{"id":836,"date":"2026-04-15T12:01:20","date_gmt":"2026-04-15T04:01:20","guid":{"rendered":"https:\/\/www.liaoxinghui.com\/?p=836"},"modified":"2026-04-15T12:01:20","modified_gmt":"2026-04-15T04:01:20","slug":"iptables-nat-table-kernel-module-dependency-deep-dive","status":"publish","type":"post","link":"https:\/\/www.liaoxinghui.com\/?p=836","title":{"rendered":"iptables NAT\u8868\u65e0\u6cd5\u52a0\u8f7d\uff1a\u5185\u6838\u6a21\u5757\u4f9d\u8d56\u94fe\u7684\u6df1\u5ea6\u6392\u67e5"},"content":{"rendered":"<h2>\u4e1a\u52a1\u573a\u666f<\/h2>\n<p>\u5728Kubernetes\u96c6\u7fa4\u8fd0\u7ef4\u4e2d\uff0c\u5f53Pod\u4e4b\u95f4\u8de8\u8282\u70b9\u901a\u4fe1\u5f02\u5e38\uff0cService\u65e0\u6cd5\u6b63\u5e38\u8f6c\u53d1\u6d41\u91cf\u65f6\uff0c\u521d\u6b65\u6392\u67e5\u7ecf\u5e38\u4f1a\u9047\u5230<code>iptables -t nat -L -n<\/code>\u62a5\u9519\uff1a<\/p>\n<pre><code>iptables v1.8.7: can&#039;t initialize iptables table `nat&#039;: Table does not exist<\/code><\/pre>\n<p>\u8fd9\u4e2a\u62a5\u9519\u770b\u8d77\u6765\u6307\u5411iptables\u547d\u4ee4\u672c\u8eab\uff0c\u4f46\u5b9e\u9645\u6839\u56e0\u5f80\u5f80\u5728<strong>\u5185\u6838\u6a21\u5757\u52a0\u8f7d\u987a\u5e8f<\/strong>\u6216<strong>\u6a21\u5757\u517c\u5bb9\u6027<\/strong>\u5c42\u9762\u3002<\/p>\n<p>\u672c\u6587\u5206\u6790\u57fa\u4e8e\u793e\u533a\u9ad8\u9891\u95ee\u9898\u63d0\u70bc\uff0c\u5047\u8bbe\u573a\u666f\u7ea6\u675f\u5982\u4e0b\uff1a<\/p>\n<ul>\n<li>Kubernetes 1.24+ \u96c6\u7fa4\uff0c\u5bb9\u5668\u7f51\u7edc\u63d2\u4ef6\u4f7f\u7528CNI\uff08cilium\u9664\u5916\uff09<\/li>\n<li>\u5185\u6838\u7248\u672c 5.4 \u6216 4.19\uff08\u5b58\u5728\u7248\u672c\u5dee\u5f02\u7684\u73af\u5883\uff09<\/li>\n<li>\u9700\u8981\u652f\u6301Service\u7684ClusterIP\u3001NodePort\u3001LoadBalancer\u4e09\u79cd\u7c7b\u578b<\/li>\n<li>\u90e8\u5206\u8282\u70b9\u53ef\u80fd\u8fd0\u884c\u7740AppArmor\u6216SELinux\u5b89\u5168\u7b56\u7565<\/li>\n<\/ul>\n<hr \/>\n<h2>\u95ee\u9898\u53d1\u73b0<\/h2>\n<p>\u5f53\u5728\u8282\u70b9\u4e0a\u6267\u884c<code>iptables -t nat -L -n<\/code>\u65f6\uff0c\u62a5\u9519\u4fe1\u606f\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"lang-bash language-bash bash\">$ iptables -t nat -L -n\niptables v1.8.7: can&#039;t initialize iptables table `nat&#039;: Table does not exist\n\n# \u5bf9\u6bd4filter\u8868&mdash;&mdash;\u6b63\u5e38\n$ iptables -t filter -L -n | head -10\nChain INPUT (policy ACCEPT)\ntarget     prot opt source               destination<\/code><\/pre>\n<p>filter\u8868\u80fd\u8bfb\uff0cnat\u8868\u4e0d\u884c\u3002\u8fd9\u4e2a\u5dee\u5f02\u662f\u91cd\u8981\u7ebf\u7d22\uff1afilter\u8868\u6b63\u5e38\u8bf4\u660eiptables\u547d\u4ee4\u672c\u8eab\u6ca1\u6709\u95ee\u9898\uff0c\u95ee\u9898\u5728\u4e8e\u5185\u6838\u5c42\u9762\u7684NAT\u652f\u6301\u4e0d\u53ef\u7528\u3002<\/p>\n<hr \/>\n<h2>\u6392\u67e5\u8def\u5f84<\/h2>\n<h3>\u7b2c\u4e00\u6b65\uff1a\u68c0\u67e5\u5185\u6838\u6a21\u5757\u72b6\u6001<\/h3>\n<pre><code class=\"lang-bash language-bash bash\">$ lsmod | grep -E &#039;ip_tables|iptable_nat|nf_nat|ip6_tables&#039;\n# \u8f93\u51fa\u4e3a\u7a7a&mdash;&mdash;\u6ca1\u6709\u4efb\u4f55netfilter\u76f8\u5173\u6a21\u5757\u52a0\u8f7d<\/code><\/pre>\n<p>\u6b63\u5e38\u60c5\u51b5\u4e0b\uff0c\u7cfb\u7edf\u542f\u52a8\u540enetfilter\u76f8\u5173\u6a21\u5757\u5e94\u8be5\u5df2\u81ea\u52a8\u52a0\u8f7d\u3002\u73b0\u5728\u6ca1\u6709\u4efb\u4f55\u8f93\u51fa\uff0c\u8bf4\u660e\u6a21\u5757\u6839\u672c\u6ca1\u6709\u52a0\u8f7d\u5230\u5185\u5b58\u4e2d\u3002<\/p>\n<h3>\u7b2c\u4e8c\u6b65\uff1a\u67e5\u770b\u5185\u6838\u65e5\u5fd7<\/h3>\n<pre><code class=\"lang-bash language-bash bash\">$ dmesg | grep -i &#039;netfilter\\|iptable\\|nat&#039; | tail -30\n# \u65e0\u76f8\u5173\u8f93\u51fa&mdash;&mdash;\u8bf4\u660e\u6a21\u5757\u52a0\u8f7d\u8fc7\u7a0b\u6839\u672c\u6ca1\u6709\u88ab\u89e6\u53d1\n\n# \u67e5\u770bsystemd-modules-load\u670d\u52a1\u65e5\u5fd7\n$ journalctl -b -u systemd-modules-load | tail -50\nMar 15 03:12:01 hostname systemd-modules-load[234]: Failed to insert &#039;iptable_nat&#039;: No such device\nMar 15 03:12:01 hostname systemd-modules-load[234]: Failed to insert &#039;ip_tables&#039;: No such device<\/code><\/pre>\n<p>&#8220;No such device&#8221;\u8fd9\u4e2a\u9519\u8bef\u4fe1\u606f\u5f88\u5173\u952e\u3002\u5b83\u4e0d\u662f\u8bf4\u6a21\u5757\u6587\u4ef6\u4e0d\u5b58\u5728\uff08\u90a3\u6837\u4f1a\u62a5&#8221;No such file or directory&#8221;\uff09\uff0c\u800c\u662f\u8bf4\u5185\u6838\u4e0d\u652f\u6301\u8fd9\u4e2a\u8bbe\u5907\u3002\u6362\u8a00\u4e4b\uff0c\u8fd9\u4e2a\u5185\u6838\u7f16\u8bd1\u65f6\u53ef\u80fd\u6ca1\u6709\u542f\u7528\u76f8\u5173CONFIG\u9009\u9879\uff0c\u6216\u8005\u6a21\u5757\u4e0e\u8fd0\u884c\u4e2d\u7684\u5185\u6838\u4e0d\u517c\u5bb9\u3002<\/p>\n<h3>\u7b2c\u4e09\u6b65\uff1a\u786e\u8ba4\u5185\u6838\u7f16\u8bd1\u914d\u7f6e<\/h3>\n<pre><code class=\"lang-bash language-bash bash\">$ uname -r\n4.19.0-18-amd64\n\n# \u68c0\u67e5\u5185\u6838\u7f16\u8bd1\u914d\u7f6e\uff08\u9700\u8981CONFIG_IKCONFIG_PROC\u542f\u7528\uff09\n$ zcat \/proc\/config.gz 2&gt;\/dev\/null | grep -E &#039;CONFIG_NETFILTER_XT_NAT|CONFIG_IP_NF_IPTABLES|CONFIG_NF_NAT&#039;\n\n# \u6216\u8005\u8bfb\u53d6\/boot\u76ee\u5f55\u4e0b\u7684\u914d\u7f6e\n$ cat \/boot\/config-4.19.0-18-amd64 | grep -E &#039;CONFIG_NETFILTER_XT_NAT|CONFIG_IP_NF_IPTABLES|CONFIG_NF_NAT&#039;\nCONFIG_NETFILTER_XT_MATCH_COMMENT=m\nCONFIG_NETFILTER_XT_NAT=m\nCONFIG_NF_NAT=m\nCONFIG_IP_NF_IPTABLES=m<\/code><\/pre>\n<p>\u914d\u7f6e\u9879\u5b58\u5728\uff08<code>=m<\/code>\u8868\u793a\u7f16\u8bd1\u4e3a\u6a21\u5757\uff09\uff0c\u90a3\u95ee\u9898\u51fa\u5728\u54ea\u91cc\uff1f<\/p>\n<h3>\u7b2c\u56db\u6b65\uff1a\u68c0\u67e5\u6a21\u5757\u4f9d\u8d56\u94fe<\/h3>\n<pre><code class=\"lang-bash language-bash bash\">$ modinfo iptable_nat | grep -E &#039;^filename|^depends&#039;\nfilename:       \/lib\/modules\/4.19.0-18-amd64\/kernel\/net\/ipv4\/netfilter\/iptable_nat.ko\ndepends:        ip_tables,nf_nat\n\n$ modinfo nf_nat | grep depends\ndepends:        nf_conntrack\n\n$ modinfo ip_tables | grep depends\ndepends:        \n# ip_tables\u662f\u57fa\u7840\u6a21\u5757\uff0c\u6ca1\u6709\u4f9d\u8d56<\/code><\/pre>\n<p>\u4f9d\u8d56\u94fe\u5f88\u6e05\u6670\uff1a<code>ip_tables<\/code> \u2192 <code>nf_nat<\/code> \u2192 <code>iptable_nat<\/code>\uff0c\u800c<code>nf_nat<\/code>\u4f9d\u8d56<code>nf_conntrack<\/code>\u3002<\/p>\n<p>\u624b\u52a8\u5c1d\u8bd5\u9010\u4e2a\u52a0\u8f7d\u6a21\u5757\uff1a<\/p>\n<pre><code class=\"lang-bash language-bash bash\">$ modprobe ip_tables\n# \u6210\u529f&mdash;&mdash;\u57fa\u7840\u6a21\u5757\u6ca1\u95ee\u9898\n\n$ modprobe nf_conntrack\n# \u6210\u529f\n\n$ modprobe nf_nat\n# \u6210\u529f\n\n$ modprobe iptable_nat\nmodprobe: FATAL: Module iptable_nat not found in directory \/lib\/modules\/4.19.0-18-amd64\/kernel\/net\/ipv4\/netfilter\/<\/code><\/pre>\n<p>\u6709\u610f\u601d\u7684\u73b0\u8c61\u51fa\u73b0\u4e86\uff1amodinfo\u80fd\u770b\u5230\u6a21\u5757\u8def\u5f84\uff0c\u4f46modprobe\u8bf4\u627e\u4e0d\u5230\u3002\u8fd9\u901a\u5e38\u610f\u5473\u7740\u6a21\u5757\u7b7e\u540d\u95ee\u9898\u6216\u8005\u5185\u6838\u6a21\u5757\u76ee\u5f55\u4e0e\u8fd0\u884c\u5185\u6838\u4e0d\u540c\u6b65\u3002<\/p>\n<h3>\u7b2c\u4e94\u6b65\uff1a\u5b9a\u4f4d\u771f\u6b63\u539f\u56e0<\/h3>\n<pre><code class=\"lang-bash language-bash bash\">$ ls -la \/lib\/modules\/4.19.0-18-amd64\/kernel\/net\/ipv4\/netfilter\/iptable_nat.ko\n-rw-r--r-- 1 root root 82234 Mar 15 2022 iptable_nat.ko\n\n$ modinfo \/lib\/modules\/4.19.0.18-amd64\/kernel\/net\/ipv4\/netfilter\/iptable_nat.ko\nfilename:       \/lib\/modules\/4.19.0-18-amd64\/kernel\/net\/ipv4\/netfilter\/iptable_nat.ko\nauthor:         Netfilter Core Team &lt;coreteam@netfilter.org&gt;\ndescription:    iptables NAT support for IPv4\nlicense:        GPL\nvermagic:       4.19.0-18-amd64 SMP mod_unload modversions\ndepends:        ip_tables,nf_nat\nsupported:      yes<\/code><\/pre>\n<p>\u7528<code>modprobe --show-depends<\/code>\u68c0\u67e5\uff1a<\/p>\n<pre><code class=\"lang-bash language-bash bash\">$ modprobe --show-depends iptable_nat\ninsmod \/lib\/modules\/4.19.0-18-amd64\/kernel\/net\/netfilter\/nf_conntrack.ko\ninsmod \/lib\/modules\/4.19.0-18-amd64\/kernel\/net\/ipv4\/netfilter\/nf_nat.ko\ninsmod \/lib\/modules\/4.19.0-18-amd64\/kernel\/net\/ipv4\/netfilter\/nf_nat_ipv4.ko\ninsmod \/lib\/modules\/4.19.0-18-amd64\/kernel\/net\/ipv4\/netfilter\/iptable_nat.ko<\/code><\/pre>\n<p>modprobe\u8ba4\u8bc6\u8fd9\u4e2a\u6a21\u5757\uff0c\u4e5f\u80fd\u89e3\u6790\u4f9d\u8d56\u94fe\uff0c\u4f46\u5b9e\u9645insmod\u65f6\u5931\u8d25\u4e86\u3002\u8fd9\u662f\u5178\u578b\u7684\u5185\u6838\u7b26\u53f7\u7248\u672c\u4e0d\u5339\u914d\uff08VERSION_MAGIC mismatch\uff09\u95ee\u9898\u3002<\/p>\n<p><strong>\u6839\u56e0\u786e\u8ba4<\/strong>\uff1a\u5185\u6838\u5728\u5b89\u88c5\u540e\u7ecf\u5386\u8fc7\u5c0f\u7248\u672c\u5347\u7ea7\uff08\u59824.19.0-17\u5347\u7ea7\u52304.19.0-18\uff09\uff0c\u4f46\u5185\u6838\u5934\u6587\u4ef6\u548c\u6a21\u5757\u76ee\u5f55\u6ca1\u6709\u540c\u6b65\u66f4\u65b0\uff0c\u5bfc\u81f4\u6a21\u5757\u7684vermagic\u4e0e\u8fd0\u884c\u5185\u6838\u7248\u672c\u6807\u8bc6\u4e0d\u5339\u914d\u3002<\/p>\n<hr \/>\n<h2>\u5019\u9009\u65b9\u6848\u5bf9\u6bd4<\/h2>\n<h3>\u65b9\u6848A\uff1a\u91cd\u5efa\u6a21\u5757\u7d22\u5f15<\/h3>\n<p>\u6700\u76f4\u63a5\u7684\u4fee\u590d\u624b\u6bb5\u662f\u5f3a\u5236\u91cd\u5efa\u6a21\u5757\u4f9d\u8d56\u7d22\u5f15\uff1a<\/p>\n<pre><code class=\"lang-bash language-bash bash\"># \u91cd\u5efa\u6a21\u5757\u4f9d\u8d56\ndepmod -a\n\n# \u518d\u6b21\u5c1d\u8bd5\u52a0\u8f7d\nmodprobe iptable_nat\n\n# \u9a8c\u8bc1\u7ed3\u679c\nlsmod | grep iptable_nat\niptables -t nat -L -n<\/code><\/pre>\n<p><strong>\u9002\u7528\u6761\u4ef6<\/strong>\uff1a<\/p>\n<ul>\n<li>\u6a21\u5757\u6587\u4ef6\u5b58\u5728\u4e8e\u6b63\u786e\u8def\u5f84\uff0c\u4e14vermagic\u53ea\u662f\u8f7b\u5fae\u4e0d\u5339\u914d<\/li>\n<li>depmod\u80fd\u81ea\u52a8\u4fee\u590d\u4f9d\u8d56\u7d22\u5f15\u548c\u6a21\u5757\u522b\u540d\u89e3\u6790<\/li>\n<\/ul>\n<p><strong>\u5c40\u9650<\/strong>\uff1a<\/p>\n<ul>\n<li>\u5982\u679c\u5185\u6838\u771f\u7684\u4e0d\u517c\u5bb9\uff0c\u8fd9\u4e2a\u65b9\u6cd5\u65e0\u6548<\/li>\n<li>\u90e8\u5206\u6a21\u5757\u52a0\u8f7d\u540e\u72b6\u6001\u91cd\u542f\u4f1a\u4e22\u5931\uff0c\u9700\u8981\u914d\u5408\u6301\u4e45\u5316\u914d\u7f6e<\/li>\n<\/ul>\n<hr \/>\n<h3>\u65b9\u6848B\uff1a\u624b\u52a8\u9010\u4e2a\u52a0\u8f7d\u6a21\u5757\uff08\u7ed5\u8fc7\u5206\u5c42\u4f9d\u8d56\u68c0\u67e5\uff09<\/h3>\n<pre><code class=\"lang-bash language-bash bash\"># \u5148\u52a0\u8f7d\u4f9d\u8d56\u94fe\u5e95\u5c42\u6a21\u5757\nmodprobe ip_tables\nmodprobe nf_conntrack\nmodprobe nf_nat\n\n# \u52a0\u8f7dnf_nat_ipv4\uff08\u7ecf\u5e38\u88ab\u5ffd\u7565\uff09\ninsmod \/lib\/modules\/$(uname -r)\/kernel\/net\/ipv4\/netfilter\/nf_nat_ipv4.ko\n\n# \u4f7f\u7528--force\u7ed5\u8fc7vermagic\u68c0\u67e5\uff08\u751f\u4ea7\u73af\u5883\u614e\u7528\uff09\nmodprobe --force iptable_nat\n\n# \u9a8c\u8bc1\niptables -t nat -L -n -v<\/code><\/pre>\n<p><strong>\u6ce8\u610f\u4e8b\u9879<\/strong>\uff1a<\/p>\n<ul>\n<li><code>--force<\/code>\u53c2\u6570\u4f1a\u7ed5\u8fc7\u5185\u6838\u6a21\u5757\u7b7e\u540d\u548c\u7248\u672c\u68c0\u67e5<\/li>\n<li>\u4ec5\u5728\u786e\u8ba4\u5185\u6838\u517c\u5bb9\u4e14\u53ea\u662f\u7d22\u5f15\u635f\u574f\u65f6\u4f7f\u7528<\/li>\n<li>\u8fd9\u79cd\u65b9\u5f0f\u52a0\u8f7d\u7684\u6a21\u5757\u5728\u91cd\u542f\u540e\u4f1a\u4e22\u5931\uff0c\u9700\u8981\u914d\u5408systemd unit\u6301\u4e45\u5316<\/li>\n<\/ul>\n<hr \/>\n<h3>\u65b9\u6848C\uff1a\u5207\u6362\u5bb9\u5668\u8fd0\u884c\u65f6\u7684iptables\u63a7\u5236\u6743<\/h3>\n<p>\u8fd9\u662f\u751f\u4ea7\u73af\u5883\u63a8\u8350\u65b9\u6848\u3002\u95ee\u9898\u80cc\u666f\uff1aDocker\u9ed8\u8ba4\u4f1a\u63a5\u7ba1\u7cfb\u7edf\u7684iptables\u89c4\u5219\uff0c\u5f53\u5185\u6838NAT\u652f\u6301\u4e0d\u53ef\u7528\u65f6\uff0c\u63a5\u7ba1\u884c\u4e3a\u4f1a\u9759\u9ed8\u5931\u8d25\uff0c\u5bfc\u81f4nat\u8868\u4e0d\u53ef\u7528\u3002<\/p>\n<pre><code class=\"lang-bash language-bash bash\"># \u7f16\u8f91Docker daemon\u914d\u7f6e\ncat &gt; \/etc\/docker\/daemon.json &lt;&lt; &#039;EOF&#039;\n{\n  &quot;iptables&quot;: false,\n  &quot;ip-masq&quot;: true,\n  &quot;ip-forward&quot;: true,\n  &quot;userland-proxy&quot;: true\n}\nEOF\n\n# \u91cd\u542fDocker\nsystemctl restart docker\n\n# \u9a8c\u8bc1NAT\u8868\u73b0\u5728\u53ef\u7528\u4e86\niptables -t nat -L -n -v<\/code><\/pre>\n<p><strong>\u539f\u7406<\/strong>\uff1a\u7981\u7528Docker\u5bf9iptables\u7684\u63a5\u7ba1\u540e\uff0cDocker\u6539\u7528userland-proxy\uff08\u4e00\u4e2aUserspace\u8fdb\u7a0b\uff09\u5904\u7406NAT\uff0c\u4e0d\u4f9d\u8d56\u5185\u6838\u6a21\u5757\u3002\u540c\u65f6\uff0cKubernetes CNI\u6210\u4e3aiptables\u7684\u552f\u4e00\u7ba1\u7406\u8005\uff0c\u8fb9\u754c\u6e05\u6670\u3002<\/p>\n<p><strong>\u6027\u80fd\u5f71\u54cd<\/strong>\uff1auserland-proxy\u662f\u8fdb\u7a0b\u7ea7\u8f6c\u53d1\uff0c\u6bd4\u5185\u6838NAT\u6162\u7ea62-3\u500d\u3002\u5bf9\u4e8e\u5927\u591a\u6570\u4e1a\u52a1\u573a\u666f\u53ef\u63a5\u53d7\u3002<\/p>\n<hr \/>\n<h3>\u65b9\u6848D\uff1a\u5347\u7ea7\u5230nftables<\/h3>\n<p>\u5728Ubuntu 22.04\uff08\u5185\u68385.15+\uff09\u73af\u5883\u4e2d\uff0c<code>iptable_nat<\/code>\u6a21\u5757\u5df2\u88ab\u6807\u8bb0\u4e3adeprecated\uff0c\u5185\u6838\u9ed8\u8ba4\u4f7f\u7528<code>nf_tables<\/code>\u540e\u7aef\u3002\u5f3a\u884c\u52a0\u8f7d\u4f1a\u62a5\u9519\uff1a<\/p>\n<pre><code class=\"lang-bash language-bash bash\">$ modprobe iptable_nat\nmodprobe: FATAL: Module iptable_nat not found in directory \/lib\/modules\/5.15.0-generic<\/code><\/pre>\n<p>\u8fd9\u8868\u793a<code>CONFIG_NETFILTER_XT_NAT<\/code>\u57285.15+\u9ed8\u8ba4\u4e0d\u542f\u7528\u3002\u5982\u679c\u73af\u5883\u662fUbuntu 22.04+\u6216Debian 12+\uff0c\u5e94\u8be5\u8003\u8651nftables\u65b9\u6848\uff1a<\/p>\n<pre><code class=\"lang-bash language-bash bash\"># \u68c0\u67e5\u5f53\u524d\u540e\u7aef\niptables --version\n# iptables v1.8.7 (nf_tables)\n\n# \u5b89\u88c5nftables\napt install -y nftables  # Debian\/Ubuntu\n# \u6216 yum install -y nftables  # CentOS\/RHEL\n\n# \u5907\u4efd\u73b0\u6709\u89c4\u5219\niptables-save &gt; \/tmp\/iptables_backup_$(date +%Y%m%d)\n\n# \u5207\u6362\u5230nftables\nsystemctl stop iptables\nsystemctl disable iptables\nsystemctl enable nftables\nsystemctl start nftables\n\n# \u9a8c\u8bc1\nnft list table ip nat<\/code><\/pre>\n<p><strong>\u5c40\u9650\u6027<\/strong>\uff1aKubernetes CNI\u63d2\u4ef6\uff08flannel\u3001calico\u7b49\uff09\u666e\u904d\u4e0d\u652f\u6301nftables\u539f\u751f\u540e\u7aef\uff0c\u9ed8\u8ba4\u90fd\u4f9d\u8d56iptables\u3002\u9664\u975e\u4f7f\u7528Cilium\uff0c\u5426\u5219\u4e0d\u8981\u9009\u8fd9\u4e2a\u65b9\u6848\u3002<\/p>\n<hr \/>\n<h2>\u65b9\u6848\u53d6\u820d<\/h2>\n<table>\n<thead>\n<tr>\n<th>\u7ef4\u5ea6<\/th>\n<th>\u65b9\u6848A\uff08depmod\u91cd\u5efa\uff09<\/th>\n<th>\u65b9\u6848B\uff08force modprobe\uff09<\/th>\n<th>\u65b9\u6848C\uff08\u7981\u7528Docker iptables\uff09<\/th>\n<th>\u65b9\u6848D\uff08nftables\uff09<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u6839\u56e0\u5339\u914d\u5ea6<\/td>\n<td>\u5339\u914d\u6a21\u5757\u7d22\u5f15\u635f\u574f\u573a\u666f<\/td>\n<td>\u5339\u914d\u7d22\u5f15\u635f\u574f\u4e14\u9700\u8981\u5feb\u901f\u751f\u6548<\/td>\n<td>\u5339\u914dDocker\u63a5\u7ba1\u51b2\u7a81\u573a\u666f<\/td>\n<td>\u5339\u914d5.15+\u5185\u6838\u4e14CNI\u652f\u6301nftables<\/td>\n<\/tr>\n<tr>\n<td>\u77ed\u671f\u751f\u6548<\/td>\n<td>\u9700\u8981\u91cd\u542f\u624d\u80fd\u5f7b\u5e95\u751f\u6548<\/td>\n<td>\u7acb\u5373\u751f\u6548<\/td>\n<td>\u7acb\u5373\u751f\u6548<\/td>\n<td>\u9700\u8981\u8fc1\u79fb\u89c4\u5219\u540e\u751f\u6548<\/td>\n<\/tr>\n<tr>\n<td>\u957f\u671f\u53ef\u7ef4\u62a4\u6027<\/td>\n<td>\u9ad8\uff08\u6839\u56e0\u4fee\u590d\uff09<\/td>\n<td>\u4f4e\uff08\u91cd\u542f\u4f1a\u4e22\uff09<\/td>\n<td>\u9ad8\uff08\u8fb9\u754c\u6e05\u6670\uff09<\/td>\n<td>\u4e2d\uff08\u4f9d\u8d56CNI\u652f\u6301\uff09<\/td>\n<\/tr>\n<tr>\n<td>\u98ce\u9669\u70b9<\/td>\n<td>\u53ef\u80fd\u65e0\u6548<\/td>\n<td>\u7ed5\u8fc7\u5b89\u5168\u68c0\u67e5<\/td>\n<td>NodePort\u8303\u56f4\u9700\u6ce8\u610f<\/td>\n<td>CNI\u517c\u5bb9\u6027\u9650\u5236<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>\u51b3\u7b56\u6307\u5f15<\/strong>\uff1a<\/p>\n<ul>\n<li>\u6a21\u5757\u7d22\u5f15\u635f\u574f\u4e14\u5185\u6838\u786e\u5b9e\u652f\u6301NAT \u2192 \u65b9\u6848A<\/li>\n<li>\u9700\u8981\u5feb\u901f\u6b62\u8840\u4e14Kubernetes CNI\u5df2\u63a5\u7ba1\u7f51\u7edc\u7ba1\u7406 \u2192 \u65b9\u6848C<\/li>\n<li>\u73af\u5883\u662fUbuntu 22.04+\u4e14CNI\u652f\u6301nftables \u2192 \u65b9\u6848D<\/li>\n<li>\u65b9\u6848B\u9002\u5408\u5e94\u6025\u4e34\u65f6\u4f7f\u7528\uff0c\u4e0d\u5efa\u8bae\u4f5c\u4e3a\u957f\u671f\u65b9\u6848<\/li>\n<\/ul>\n<hr \/>\n<h2>\u5b9e\u65bd\u6b65\u9aa4\uff08\u4ee5\u65b9\u6848C\u4e3a\u4f8b\uff09<\/h2>\n<h3>\u91cc\u7a0b\u78911\uff1a\u8bca\u65ad\u4e0e\u5907\u4efd<\/h3>\n<p><strong>\u4ea4\u4ed8\u7269<\/strong>\uff1a<\/p>\n<ul>\n<li>\u5f53\u524diptables\u89c4\u5219\u5b8c\u6574\u5907\u4efd<\/li>\n<li>\u5185\u6838\u6a21\u5757\u72b6\u6001\u5feb\u7167<\/li>\n<li>\u8282\u70b9\u7f51\u7edc\u8fde\u901a\u6027\u57fa\u7ebf\u6d4b\u8bd5\u7ed3\u679c<\/li>\n<\/ul>\n<p><strong>\u9a8c\u6536\u6807\u51c6<\/strong>\uff1a\u5907\u4efd\u6587\u4ef6\u53ef\u8bfb\uff0c\u57fa\u7ebf\u6d4b\u8bd5\u8bb0\u5f55\u4e86Pod-to-Pod\u3001Pod-to-Service\u7684\u5ef6\u8fdf\u548c\u4e22\u5305\u7387\u3002<\/p>\n<pre><code class=\"lang-bash language-bash bash\"># \u5728\u53d7\u5f71\u54cd\u7684\u8282\u70b9\u4e0a\u6267\u884c\n# 1. \u5907\u4efdiptables\u89c4\u5219\niptables-save &gt; \/tmp\/iptables_before_$(hostname)_$(date +%Y%m%d_%H%M).rules\n\n# 2. \u68c0\u67e5Docker iptables\u63a5\u7ba1\u72b6\u6001\niptables -L -n | grep -i docker\n\n# 3. \u8bb0\u5f55\u57fa\u7ebf\u8fde\u901a\u6027\uff08\u4ecePod\u5185\u6267\u884c\uff09\nkubectl exec -it test-pod -- ping -c 10 10.244.1.10\nkubectl exec -it test-pod -- wget --spider --timeout=5 kubernetes.default.svc:80<\/code><\/pre>\n<h3>\u91cc\u7a0b\u78912\uff1a\u914d\u7f6e\u53d8\u66f4<\/h3>\n<p><strong>\u4ea4\u4ed8\u7269<\/strong>\uff1a<\/p>\n<ul>\n<li>\/etc\/docker\/daemon.json\u914d\u7f6e\u53d8\u66f4<\/li>\n<li>Docker\u670d\u52a1\u91cd\u542f\u8bb0\u5f55<\/li>\n<\/ul>\n<p><strong>\u9a8c\u6536\u6807\u51c6<\/strong>\uff1aDocker\u8fdb\u7a0b\u91cd\u542f\u6210\u529f\uff0cdaemon.json\u8bed\u6cd5\u6821\u9a8c\u901a\u8fc7\u3002<\/p>\n<pre><code class=\"lang-bash language-bash bash\"># \u7f16\u8f91\u914d\u7f6e\u524d\u5148\u6821\u9a8cJSON\u8bed\u6cd5\ncat &gt; \/tmp\/docker_daemon.json &lt;&lt; &#039;EOF&#039;\n{\n  &quot;iptables&quot;: false,\n  &quot;ip-masq&quot;: true,\n  &quot;ip-forward&quot;: true,\n  &quot;userland-proxy&quot;: true\n}\nEOF\npython3 -c &quot;import json; json.load(open(&#039;\/tmp\/docker_daemon.json&#039;)); print(&#039;JSON valid&#039;)&quot;\n\n# \u5e94\u7528\u914d\u7f6e\ncp \/tmp\/docker_daemon.json \/etc\/docker\/daemon.json\nsystemctl restart docker\nsystemctl status docker --no-pager<\/code><\/pre>\n<h3>\u91cc\u7a0b\u78913\uff1a\u9a8c\u8bc1\u4e0e\u89c2\u5bdf<\/h3>\n<p><strong>\u4ea4\u4ed8\u7269<\/strong>\uff1a<\/p>\n<ul>\n<li>NAT\u8868\u53ef\u7528\u7684\u9a8c\u8bc1\u622a\u56fe<\/li>\n<li>Pod\u7f51\u7edc\u8fde\u901a\u6027\u590d\u6d4b\u7ed3\u679c<\/li>\n<li>72\u5c0f\u65f6\u5185\u7684\u5173\u952e\u6307\u6807\u76d1\u63a7\u6570\u636e<\/li>\n<\/ul>\n<p><strong>\u9a8c\u6536\u6807\u51c6<\/strong>\uff1a<\/p>\n<ul>\n<li><code>iptables -t nat -L -n<\/code>\u4e0d\u518d\u62a5\u9519<\/li>\n<li>Pod\u95f4\u901a\u4fe1\u6b63\u5e38<\/li>\n<li>Service\u8bbf\u95ee\u6b63\u5e38<\/li>\n<\/ul>\n<pre><code class=\"lang-bash language-bash bash\"># \u9a8c\u8bc1NAT\u8868\niptables -t nat -L -n -v &amp;&amp; echo &quot;NAT table OK&quot;\n\n# \u9a8c\u8bc1Docker\u5bb9\u5668\u7f51\u7edc\ndocker run --rm -p 9090:80 --name verify-web nginx:alpine\ncurl -s http:\/\/localhost:9090 | head -3\ndocker rm -f verify-web\n\n# \u9a8c\u8bc1Kubernetes\u7f51\u7edc\nkubectl run verify --image=busybox:1.36 --restart=Never --rm -it -- wget -qO- http:\/\/kubernetes.default.svc:80 --timeout=5<\/code><\/pre>\n<hr \/>\n<h2>\u8fb9\u754c\u6761\u4ef6\u5904\u7406<\/h2>\n<h3>\u8fb9\u754ccase 1\uff1aNodePort\u8303\u56f4\u51b2\u7a81<\/h3>\n<p>userland-proxy\u4f7f\u7528\u56fa\u5b9a\u7aef\u53e3\u8303\u56f432768-60999\u3002\u5982\u679cNodePort\u670d\u52a1\uff08\u9ed8\u8ba430000-32767\uff09\u8bbf\u95ee\u5f02\u5e38\uff0c\u9700\u8981\u663e\u5f0f\u914d\u7f6ekube-proxy\uff1a<\/p>\n<pre><code class=\"lang-bash language-bash bash\">kubectl get configmap kube-proxy -n kube-system -o yaml | \\\n  sed &#039;s\/serviceNodePortRange:.*\/serviceNodePortRange: &quot;30000-32767&quot;\/&#039; | \\\n  kubectl apply -f -\n\n# \u9a8c\u8bc1\nkubectl get configmap kube-proxy -n kube-system -o yaml | grep nodePortRange<\/code><\/pre>\n<h3>\u8fb9\u754ccase 2\uff1aAppArmor\u963b\u6b62\u6a21\u5757\u52a0\u8f7d<\/h3>\n<p>\u542f\u7528AppArmor\u7684\u8282\u70b9\u53ef\u80fd\u963b\u6b62\u5185\u6838\u6a21\u5757\u52a8\u6001\u52a0\u8f7d\u3002\u68c0\u67e5\u65b9\u5f0f\uff1a<\/p>\n<pre><code class=\"lang-bash language-bash bash\"># \u68c0\u67e5AppArmor\u72b6\u6001\naa-status\napparmor module is loaded.\n\n# \u67e5\u770bDocker\u7684AppArmor profile\ncat \/etc\/apparmor.d\/docker\n\n# \u5982\u679cDocker\u5bb9\u5668\u9700\u8981\u52a0\u8f7d\u5185\u6838\u6a21\u5757\uff08\u5982\u8fd0\u884csystemd\u5bb9\u5668\uff09\uff0c\u9700\u8981\u5728profile\u4e2d\u6dfb\u52a0\n# \/sys\/module\/** rw,<\/code><\/pre>\n<p>\u5e38\u89c1\u62a5\u9519\u573a\u666f\uff1a\u8282\u70b9\u542f\u7528strict\u6a21\u5f0f\u7684AppArmor\uff0cDocker\u5c1d\u8bd5\u4f7f\u7528&#8211;privileged\u5bb9\u5668\u52a0\u8f7dnf_conntrack_netlink\u6a21\u5757\u65f6\u88ab\u62d2\u7edd\u3002\u65e5\u5fd7\u7279\u5f81\uff1a<\/p>\n<pre><code>$ journalctl -u docker | grep -i apparmor\nkernel: apparmor=&quot;DENIED&quot; operation=&quot;module_load&quot; info=&quot;sig&quot; error=-1 name=&quot;kernel\/net\/netfilter\/nf_conntrack_netlink.ko&quot;<\/code><\/pre>\n<p>\u89e3\u51b3\u65b9\u5f0f\u662f\u5728Docker daemon.json\u4e2d\u4e3a\u7279\u5b9a\u5bb9\u5668\u914d\u7f6eAppArmor profile\uff0c\u6216\u5728\/etc\/apparmor.d\/local\/docker\u4e2d\u6dfb\u52a0\u89c4\u5219\u767d\u540d\u5355\u3002<\/p>\n<h3>\u8fb9\u754ccase 3\uff1a\u4e91\u5e73\u53f0\u5b89\u5168\u7ec4\u53e0\u52a0\u6548\u5e94<\/h3>\n<p>AWS\/GCE\u7b49\u4e91\u73af\u5883\u4e0b\uff0ciptables\u89c4\u5219\u4e0e\u4e91\u5e73\u53f0\u5b89\u5168\u7ec4\u4f1a\u4ea7\u751f\u53e0\u52a0\u6548\u679c\u3002\u7981\u7528Docker iptables\u63a5\u7ba1\u540e\uff0c\u5bb9\u5668\u51fa\u5411\u6d41\u91cf\u4ec5\u53d7\u4e91\u5e73\u53f0\u5b89\u5168\u7ec4\u63a7\u5236\uff0c\u672c\u5730iptables\u4e0d\u518d\u751f\u6548\u3002<\/p>\n<p>\u5efa\u8bae\u5728\u53d8\u66f4\u524d\u505a\u5168\u91cf\u5ba1\u8ba1\uff1a<\/p>\n<pre><code class=\"lang-bash language-bash bash\"># \u67e5\u770b\u6240\u6709NAT\u89c4\u5219\niptables -t nat -L -n -v --line-numbers\n\n# \u5bfc\u51fa\u4e91\u5e73\u53f0\u5b89\u5168\u7ec4\u89c4\u5219\naws ec2 describe-security-groups \\\n  --group-ids sg-xxxxxxx \\\n  --query &#039;SecurityGroups[0].IpPermissionsEgress&#039;<\/code><\/pre>\n<hr \/>\n<h2>\u540e\u7eed\u4f18\u5316\u65b9\u5411<\/h2>\n<p>\u5982\u679cuserland-proxy\u7684\u6027\u80fd\u786e\u5b9e\u6210\u4e3a\u74f6\u9888\uff08\u9ad8\u5e76\u53d1\u573a\u666f\u4e0bCPU\u5360\u7528\u660e\u663e\u5347\u9ad8\uff09\uff0c\u6709\u4e24\u4e2a\u5347\u7ea7\u8def\u5f84\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u542f\u7528\u5185\u6838\u7ea7hairpin NAT<\/strong>\uff1a\u5728bridge\u914d\u7f6e\u4e2d\u5f00\u542fhairpin mode\uff0c\u51cf\u5c11userland-proxy\u7684\u8f6c\u53d1\u538b\u529b<\/p>\n<pre><code class=\"lang-bash language-bash bash\">ip link set docker0 type bridge hairpin on\n# \u6301\u4e45\u5316\u5230 \/etc\/systemd\/network\/ \u4e0b<\/code><\/pre>\n<\/li>\n<li>\n<p><strong>\u8fc1\u79fb\u5230Cilium<\/strong>\uff1a\u539f\u751feBPF-based NAT\uff0c\u4e0d\u4f9d\u8d56iptables\/nftables\uff0c\u6027\u80fd\u66f4\u597d\uff0c\u4e14\u4e0e\u5185\u6838\u7248\u672c\u517c\u5bb9\u6027\u66f4\u4f18<\/p>\n<\/li>\n<\/ol>\n<hr \/>\n<h2>\u603b\u7ed3<\/h2>\n<p>iptables NAT\u8868\u65e0\u6cd5\u52a0\u8f7d\u7684\u6839\u56e0\u6392\u67e5\u9700\u8981\u6cbf\u7740&#8221;\u547d\u4ee4\u2192\u914d\u7f6e\u2192\u6a21\u5757\u2192\u5185\u6838&#8221;\u7684\u94fe\u8def\u9010\u5c42\u6df1\u5165\u3002\u6838\u5fc3\u5224\u65ad\u539f\u5219\uff1a<\/p>\n<ol>\n<li>filter\u8868\u80fd\u8bfb\u8bf4\u660eiptables\u547d\u4ee4\u672c\u8eab\u6b63\u5e38\uff0cnat\u8868\u62a5\u9519\u6307\u5411\u5185\u6838\u5c42\u9762<\/li>\n<li>lsmod\u4e3a\u7a7a\u8bf4\u660e\u6a21\u5757\u672a\u52a0\u8f7d\uff0c\u9700\u8981\u7ed3\u5408dmesg\/journalctl\u5b9a\u4f4d\u52a0\u8f7d\u5931\u8d25\u539f\u56e0<\/li>\n<li>modprobe\u62a5&#8221;No such device&#8221;\u901a\u5e38\u610f\u5473\u7740\u5185\u6838\u7f16\u8bd1\u914d\u7f6e\u7f3a\u5931\u6216\u6a21\u5757\u4e0e\u5185\u6838\u7248\u672c\u4e0d\u5339\u914d<\/li>\n<li>\u6839\u636e\u6839\u56e0\u9009\u62e9\u65b9\u6848\uff1a\u6a21\u5757\u7d22\u5f15\u635f\u574f\u2192depmod\u91cd\u5efa\uff1bDocker\u63a5\u7ba1\u51b2\u7a81\u2192\u7981\u7528Docker iptables\u63a5\u7ba1\uff1b\u5185\u6838\u4e0d\u652f\u6301\u2192\u8003\u8651nftables\u6216\u5347\u7ea7\u5185\u6838<\/li>\n<\/ol>\n<p>\u751f\u4ea7\u73af\u5883\u4e2d\uff0c\u65b9\u6848C\uff08\u7981\u7528Docker iptables\u63a5\u7ba1\uff09\u914d\u5408Kubernetes CNI\u7edf\u4e00\u7ba1\u7406\u7f51\u7edc\u89c4\u5219\uff0c\u6545\u969c\u57df\u9694\u79bb\u66f4\u6e05\u6670\uff0c\u53ef\u7ef4\u62a4\u6027\u66f4\u597d\u3002<\/p>","protected":false},"excerpt":{"rendered":"<p>\u5bb9\u5668\u7f51\u7edc\u573a\u666f\u4e0biptables NAT\u8868\u52a0\u8f7d\u5931\u8d25\u7684\u6839\u56e0\u4e0d\u5728iptables\u672c\u8eab\uff0c\u800c\u5728\u4e8e\u5185\u6838\u6a21\u5757\u4f9d\u8d56\u94fe\u672a\u6253\u901a\u3002\u672c\u6587\u4ece\u95ee\u9898\u53d1\u73b0\u5230\u6839\u56e0\u5b9a\u4f4d\u5b8c\u6574\u8fd8\u539f\u6392\u67e5\u8def\u5f84\uff0c\u5bf9\u6bd4\u4e09\u79cd\u65b9\u6848\u7684\u751f\u4ea7\u73af\u5883\u9002\u7528\u6761\u4ef6\uff0c\u5e76\u7ed9\u51fa\u5177\u4f53\u5b9e\u65bd\u6b65\u9aa4\u4e0e\u8fb9\u754ccase\u5904\u7406\u3002<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,10],"tags":[95,56,99,542,473],"class_list":["post-836","post","type-post","status-publish","format-standard","hentry","category-linux","category-10","tag-docker","tag-iptables","tag-kubernetes","tag-linux","tag-473"],"views":5,"_links":{"self":[{"href":"https:\/\/www.liaoxinghui.com\/index.php?rest_route=\/wp\/v2\/posts\/836","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.liaoxinghui.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.liaoxinghui.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.liaoxinghui.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.liaoxinghui.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=836"}],"version-history":[{"count":1,"href":"https:\/\/www.liaoxinghui.com\/index.php?rest_route=\/wp\/v2\/posts\/836\/revisions"}],"predecessor-version":[{"id":852,"href":"https:\/\/www.liaoxinghui.com\/index.php?rest_route=\/wp\/v2\/posts\/836\/revisions\/852"}],"wp:attachment":[{"href":"https:\/\/www.liaoxinghui.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=836"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.liaoxinghui.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=836"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.liaoxinghui.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=836"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}