6_pre {
}
chain nat_PRE_policy_allow-host-ipv6_log {
}
chain nat_PRE_policy_allow-host-ipv6_deny {
}
chain nat_PRE_policy_allow-host-ipv6_allow {
}
chain nat_PRE_policy_allow-host-ipv6_post {
}
chain mangle_PRE_policy_allow-host-ipv6 {
jump mangle_PRE_policy_allow-host-ipv6_pre
jump mangle_PRE_policy_allow-host-ipv6_log
jump mangle_PRE_policy_allow-host-ipv6_deny
jump mangle_PRE_policy_allow-host-ipv6_allow
jump mangle_PRE_policy_allow-host-ipv6_post
}
chain mangle_PRE_policy_allow-host-ipv6_pre {
}
chain mangle_PRE_policy_allow-host-ipv6_log {
}
chain mangle_PRE_policy_allow-host-ipv6_deny {
}
chain mangle_PRE_policy_allow-host-ipv6_allow {
}
chain mangle_PRE_policy_allow-host-ipv6_post {
}
}
root@marvin:/home/volker#
Ansonsten spricht eine Fehlermeldung wie no route to host eher dafür, daß im Netzwerk etwas falsch konfiguriert ist.
In der Netzwerkumgebung hat sich – außer dem Rechner „marvin“ selbst – nichts geändert.
Das ist typischerweise dann der Fall, wenn man sein Netzwerk teilweise oder vollständig mit statischen IP-Adressen konfiguriert statt DHCP zu nutzen. Mit DHCP entstehen solche Fehler nicht, bei menschlicher Manuellkonfiguration schon.
Ist mir klar, dass sich da Zahlendreher einschleichen können. Aber das ist hier nicht der Fall, die statische IP von marvin ist ja problemlos von eddie aus pingbar. Deshalb ist mir das „no route to host“ auch ein Rätsel. Da ich marvin von mehreren Stellen aus als Server beanspruche, ist mir die statische IP lieber, um nicht auch noch Auflösungsproblemen von Hostnamen begegnen zu müssen
Der Host ist jedenfalls da, einen simplen IP-Konflikt schließe ich aus:
Code: Alles auswählen
root@marvin:/home/volker# nmap -sP 192.168.0/24
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-31 08:44 CEST
Nmap scan report for fritz.box (192.168.0.1)
Host is up (0.0016s latency).
[…]
Nmap scan report for marvin.fritz.box (192.168.0.10)
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 6.22 seconds
root@marvin:/home/volker#
--ks
Hier so: Debian Stable/Sid (nach Laune) – KDE Plasma – Lenovo Thinkpad T470p – i7-7700HQ – 32GB RAM
