接受本地不起作用答案

【问题标题】：accept_local doesn't work接受本地不起作用
【发布时间】：2014-09-19 13:22:01
【问题描述】：

我想从一个网卡发送数据，然后由 CENTOS6.4 上的另一个网卡接收（X86 框架，3 个网卡，一个是板载 realtek 的，另外两个是 intel 网卡）。

首先，我在两个英特尔网卡上配置了英特尔网卡 ip：(eth0) 192.168.1.1/24 和 (eth1) 192.168.1.2/24。

其次，我通过以下cmd添加路由：

# route add -host 192.168.1.1 dev eth1
# route add -host 192.168.1.2 dev eth0

第三，我在/etc/sysctl.conf中启用了accept_local：

net.ipv4.conf.eth0.accept_local = 1
net.ipv4.conf.eth1.accept_local = 1

我还禁用了 iptables 和 SElinux。我重新启动系统，然后使用有线连接 eth0 和 eth1，然后我这样测试：

#ping 192.168.1.1 -I eth1

消息返回：

"From 192.168.1.2 icmp_seq=xx Destination Host Unreachable"

我错过了什么吗？

我已经阅读了这个主题How can configure linux routing to send packets out one interface, over a bridge and into another interface on the same box。

【问题讨论】：

dmesg | grep eth告诉你两个eth的链路层都up了？
是的，eth0 和 eth1 都已启动，如下所示。 e1000：eth0 网卡链路已启动 1000 Mbps 全双工，流控制：RX/TX e1000：eth1 网卡链路已启动 1000 Mbps 全双工，流控制：RX/TX 。
还有其他方法可以实现这样的功能吗？

标签： linux local routes

【解决方案1】：

尝试设置sysctl -w net.ipv4.conf.all.rp_filter=2

参考https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt

accept_local - BOOLEAN
    Accept packets with local source addresses. In combination
    with suitable routing, this can be used to direct packets
    between two local interfaces over the wire and have them
    accepted properly.

    rp_filter must be set to a non-zero value in order for
    accept_local to have an effect.


rp_filter - INTEGER
    0 - No source validation.
    1 - Strict mode as defined in RFC3704 Strict Reverse Path
        Each incoming packet is tested against the FIB and if the interface
        is not the best reverse path the packet check will fail.
        By default failed packets are discarded.
    2 - Loose mode as defined in RFC3704 Loose Reverse Path
        Each incoming packet's source address is also tested against the FIB
        and if the source address is not reachable via any interface
        the packet check will fail.

    Current recommended practice in RFC3704 is to enable strict mode
    to prevent IP spoofing from DDos attacks. If using asymmetric routing
    or other complicated routing, then loose mode is recommended.

    The max value from conf/{all,interface}/rp_filter is used
    when doing source validation on the {interface}.

    Default value is 0. Note that some distributions enable it
    in startup scripts.

【讨论】：