Почему нет пинга между сетями?

Question

[Михаил]

Есть LEDE project на TP-link wr-942n.
Хочу 2 порта LAN порта использовать под одну сеть, и 2 LAN под другую.
Сети поднял, интерфейс пингую. Но не пингую хосты между сетями, хотя маршруты есть. В чем может быть причина?

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.6.30 0.0.0.0 UG 0 0 0 eth0
10.80.0.0 * 255.255.255.0 U 0 0 0 eth1.10
192.168.1.0 * 255.255.255.0 U 0 0 0 br-lan
192.168.6.0 * 255.255.255.0 U 0 0 0 eth0
192.168.6.30 * 255.255.255.255 UH 0 0 0 eth0

root@LEDE:/etc/config# cat network

config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fdfa:5209:ba5e::/48'

config interface 'lan'
option type 'bridge'
option ifname 'eth1.1'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'

config interface 'wan'
option ifname 'eth0'
option proto 'dhcp'

config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'

config switch_vlan
option device 'switch0'
option vlan '1'
option vid '1'
option ports '0t 1 4'

config interface 'test'
option proto 'static'
option ipaddr '10.80.0.1'
option netmask '255.255.255.0'
option broadcast '10.80.0.255'
option _orig_ifname 'eth1.1'
option _orig_bridge 'false'
option ifname 'eth1.10'

config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0t 2 3'
option vid '10'

Comments

[p2n]

Может файервол режет? Вывод iptables-save можно привести?

[Михаил]

p2n, ничего не менял в правилах, все как после установки.

spoiler

iptables -L -n -v
Chain INPUT (policy ACCEPT 1144 packets, 156K bytes)
pkts bytes target prot opt in out source destination
512 51796 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */
921K 258M input_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: user chain for input */
26490 5785K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED /* !fw3 */
39 2028 syn_flood tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 /* !fw3 */
27345 3550K zone_lan_input all -- br-lan * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */
866K 249M zone_wan_input all -- eth0 * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
10M 11G forwarding_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: user chain for forwarding */
10M 11G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED /* !fw3 */
21209 4169K zone_lan_forward all -- br-lan * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */
0 0 zone_wan_forward all -- eth0 * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */
88 5132 reject all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain OUTPUT (policy ACCEPT 3 packets, 252 bytes)
pkts bytes target prot opt in out source destination
516 52108 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0 /* !fw3 */
35060 5845K output_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: user chain for output */
16556 3855K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED /* !fw3 */
51 14992 zone_lan_output all -- * br-lan 0.0.0.0/0 0.0.0.0/0 /* !fw3 */
18450 1975K zone_wan_output all -- * eth0 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain forwarding_lan_rule (1 references)
pkts bytes target prot opt in out source destination

Chain forwarding_rule (1 references)
pkts bytes target prot opt in out source destination

Chain forwarding_wan_rule (1 references)
pkts bytes target prot opt in out source destination

Chain input_lan_rule (1 references)
pkts bytes target prot opt in out source destination

Chain input_rule (1 references)
pkts bytes target prot opt in out source destination

Chain input_wan_rule (1 references)
pkts bytes target prot opt in out source destination

Chain output_lan_rule (1 references)
pkts bytes target prot opt in out source destination

Chain output_rule (1 references)
pkts bytes target prot opt in out source destination

Chain output_wan_rule (1 references)
pkts bytes target prot opt in out source destination

Chain reject (3 references)
pkts bytes target prot opt in out source destination
110 11944 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */ reject-with tcp-reset
510K 132M REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */ reject-with icmp-port-unreachable

Chain syn_flood (1 references)
pkts bytes target prot opt in out source destination
39 2028 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 limit: avg 25/sec burst 50 /* !fw3 */
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain zone_lan_dest_ACCEPT (4 references)
pkts bytes target prot opt in out source destination
51 14992 ACCEPT all -- * br-lan 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain zone_lan_forward (1 references)
pkts bytes target prot opt in out source destination
21209 4169K forwarding_lan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: user chain for forwarding */
21209 4169K zone_wan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: forwarding lan -> wan */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* !fw3: Accept port forwards */
58 3620 zone_lan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain zone_lan_input (1 references)
pkts bytes target prot opt in out source destination
27345 3550K input_lan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: user chain for input */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* !fw3: Accept port redirections */
27345 3550K zone_lan_src_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain zone_lan_output (1 references)
pkts bytes target prot opt in out source destination
51 14992 output_lan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: user chain for output */
51 14992 zone_lan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain zone_lan_src_ACCEPT (1 references)
pkts bytes target prot opt in out source destination
27345 3550K ACCEPT all -- br-lan * 0.0.0.0/0 0.0.0.0/0 ctstate NEW,UNTRACKED /* !fw3 */

Chain zone_wan_dest_ACCEPT (2 references)
pkts bytes target prot opt in out source destination
1078 47809 DROP all -- * eth0 0.0.0.0/0 0.0.0.0/0 ctstate INVALID /* !fw3: Prevent NAT leakage */
38523 6092K ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain zone_wan_dest_REJECT (1 references)
pkts bytes target prot opt in out source destination
0 0 reject all -- * eth0 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain zone_wan_forward (1 references)
pkts bytes target prot opt in out source destination
0 0 forwarding_wan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: user chain for forwarding */
0 0 zone_lan_dest_ACCEPT esp -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: Allow-IPSec-ESP */
0 0 zone_lan_dest_ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:500 /* !fw3: Allow-ISAKMP */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* !fw3: Accept port forwards */
0 0 zone_wan_dest_REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain zone_wan_input (1 references)
pkts bytes target prot opt in out source destination
866K 249M input_wan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: user chain for input */
356K 117M ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:68 /* !fw3: Allow-DHCP-Renew */
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8 /* !fw3: Allow-Ping */
0 0 ACCEPT 2 -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: Allow-IGMP */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* !fw3: Accept port redirections */
510K 132M zone_wan_src_REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain zone_wan_output (1 references)
pkts bytes target prot opt in out source destination
18450 1975K output_wan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3: user chain for output */
18450 1975K zone_wan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

Chain zone_wan_src_REJECT (1 references)
pkts bytes target prot opt in out source destination
510K 132M reject all -- eth0 * 0.0.0.0/0 0.0.0.0/0 /* !fw3 */

[Михаил]

p2n,

spoiler

# Generated by iptables-save v1.6.1 on Mon Sep 25 05:47:46 2017
*nat
:PREROUTING ACCEPT [883148:202629820]
:INPUT ACCEPT [7571:1258816]
:OUTPUT ACCEPT [18369:1977930]
:POSTROUTING ACCEPT [100:12793]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -m comment --comment "!fw3: user chain for prerouting" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_wan_prerouting
-A POSTROUTING -m comment --comment "!fw3: user chain for postrouting" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_wan_postrouting
-A zone_lan_postrouting -m comment --comment "!fw3: user chain for postrouting" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: user chain for prerouting" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: user chain for postrouting" -j postrouting_wan_rule
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_wan_prerouting -m comment --comment "!fw3: user chain for prerouting" -j prerouting_wan_rule
COMMIT
# Completed on Mon Sep 25 05:47:46 2017
# Generated by iptables-save v1.6.1 on Mon Sep 25 05:47:46 2017
*mangle
:PREROUTING ACCEPT [11403825:11086247234]
:INPUT ACCEPT [922122:258317846]
:FORWARD ACCEPT [10134372:10761757755]
:OUTPUT ACCEPT [36296:6142829]
:POSTROUTING ACCEPT [10169498:10767847483]
-A FORWARD -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: wan (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Mon Sep 25 05:47:46 2017
# Generated by iptables-save v1.6.1 on Mon Sep 25 05:47:46 2017
*filter
:INPUT ACCEPT [1144:156150]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [3:252]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: user chain for input" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_wan_input
-A FORWARD -m comment --comment "!fw3: user chain for forwarding" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: user chain for output" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_wan_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: user chain for forwarding" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: forwarding lan -> wan" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: user chain for input" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: user chain for output" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth0 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: user chain for forwarding" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: user chain for input" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "!fw3: user chain for output" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth0 -m comment --comment "!fw3" -j reject
COMMIT

[p2n]

У вас политика DROP для цепочки FORWARD и нет разрешающего правила для хождения пакетов из одной сети в другую. Попробуйте добавить это правило

iptables -A forwarding_rule -i eth1.+ -o eth1.+ -j ACCEPT