WireGuard转发数据包未触发POSTROUTING规则，恢复后寻求原因解析

我最近碰到了一个WireGuard流量转发的诡异问题，配置逻辑很简单但最后一步就是不生效，折腾半天后意外恢复了，但还是没完全搞懂背后的原因，来跟大家说说这个情况：

问题场景 #

我的WireGuard配置很基础：客户端分配10.7.0.0/24网段地址，流量转发到主接口，最后要把发往192.168.1.0/24的数据包通过主接口做SNAT。前面的转发都正常，唯独最后一步SNAT完全没反应，甚至我在POSTROUTING表加的LOG规则都触发不了。

下面是从10.7.0.2 ping 192.168.1.185的内核TRACE输出：

kernel: [  524.154478] TRACE: raw:PREROUTING:policy:2 IN=wg0 OUT= MAC= SRC=10.7.0.2 DST=192.168.1.185 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=7783 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=542

kernel: [  524.154502] TRACE: filter:FORWARD:rule:1 IN=wg0 OUT=ens192 MAC= SRC=10.7.0.2 DST=192.168.1.185 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7783 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=542

kernel: [  524.154507] IN=wg0 OUT=ens192 MAC= SRC=10.7.0.2 DST=192.168.1.185 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7783 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=542

kernel: [  524.154512] TRACE: filter:FORWARD:rule:3 IN=wg0 OUT=ens192 MAC= SRC=10.7.0.2 DST=192.168.1.185 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7783 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=542

从TRACE能看到，filter:FORWARD:rule:1的LOG规则触发正常，数据包也走到了filter:FORWARD:rule:3，这部分逻辑是对的。

当时的FORWARD链规则如下：

Chain FORWARD (policy ACCEPT 92 packets, 4848 bytes)

pkts bytes target     prot opt in     out     source               destination

4   240 LOG        icmp --  *      *       0.0.0.0/0            192.168.1.185        LOG flags 0 level 4

0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

430 28493 ACCEPT     all  --  *      *       10.7.0.0/24          0.0.0.0/0

但我搞不懂的是，数据包走完FORWARD之后，完全没触发POSTROUTING的任何规则，连LOG都没有。当时的POSTROUTING链规则：

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target     prot opt in     out     source               destination

0     0 LOG        icmp --  *      *       0.0.0.0/0            192.168.1.185        LOG flags 0 level 4

0     0 SNAT       all  --  *      *       10.7.0.0/24         !10.7.0.0/24          to:192.168.1.124

初始完整规则 #

我当时的完整iptables规则：

*nat

:PREROUTING ACCEPT [0:0]

:INPUT ACCEPT [26:2369]

:OUTPUT ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

[0:0] -A POSTROUTING -s 10.7.0.0/24 ! -d 10.7.0.0/24 -j SNAT --to-source 192.168.1.124

COMMIT

# Completed on Thu May 18 00:16:56 2023

# Generated by iptables-save v1.6.1 on Thu May 18 00:16:56 2023

*filter

:INPUT ACCEPT [3598:452715]

:FORWARD ACCEPT [12:720]

:OUTPUT ACCEPT [2685:370730]

[240:33000] -A INPUT -p udp -m udp --dport 52160 -j ACCEPT

[0:0] -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

[228:15470] -A FORWARD -s 10.7.0.0/24 -j ACCEPT

COMMIT

同时nftables的规则是：

sudo nft list ruleset

table inet filter {

chain input {

type filter hook input priority filter; policy accept;

}

chain forward {

type filter hook forward priority filter; policy accept;

}

chain output {

type filter hook output priority filter; policy accept;

}

}

意外恢复的情况 #

后来我在查看其他iptables规则的时候，突然发现一切都正常了，SNAT开始生效，POSTROUTING的规则也能触发了。恢复后的iptables-save输出如下：

# Generated by iptables-save v1.6.1 on Thu May 18 00:48:19 2023

*raw

:PREROUTING ACCEPT [6532:813762]

:OUTPUT ACCEPT [4430:674431]

COMMIT

# Completed on Thu May 18 00:48:19 2023

# Generated by iptables-save v1.6.1 on Thu May 18 00:48:19 2023

*mangle

:PREROUTING ACCEPT [12837:1592394]

:INPUT ACCEPT [11726:1478490]

:FORWARD ACCEPT [1111:113904]

:OUTPUT ACCEPT [8651:1277974]

:POSTROUTING ACCEPT [9762:1391878]

COMMIT

# Completed on Thu May 18 00:48:19 2023

# Generated by iptables-save v1.6.1 on Thu May 18 00:48:19 2023

*nat

:PREROUTING ACCEPT [1678:159704]

:INPUT ACCEPT [1932:186621]

:OUTPUT ACCEPT [4667:280576]

:POSTROUTING ACCEPT [4674:280996]

[110:7552] -A POSTROUTING -s 10.7.0.0/24 ! -d 10.7.0.0/24 -j SNAT --to-source 192.168.1.124

COMMIT

# Completed on Thu May 18 00:48:19 2023

# Generated by iptables-save v1.6.1 on Thu May 18 00:48:19 2023

*filter

:INPUT ACCEPT [19546:2623783]

:FORWARD ACCEPT [502:28104]

:OUTPUT ACCEPT [15543:2246022]

[1835:264832] -A INPUT -p udp -m udp --dport 52160 -j ACCEPT

[1136:122259] -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

[533:36117] -A FORWARD -s 10.7.0.0/24 -j ACCEPT

COMMIT

# Completed on Thu May 18 00:48:19 2023

我的两个猜测 #

现在我有两个可能的方向，但还不确定哪个是对的：

• NAT表只对新连接生效，但我不太清楚系统是怎么判定一个连接是否为“新”的
• 当时查看mangle表规则的时候，系统自动创建了mangle表，会不会这个操作改变了数据包的处理路径或者内核的行为？

有没有大佬能帮我分析下真正的原因？

备注：内容来源于stack exchange，提问作者Liam Kelly