{"id":109,"date":"2026-08-07T07:34:27","date_gmt":"2026-08-06T23:34:27","guid":{"rendered":"https:\/\/blog.yunbai.icu\/?p=109"},"modified":"2026-08-07T09:28:35","modified_gmt":"2026-08-07T01:28:35","slug":"%e5%9c%a8-oracle-cloud-arm-%e6%9c%8d%e5%8a%a1%e5%99%a8%e4%b8%8a%e5%ae%89%e8%a3%85-proxmox-ve-9%ef%bc%8c%e5%b9%b6%e9%85%8d%e7%bd%ae-lxc-nat-%e7%bd%91%e7%bb%9c","status":"publish","type":"post","link":"https:\/\/blog.yunbai.icu\/?p=109","title":{"rendered":"\u5728 Oracle Cloud ARM \u670d\u52a1\u5668\u4e0a\u5b89\u88c5 Proxmox VE 9\uff0c\u5e76\u914d\u7f6e LXC NAT \u7f51\u7edc"},"content":{"rendered":"\n

Oracle Cloud ARM \u5b89\u88c5 Proxmox VE 9\uff1a\u9762\u5411 LXC \u7684\u5b8c\u6574\u5b9e\u6218\u6559\u7a0b<\/h1>\n\n\n\n
\n

\u672c\u6587\u8bb0\u5f55\u4e00\u6b21\u5728 Oracle Cloud ARM \u4e91\u670d\u52a1\u5668\u4e0a\u5b89\u88c5 Proxmox VE 9\uff0c\u5e76\u628a\u5b83\u4f5c\u4e3a LXC \u5bb9\u5668\u5e73\u53f0\u4f7f\u7528\u7684\u5b8c\u6574\u8fc7\u7a0b\u3002<\/p>\n\n\n\n

\u91cd\u70b9\u4e0d\u662f KVM \u865a\u62df\u673a\uff0c\u800c\u662f ARM64 LXC\uff1a\u5b89\u88c5 PVE\u3001\u914d\u7f6e OCI \u5b89\u5168\u7684 NAT \u7f51\u7edc\u3001\u4e0b\u8f7d ARM64 \u5bb9\u5668\u6a21\u677f\u3001\u521b\u5efa Debian \/ Ubuntu \/ OpenWrt \/ Kali \/ Oracle Linux \u5bb9\u5668\uff0c\u4ee5\u53ca\u628a\u5bb9\u5668\u670d\u52a1\u901a\u8fc7\u5bbf\u4e3b\u673a\u516c\u7f51\u9ad8\u7aef\u53e3\u8f6c\u53d1\u51fa\u53bb\u3002<\/p>\n<\/blockquote>\n\n\n\n

\u53d8\u91cf\u7ea6\u5b9a<\/h2>\n\n\n\n

\u4e0b\u9762\u6240\u6709\u516c\u7f51 IP\u3001\u5bc6\u7801\u3001\u7aef\u53e3\u90fd\u4f7f\u7528\u5360\u4f4d\u7b26\u3002\u7167\u6284\u65f6\u8bf7\u66ff\u6362\u6210\u4f60\u81ea\u5df1\u7684\u503c\u3002<\/p>\n\n\n\n

<PUBLIC_IP>             \u4f60\u7684\u4e91\u670d\u52a1\u5668\u516c\u7f51 IP\uff0c\u4f8b\u5982 203.0.113.10\n<HOST_PRIVATE_IP>       \u4e91\u670d\u52a1\u5668\u5728 OCI VCN \u91cc\u7684\u5185\u7f51 IP\uff0c\u4f8b\u5982 10.0.0.30\n<ROOT_PASSWORD>         \u5bbf\u4e3b\u673a root \u5bc6\u7801\n<CT_ROOT_PASSWORD>      \u5bb9\u5668 root \u5bc6\u7801\n<HOST_PORT>             \u5bbf\u4e3b\u673a\u516c\u7f51\u9ad8\u7aef\u53e3\uff0c\u4f8b\u5982 21025\n<CT_IP>                 \u5bb9\u5668\u5185\u7f51 IP\uff0c\u4f8b\u5982 10.10.10.104\n<CT_SERVICE_PORT>       \u5bb9\u5668\u670d\u52a1\u7aef\u53e3\uff0c\u4f8b\u5982 SSH \u662f 22\uff0cHTTP \u662f 80<\/code><\/pre>\n\n\n\n
\u672c\u6587\u793a\u4f8b\u7f51\u7edc\uff1a<\/p>\n\n\n\n
\u5bbf\u4e3b\u4e3b\u7f51\u5361\uff1aenp0s3\n\u5bbf\u4e3b\u516c\u7f51 IP\uff1a<PUBLIC_IP>\n\u5bbf\u4e3b OCI \u5185\u7f51 IP\uff1a<HOST_PRIVATE_IP>\nLXC bridge\uff1avmbr0\nLXC \u7f51\u5173\uff1a10.10.10.1\nLXC \u7f51\u6bb5\uff1a10.10.10.0\/24\nNAT \u51fa\u53e3\u7f51\u5361\uff1aenp0s3<\/code><\/pre>\n\n\n\n
\u9002\u7528\u573a\u666f<\/h2>\n\n\n\n
\u672c\u6587\u9002\u5408\uff1a<\/p>\n\n\n\n
    \n
  • Oracle Cloud Infrastructure\uff0c\u4e5f\u5c31\u662f OCI<\/li>\n\n\n\n
  • ARM64 \/ AArch64 \u5b9e\u4f8b<\/li>\n\n\n\n
  • Debian GNU\/Linux 13 trixie<\/li>\n\n\n\n
  • Proxmox VE 9.x<\/li>\n\n\n\n
  • \u4e3b\u8981\u8dd1 LXC \u5bb9\u5668<\/li>\n\n\n\n
  • \u4e0d\u8981\u6c42 KVM \u865a\u62df\u673a<\/li>\n\n\n\n
  • \u5bb9\u5668\u901a\u8fc7 NAT \u51fa\u7f51<\/li>\n\n\n\n
  • \u5bb9\u5668\u670d\u52a1\u901a\u8fc7\u5bbf\u4e3b\u673a\u516c\u7f51\u9ad8\u7aef\u53e3\u8f6c\u53d1\u8bbf\u95ee<\/li>\n<\/ul>\n\n\n\n
    \u4e00\u6b21\u5b9e\u9645\u5b89\u88c5\u540e\u7684\u7248\u672c\u793a\u4f8b\uff1a<\/p>\n\n\n\n
    pve-manager\/9.2.9\nrunning kernel: 7.0.14-6-pve<\/code><\/pre>\n\n\n\n
    \u5148\u8bf4\u7ed3\u8bba<\/h2>\n\n\n\n
    Oracle Cloud ARM \u5b9e\u4f8b\u53ef\u4ee5\u5b89\u88c5 Proxmox VE 9\uff0c\u4f46\u5efa\u8bae\u628a\u5b83\u5f53\u6210 LXC \u5bb9\u5668\u7ba1\u7406\u5e73\u53f0\uff0c\u800c\u4e0d\u662f\u5b8c\u6574\u865a\u62df\u5316\u5e73\u53f0\u3002<\/p>\n\n\n\n
    \u5f88\u591a OCI ARM \u5b9e\u4f8b\u6ca1\u6709 \/dev\/kvm<\/code>\uff0c\u8fd9\u4f1a\u5f71\u54cd KVM \u865a\u62df\u673a\u3002\u4f46 LXC \u5bb9\u5668\u4e0d\u4f9d\u8d56 KVM\uff0c\u6240\u4ee5\u53ef\u4ee5\u6b63\u5e38\u4f7f\u7528\u3002<\/p>\n\n\n\n
    \u63a8\u8350\u8def\u7ebf\uff1a<\/p>\n\n\n\n
      \n
    1. \u4f7f\u7528 Debian 13 trixie ARM64\u3002<\/li>\n\n\n\n
    2. \u6dfb\u52a0 Proxmox VE 9 trixie arm64 \u8f6f\u4ef6\u6e90\u3002<\/li>\n\n\n\n
    3. \u5b89\u88c5 PVE \u5185\u6838\u5e76\u91cd\u542f\u3002<\/li>\n\n\n\n
    4. \u5b89\u88c5 proxmox-ve<\/code>\u3002<\/li>\n\n\n\n
    5. \u7981\u7528 enterprise \u6e90\u3002<\/li>\n\n\n\n
    6. \u914d\u7f6e\u72ec\u7acb LXC NAT bridge\uff1avmbr0<\/code>\u3002<\/li>\n\n\n\n
    7. \u4ece Linux Containers \u955c\u50cf\u7ad9\u4e0b\u8f7d ARM64 CT \u6a21\u677f\u3002<\/li>\n\n\n\n
    8. \u521b\u5efa\u5bb9\u5668\u65f6\u4f7f\u7528\u9759\u6001\u5185\u7f51 IP\u3002<\/li>\n\n\n\n
    9. \u9700\u8981\u516c\u7f51\u8bbf\u95ee\u7684\u670d\u52a1\uff0c\u5728\u5bbf\u4e3b\u673a\u4e0a\u505a DNAT \u548c FORWARD\u3002<\/li>\n<\/ol>\n\n\n\n
      \u4e3a\u4ec0\u4e48\u4e0d DD \u91cd\u88c5<\/h2>\n\n\n\n
      \u5f88\u591a\u6559\u7a0b\u4f1a\u7528\u7b2c\u4e09\u65b9 DD \u811a\u672c\u76f4\u63a5\u5237 Proxmox \u955c\u50cf\u3002\u5982\u679c\u5f53\u524d\u7cfb\u7edf\u5df2\u7ecf\u662f Debian 13 ARM64\uff0c\u5c31\u6ca1\u5fc5\u8981\u8fd9\u4e48\u505a\u3002<\/p>\n\n\n\n
      \u76f4\u63a5 apt \u5b89\u88c5\u66f4\u7a33\uff1a<\/p>\n\n\n\n
        \n
      • \u4e0d\u9700\u8981\u91cd\u5237\u7cfb\u7edf\u76d8\u3002<\/li>\n\n\n\n
      • \u4e0d\u5bb9\u6613\u7834\u574f OCI \u7684 SSH \u548c\u7f51\u5361\u914d\u7f6e\u3002<\/li>\n\n\n\n
      • \u51fa\u95ee\u9898\u65f6\u66f4\u5bb9\u6613\u6392\u67e5\u3002<\/li>\n\n\n\n
      • \u66f4\u9002\u5408\u53ea\u8dd1 LXC \u7684\u7528\u9014\u3002<\/li>\n<\/ul>\n\n\n\n
        \u6ce8\u610f\uff1aProxmox VE 8 \u7684 bookworm \u6e90\u4e3b\u8981\u662f amd64\uff1bARM64 \u5e94\u4f7f\u7528 Proxmox VE 9 \u7684 trixie \u6e90\u3002<\/p>\n\n\n\n
        \u5b89\u88c5\u524d\u68c0\u67e5<\/h2>\n\n\n\n
        \u786e\u8ba4\u67b6\u6784\uff1a<\/p>\n\n\n\n
        uname -m<\/code><\/pre>\n\n\n\n
        \u671f\u671b\u770b\u5230\uff1a<\/p>\n\n\n\n
        aarch64<\/code><\/pre>\n\n\n\n
        \u786e\u8ba4\u7cfb\u7edf\u7248\u672c\uff1a<\/p>\n\n\n\n
        cat \/etc\/os-release<\/code><\/pre>\n\n\n\n
        \u671f\u671b\u662f Debian 13 trixie\u3002<\/p>\n\n\n\n
        \u68c0\u67e5 KVM\uff1a<\/p>\n\n\n\n
        ls -l \/dev\/kvm<\/code><\/pre>\n\n\n\n
        \u5982\u679c\u63d0\u793a\u4e0d\u5b58\u5728\uff0c\u4e0d\u7528\u614c\u3002\u6ca1\u6709 \/dev\/kvm<\/code> \u53ea\u662f\u4e0d\u9002\u5408\u8dd1 KVM \u865a\u62df\u673a\uff0cLXC \u4ecd\u7136\u53ef\u4ee5\u7528\u3002<\/p>\n\n\n\n
        \u4fee\u6539 hostname<\/h2>\n\n\n\n
        Proxmox \u4e0d\u5efa\u8bae hostname \u662f localhost<\/code>\u3002\u8fd9\u91cc\u4ee5 pve<\/code> \u4e3a\u4f8b\uff1a<\/p>\n\n\n\n
        echo pve > \/etc\/hostname\nhostnamectl set-hostname pve<\/code><\/pre>\n\n\n\n
        \u4fee\u6539 \/etc\/hosts<\/code>\uff0c\u628a\u4e3b\u673a\u540d\u6307\u5411 OCI \u5185\u7f51 IP\uff1a<\/p>\n\n\n\n
        <HOST_PRIVATE_IP> pve.local pve<\/code><\/pre>\n\n\n\n
        \u4f8b\u5982\uff1a<\/p>\n\n\n\n
        10.0.0.30 pve.local pve<\/code><\/pre>\n\n\n\n
        \u5982\u679c\u673a\u5668\u4e0a\u6709 cloud-init\uff0c\u5efa\u8bae\u9632\u6b62\u91cd\u542f\u540e hostname \u88ab\u6539\u56de\u53bb\uff1a<\/p>\n\n\n\n
        if [ -f \/etc\/cloud\/cloud.cfg ]; then\n  grep -q '^preserve_hostname:' \/etc\/cloud\/cloud.cfg \\\n    && sed -i 's\/^preserve_hostname:.*\/preserve_hostname: true\/' \/etc\/cloud\/cloud.cfg \\\n    || echo 'preserve_hostname: true' >> \/etc\/cloud\/cloud.cfg\nfi<\/code><\/pre>\n\n\n\n
        \u5b89\u88c5\u57fa\u7840\u5de5\u5177<\/h2>\n\n\n\n
        apt update\napt install -y ca-certificates wget curl gnupg<\/code><\/pre>\n\n\n\n
        \u6dfb\u52a0 Proxmox VE 9 ARM64 \u8f6f\u4ef6\u6e90<\/h2>\n\n\n\n
        \u521b\u5efa keyring \u76ee\u5f55\uff1a<\/p>\n\n\n\n
        install -d -m 0755 \/etc\/apt\/keyrings<\/code><\/pre>\n\n\n\n
        \u4e0b\u8f7d Proxmox trixie \u6e90\u5bc6\u94a5\uff1a<\/p>\n\n\n\n
        wget -O \/etc\/apt\/keyrings\/proxmox-release-trixie.gpg \\\n  https://enterprise.proxmox.com\/debian\/proxmox-release-trixie.gpg<\/code><\/pre>\n\n\n\n
        \u6dfb\u52a0 no-subscription \u6e90\uff1a<\/p>\n\n\n\n
        cat > \/etc\/apt\/sources.list.d\/pve-install-repo.list <<'EOF'\ndeb [arch=arm64 signed-by=\/etc\/apt\/keyrings\/proxmox-release-trixie.gpg] http:\/\/download.proxmox.com\/debian\/pve trixie pve-no-subscription\nEOF<\/code><\/pre>\n\n\n\n
        \u66f4\u65b0\u8f6f\u4ef6\u6e90\uff1a<\/p>\n\n\n\n
        apt update<\/code><\/pre>\n\n\n\n
        \u5347\u7ea7\u7cfb\u7edf\u5e76\u5b89\u88c5 PVE \u5185\u6838<\/h2>\n\n\n\n
        apt full-upgrade -y\napt install -y proxmox-default-kernel<\/code><\/pre>\n\n\n\n
        \u5b89\u88c5\u5185\u6838\u540e\u91cd\u542f\uff1a<\/p>\n\n\n\n
        systemctl reboot<\/code><\/pre>\n\n\n\n
        \u91cd\u542f\u56de\u6765\u540e\u68c0\u67e5\u5185\u6838\uff1a<\/p>\n\n\n\n
        uname -r<\/code><\/pre>\n\n\n\n
        \u6b63\u5e38\u4f1a\u770b\u5230\u7c7b\u4f3c\uff1a<\/p>\n\n\n\n
        7.0.14-6-pve<\/code><\/pre>\n\n\n\n
        \u5b89\u88c5 Proxmox VE \u4e3b\u4f53<\/h2>\n\n\n\n
        \u4e3a\u4e86\u907f\u514d Postfix \u5f39\u4ea4\u4e92\u7a97\u53e3\uff0c\u53ef\u4ee5\u5148\u9884\u7f6e\u6210\u672c\u5730\u6295\u9012\uff1a<\/p>\n\n\n\n
        echo 'postfix postfix\/mailname string pve.local' | debconf-set-selections\necho 'postfix postfix\/main_mailer_type select Local only' | debconf-set-selections<\/code><\/pre>\n\n\n\n
        \u5b89\u88c5 PVE\uff1a<\/p>\n\n\n\n
        DEBIAN_FRONTEND=noninteractive apt install -y proxmox-ve postfix open-iscsi chrony<\/code><\/pre>\n\n\n\n
        \u68c0\u67e5\u7248\u672c\uff1a<\/p>\n\n\n\n
        pveversion | head -n 1<\/code><\/pre>\n\n\n\n
        \u68c0\u67e5\u5931\u8d25\u670d\u52a1\uff1a<\/p>\n\n\n\n
        systemctl --no-pager --state=failed<\/code><\/pre>\n\n\n\n
        \u6b63\u5e38\u60c5\u51b5\u4e0b\u5e94\u663e\u793a\uff1a<\/p>\n\n\n\n
        0 loaded units listed.<\/code><\/pre>\n\n\n\n
        \u7981\u7528 enterprise \u6e90<\/h2>\n\n\n\n
        \u5b89\u88c5 proxmox-ve<\/code> \u540e\uff0c\u7cfb\u7edf\u53ef\u80fd\u4f1a\u81ea\u52a8\u751f\u6210 enterprise \u6e90\u3002\u6ca1\u6709\u8ba2\u9605\u65f6\uff0c\u540e\u7eed apt update<\/code> \u53ef\u80fd\u62a5\u9519\u3002<\/p>\n\n\n\n
        \u5982\u679c\u5b58\u5728\uff1a<\/p>\n\n\n\n
        \/etc\/apt\/sources.list.d\/pve-enterprise.sources<\/code><\/pre>\n\n\n\n
        \u5efa\u8bae\u6539\u6210\uff1a<\/p>\n\n\n\n
        Enabled: no\nTypes: deb\nURIs: https:\/\/enterprise.proxmox.com\/debian\/pve\nSuites: trixie\nComponents: pve-enterprise\nSigned-By: \/usr\/share\/keyrings\/proxmox-archive-keyring.gpg<\/code><\/pre>\n\n\n\n
        \u6ce8\u610f\uff1adeb822 \u683c\u5f0f\u4e0d\u8981\u53ea\u6ce8\u91ca Types:<\/code>\uff0c\u5426\u5219 apt \u4f1a\u8ba4\u4e3a\u6e90\u6587\u4ef6 malformed\u3002\u6b63\u786e\u505a\u6cd5\u662f\u52a0\uff1a<\/p>\n\n\n\n
        Enabled: no<\/code><\/pre>\n\n\n\n
        \u7136\u540e\u9a8c\u8bc1\uff1a<\/p>\n\n\n\n
        apt update\napt -s upgrade<\/code><\/pre>\n\n\n\n
        \u8bbf\u95ee PVE \u9762\u677f<\/h2>\n\n\n\n
        PVE Web \u9ed8\u8ba4\u7aef\u53e3\u662f 8006<\/code>\uff1a<\/p>\n\n\n\n
        https://<PUBLIC_IP>:8006\/<\/code><\/pre>\n\n\n\n
        \u767b\u5f55\uff1a<\/p>\n\n\n\n
        \u7528\u6237\u540d\uff1aroot\nRealm\uff1aLinux PAM standard authentication\n\u5bc6\u7801\uff1a\u5bbf\u4e3b\u673a root \u5bc6\u7801<\/code><\/pre>\n\n\n\n
        \u5982\u679c\u6253\u4e0d\u5f00\uff0c\u68c0\u67e5 OCI \u5b89\u5168\u5217\u8868\u6216\u7f51\u7edc\u5b89\u5168\u7ec4\u662f\u5426\u653e\u884c TCP 8006<\/code>\u3002<\/p>\n\n\n\n
        OCI \u4e0a\u4e3a\u4ec0\u4e48\u4e0d\u8981\u76f4\u63a5\u6865\u63a5\u4e3b\u7f51\u5361<\/h2>\n\n\n\n
        OCI \u7684\u7f51\u7edc\u4e0d\u9002\u5408\u628a\u516c\u7f51\u4e3b\u7f51\u5361\u76f4\u63a5\u6865\u63a5\u7ed9\u5bb9\u5668\u3002\u539f\u56e0\u5305\u62ec\uff1a<\/p>\n\n\n\n
          \n
        • OCI VNIC \u5bf9 MAC\/IP \u7ed1\u5b9a\u6bd4\u8f83\u4e25\u683c\u3002<\/li>\n\n\n\n
        • \u516c\u7f51 IP \u662f\u7ed1\u5b9a\u5230\u4e91\u7f51\u5361\u4e0a\u7684\uff0c\u4e0d\u662f\u666e\u901a\u4e8c\u5c42\u7f51\u7edc\u91cc\u968f\u4fbf\u6f02\u3002<\/li>\n\n\n\n
        • \u76f4\u63a5\u6865\u63a5 enp0s3<\/code> \u53ef\u80fd\u5f71\u54cd\u5bbf\u4e3b\u673a SSH\u3002<\/li>\n\n\n\n
        • \u5bb9\u5668\u516c\u7f51\u66b4\u9732\u5e94\u8be5\u7531\u5bbf\u4e3b\u673a NAT\/\u8f6c\u53d1\u5904\u7406\u3002<\/li>\n<\/ul>\n\n\n\n
          \u66f4\u7a33\u7684\u65b9\u6848\u662f\uff1a<\/p>\n\n\n\n
          \u516c\u7f51\u6d41\u91cf\n  \u2193\nOCI VNIC \/ enp0s3\n  \u2193\nPVE \u5bbf\u4e3b\u673a iptables DNAT\n  \u2193\nvmbr0\n  \u2193\nLXC \u5bb9\u5668 10.10.10.x<\/code><\/pre>\n\n\n\n
          \u5bb9\u5668\u51fa\u7f51\u8def\u5f84\uff1a<\/p>\n\n\n\n
          LXC \u5bb9\u5668 10.10.10.x\n  \u2193\n\u7f51\u5173 10.10.10.1\uff0c\u4e5f\u5c31\u662f vmbr0\n  \u2193\n\u5bbf\u4e3b\u673a MASQUERADE\n  \u2193\nenp0s3\n  \u2193\n\u4e92\u8054\u7f51<\/code><\/pre>\n\n\n\n
          \u914d\u7f6e LXC NAT \u7f51\u7edc<\/h2>\n\n\n\n
          \u672c\u6587\u4f7f\u7528\uff1a<\/p>\n\n\n\n
          \u5bbf\u4e3b\u4e3b\u7f51\u5361\uff1aenp0s3\nLXC bridge\uff1avmbr0\nLXC \u7f51\u6bb5\uff1a10.10.10.0\/24\nLXC \u7f51\u5173\uff1a10.10.10.1\nNAT \u51fa\u53e3\uff1aenp0s3<\/code><\/pre>\n\n\n\n
          \u4e3a\u4ec0\u4e48\u8981\u7528 dummy0<\/h3>\n\n\n\n
          \u6b63\u5e38 PVE \u7a7a\u6865\u53ef\u4ee5\u5199 bridge-ports none<\/code>\uff0c\u4f46\u67d0\u4e9b ifupdown2 \u7248\u672c\u5bf9\u7a7a bridge \u5199\u6cd5\u4e0d\u53cb\u597d\uff0c\u53ef\u80fd\u62a5\u9519\u3002<\/p>\n\n\n\n
          \u53e6\u5916\uff0c\u6709\u4e9b PVE 9 \u73af\u5883\u4e0d\u4f1a\u628a \/etc\/network\/interfaces.d\/<\/code> \u91cc\u7684 bridge \u663e\u793a\u5230\u521b\u5efa CT \u7684\u4e0b\u62c9\u6846\u91cc\u3002<\/p>\n\n\n\n
          \u7a33\u5b9a\u5199\u6cd5\uff1a<\/p>\n\n\n\n
            \n
          • \u628a vmbr0<\/code> \u5199\u8fdb \/etc\/network\/interfaces<\/code> \u4e3b\u6587\u4ef6\u3002<\/li>\n\n\n\n
          • \u521b\u5efa dummy0<\/code> \u865a\u62df\u7f51\u5361\u3002<\/li>\n\n\n\n
          • \u8ba9 vmbr0<\/code> \u6865\u63a5 dummy0<\/code>\u3002<\/li>\n\n\n\n
          • \u4e0d\u8981\u628a OCI \u4e3b\u7f51\u5361 enp0s3<\/code> \u52a0\u8fdb vmbr0<\/code>\u3002<\/li>\n<\/ul>\n\n\n\n
            \u6700\u7ec8 \/etc\/network\/interfaces<\/code> \u793a\u4f8b<\/h3>\n\n\n\n
            \u7f16\u8f91 \/etc\/network\/interfaces<\/code>\uff1a<\/p>\n\n\n\n
            auto lo\niface lo inet loopback\n\nauto enp0s3\niface enp0s3 inet dhcp\n\nauto dummy0\niface dummy0 inet manual\n        pre-up ip link add dummy0 type dummy || true\n        post-down ip link delete dummy0 type dummy 2>\/dev\/null || true\n\nauto vmbr0\niface vmbr0 inet static\n        address 10.10.10.1\/24\n        bridge-ports dummy0\n        bridge-stp off\n        bridge-fd 0\n        post-up iptables -t nat -C POSTROUTING -s 10.10.10.0\/24 -o enp0s3 -j MASQUERADE 2>\/dev\/null || iptables -t nat -A POSTROUTING -s 10.10.10.0\/24 -o enp0s3 -j MASQUERADE\n        post-down iptables -t nat -D POSTROUTING -s 10.10.10.0\/24 -o enp0s3 -j MASQUERADE 2>\/dev\/null || true<\/code><\/pre>\n\n\n\n
            \u542f\u7528 IPv4 \u8f6c\u53d1\uff1a<\/p>\n\n\n\n
            cat > \/etc\/sysctl.d\/99-pve-lxc-nat.conf <<'EOF'\nnet.ipv4.ip_forward=1\nEOF\n\nsysctl --system<\/code><\/pre>\n\n\n\n
            \u68c0\u67e5\uff1a<\/p>\n\n\n\n
            sysctl net.ipv4.ip_forward\niptables -t nat -S POSTROUTING | grep 10.10.10.0\/24<\/code><\/pre>\n\n\n\n
            \u671f\u671b\u770b\u5230\uff1a<\/p>\n\n\n\n
            net.ipv4.ip_forward = 1\n-A POSTROUTING -s 10.10.10.0\/24 -o enp0s3 -j MASQUERADE<\/code><\/pre>\n\n\n\n
            \u8fdc\u7a0b\u4e91\u670d\u52a1\u5668\u4e0a\u5e94\u7528\u7f51\u7edc\u914d\u7f6e\u6709\u65ad\u8fde\u98ce\u9669\u3002\u5efa\u8bae\u5148\u68c0\u67e5\u8bed\u6cd5\uff1a<\/p>\n\n\n\n
            ifreload -a -s<\/code><\/pre>\n\n\n\n
            \u786e\u8ba4\u6709\u63a7\u5236\u53f0\u6216\u6551\u63f4\u65b9\u5f0f\u540e\u518d\u5b9e\u9645\u5e94\u7528\u3002<\/p>\n\n\n\n
            \u5982\u679c\u53ea\u662f\u8ba9 PVE \u9762\u677f\u5237\u65b0\u7f51\u7edc\u4fe1\u606f\uff0c\u53ef\u4ee5\u91cd\u542f PVE API \u548c Web\uff1a<\/p>\n\n\n\n
            systemctl restart pvedaemon pveproxy<\/code><\/pre>\n\n\n\n
            \u68c0\u67e5 PVE \u662f\u5426\u8bc6\u522b vmbr0<\/code>\uff1a<\/p>\n\n\n\n
            pvesh get \/nodes\/$(hostname)\/network --type any_bridge<\/code><\/pre>\n\n\n\n
            \u5e94\u80fd\u770b\u5230 vmbr0<\/code>\uff0c\u7c7b\u578b\u662f bridge<\/code>\u3002<\/p>\n\n\n\n
            IPv6 \/ DHCPv6 \u6ce8\u610f\u4e8b\u9879<\/h2>\n\n\n\n
            OCI \u53ef\u80fd\u5df2\u7ecf\u7ed9\u5bbf\u4e3b\u673a\u5206\u914d\u4e86 IPv6 \u5730\u5740\uff0c\u4f46\u8fd9\u4e0d\u4e00\u5b9a\u9002\u5408\u4ea4\u7ed9 ifupdown2 \u7ba1\u7406\u3002<\/p>\n\n\n\n
            \u5982\u679c \/etc\/network\/interfaces<\/code> \u91cc\u5199\u4e86\uff1a<\/p>\n\n\n\n
            iface enp0s3 inet6 auto<\/code><\/pre>\n\n\n\n
            \u6216\u7c7b\u4f3c DHCPv6 \u914d\u7f6e\uff0cifreload -a<\/code> \u53ef\u80fd\u4f1a\u89e6\u53d1 dhclient -6<\/code>\uff0c\u7136\u540e\u5931\u8d25\u3002<\/p>\n\n\n\n
            \u5982\u679c\u5bb9\u5668\u53ea\u9700\u8981 IPv4 NAT\uff0c\u5efa\u8bae\u5bbf\u4e3b\u673a ifupdown2 \u914d\u7f6e\u91cc\u53ea\u4fdd\u7559\uff1a<\/p>\n\n\n\n
            auto enp0s3\niface enp0s3 inet dhcp<\/code><\/pre>\n\n\n\n
            \u8ba9 OCI \u8fd0\u884c\u65f6\u81ea\u5df1\u5904\u7406\u5bbf\u4e3b IPv6\uff0cLXC \u7f51\u7edc\u5219\u8d70 IPv4 NAT\u3002<\/p>\n\n\n\n
            ARM64 CT \u6a21\u677f\u4ece\u54ea\u91cc\u627e<\/h2>\n\n\n\n
            PVE \u81ea\u5e26\u6a21\u677f\u5217\u8868\u91cc\u7684 ARM64 \u6a21\u677f\u5f88\u5c11\u3002\u53ef\u4ee5\u4ece Linux Containers \u955c\u50cf\u7ad9\u4e0b\u8f7d\uff1a<\/p>\n\n\n\n
            https://images.linuxcontainers.org\/images\/<\/code><\/pre>\n\n\n\n
            \u76ee\u5f55\u683c\u5f0f\u5927\u81f4\u662f\uff1a<\/p>\n\n\n\n
            https://images.linuxcontainers.org\/images\/<\u53d1\u884c\u7248>\/<\u7248\u672c>\/arm64\/default\/<\u65e5\u671f>\/rootfs.tar.xz<\/code><\/pre>\n\n\n\n
            \u4f8b\u5982 Debian 13 trixie ARM64\uff1a<\/p>\n\n\n\n
            https://images.linuxcontainers.org\/images\/debian\/trixie\/arm64\/default\/<\/code><\/pre>\n\n\n\n
            \u8fdb\u5165\u6700\u65b0\u65e5\u671f\u76ee\u5f55\uff0c\u4e0b\u8f7d rootfs.tar.xz<\/code> \u5230 PVE \u6a21\u677f\u76ee\u5f55\uff1a<\/p>\n\n\n\n
            cd \/var\/lib\/vz\/template\/cache\nwget -O debian-13-trixie-default_YYYYMMDD_arm64.tar.xz \\\n  https://images.linuxcontainers.org\/images\/debian\/trixie\/arm64\/default\/YYYYMMDD_HH:MM\/rootfs.tar.xz<\/code><\/pre>\n\n\n\n
            \u5982\u679c\u76ee\u5f55\u91cc\u6709 SHA256SUMS<\/code>\uff0c\u5efa\u8bae\u6821\u9a8c\uff1a<\/p>\n\n\n\n
            wget -O SHA256SUMS \\\n  https://images.linuxcontainers.org\/images\/debian\/trixie\/arm64\/default\/YYYYMMDD_HH:MM\/SHA256SUMS\n\nsha256sum debian-13-trixie-default_YYYYMMDD_arm64.tar.xz<\/code><\/pre>\n\n\n\n
            \u628a\u8f93\u51fa\u548c SHA256SUMS<\/code> \u91cc\u7684 rootfs.tar.xz<\/code> \u5bf9\u5e94\u503c\u6bd4\u8f83\u3002<\/p>\n\n\n\n
            \u786e\u8ba4 PVE \u80fd\u8bc6\u522b\u6a21\u677f\uff1a<\/p>\n\n\n\n
            pveam list local<\/code><\/pre>\n\n\n\n
            \u521b\u5efa\u666e\u901a Debian \/ Ubuntu \u5bb9\u5668<\/h2>\n\n\n\n
            \u5047\u8bbe\u521b\u5efa\u4e00\u4e2a Debian \u5bb9\u5668\uff1a<\/p>\n\n\n\n
            VMID\uff1a100\nhostname\uff1adebian\nIP\uff1a10.10.10.101\/24\n\u7f51\u5173\uff1a10.10.10.1\nDNS\uff1a1.1.1.1 8.8.8.8\nCPU\uff1a1 \u6838\n\u5185\u5b58\uff1a2048 MB<\/code><\/pre>\n\n\n\n
            \u547d\u4ee4\u793a\u4f8b\uff1a<\/p>\n\n\n\n
            pct create 100 local:vztmpl\/debian-13-trixie-default_YYYYMMDD_arm64.tar.xz \\\n  --arch arm64 \\\n  --ostype debian \\\n  --hostname debian \\\n  --cores 1 \\\n  --memory 2048 \\\n  --swap 512 \\\n  --rootfs local:8 \\\n  --net0 name=eth0,bridge=vmbr0,ip=10.10.10.101\/24,gw=10.10.10.1 \\\n  --nameserver '1.1.1.1 8.8.8.8' \\\n  --searchdomain local \\\n  --unprivileged 1 \\\n  --features nesting=1 \\\n  --onboot 1<\/code><\/pre>\n\n\n\n
            \u542f\u52a8\uff1a<\/p>\n\n\n\n
            pct start 100<\/code><\/pre>\n\n\n\n
            \u8bbe\u7f6e root \u5bc6\u7801\uff1a<\/p>\n\n\n\n
            pct exec 100 -- passwd root<\/code><\/pre>\n\n\n\n
            \u68c0\u67e5\u7f51\u7edc\uff1a<\/p>\n\n\n\n
            pct exec 100 -- ip addr show eth0\npct exec 100 -- ip route\npct exec 100 -- cat \/etc\/resolv.conf\npct exec 100 -- ping -c 3 1.1.1.1\npct exec 100 -- getent hosts deb.debian.org<\/code><\/pre>\n\n\n\n
            \u521b\u5efa OpenWrt \u5bb9\u5668<\/h2>\n\n\n\n
            OpenWrt \u6bd4\u666e\u901a Debian\/Ubuntu \u7279\u6b8a\u3002\u5b83\u9ed8\u8ba4\u628a eth0<\/code> \u5f53\u6210 LAN\uff0c\u5e76\u4e14\u5e38\u89c1\u9ed8\u8ba4 IP \u662f 192.168.1.1<\/code>\uff0c\u6240\u4ee5 PVE \u7684 net0 ip=...<\/code> \u4e0d\u4e00\u5b9a\u4f1a\u81ea\u52a8\u751f\u6548\u3002<\/p>\n\n\n\n
            \u521b\u5efa\u793a\u4f8b\uff1a<\/p>\n\n\n\n
            pct create 102 local:vztmpl\/openwrt-24.10.x-armsr-armv8-rootfs.tar.gz \\\n  --arch arm64 \\\n  --ostype unmanaged \\\n  --hostname openwrt \\\n  --cores 1 \\\n  --memory 2048 \\\n  --swap 512 \\\n  --rootfs local:2 \\\n  --net0 name=eth0,bridge=vmbr0,ip=10.10.10.103\/24,gw=10.10.10.1 \\\n  --nameserver '1.1.1.1 8.8.8.8' \\\n  --searchdomain local \\\n  --unprivileged 0 \\\n  --features nesting=1 \\\n  --onboot 1<\/code><\/pre>\n\n\n\n
            \u542f\u52a8\uff1a<\/p>\n\n\n\n
            pct start 102<\/code><\/pre>\n\n\n\n
            \u8fdb\u5165\u5bb9\u5668\u540e\u4fee\u6539 OpenWrt \u7f51\u7edc\uff1a<\/p>\n\n\n\n
            pct exec 102 -- sh -c 'cp \/etc\/config\/network \/etc\/config\/network.before-pve-nat'\n\npct exec 102 -- sh -c \"cat > \/etc\/config\/network <<'EOF'\nconfig interface 'loopback'\n        option device 'lo'\n        option proto 'static'\n        option ipaddr '127.0.0.1'\n        option netmask '255.0.0.0'\n\nconfig globals 'globals'\n        option ula_prefix 'fd00:10:10:10::\/48'\n\nconfig device\n        option name 'br-lan'\n        option type 'bridge'\n        list ports 'eth0'\n\nconfig interface 'lan'\n        option device 'br-lan'\n        option proto 'static'\n        option ipaddr '10.10.10.103'\n        option netmask '255.255.255.0'\n        option gateway '10.10.10.1'\n        list dns '1.1.1.1'\n        list dns '8.8.8.8'\nEOF\n\/etc\/init.d\/network restart\"<\/code><\/pre>\n\n\n\n
            \u8bbe\u7f6e OpenWrt root \u5bc6\u7801\uff1a<\/p>\n\n\n\n
            pct exec 102 -- passwd root<\/code><\/pre>\n\n\n\n
            \u5b89\u88c5 LuCI \u4e2d\u6587\u5305\u793a\u4f8b\uff1a<\/p>\n\n\n\n
            pct exec 102 -- opkg update\npct exec 102 -- opkg install luci-i18n-base-zh-cn luci-i18n-firewall-zh-cn\npct exec 102 -- \/etc\/init.d\/uhttpd restart<\/code><\/pre>\n\n\n\n
            \u5982\u679c\u8981\u5b89\u88c5\u4e3b\u9898\uff0c\u4f18\u5148\u7528\u5b98\u65b9\u6e90\uff1a<\/p>\n\n\n\n
            pct exec 102 -- opkg install luci-theme-material\npct exec 102 -- uci set luci.main.mediaurlbase='\/luci-static\/material'\npct exec 102 -- uci commit luci\npct exec 102 -- \/etc\/init.d\/uhttpd restart<\/code><\/pre>\n\n\n\n
            \u7b2c\u4e09\u65b9 IPK \u4e3b\u9898\u5efa\u8bae\u4e0b\u8f7d\u540e\u5148\u6821\u9a8c hash\uff0c\u518d\u5b89\u88c5\u3002<\/p>\n\n\n\n
            \u521b\u5efa Kali \u5bb9\u5668<\/h2>\n\n\n\n
            Kali ARM64 \u6a21\u677f\u4e5f\u53ef\u4ee5\u4ece Linux Containers \u955c\u50cf\u7ad9\u627e\uff1a<\/p>\n\n\n\n
            https://images.linuxcontainers.org\/images\/kali\/current\/arm64\/default\/<\/code><\/pre>\n\n\n\n
            \u4e0b\u8f7d\u793a\u4f8b\uff1a<\/p>\n\n\n\n
            cd \/var\/lib\/vz\/template\/cache\nwget -O kali-current-arm64-default_YYYYMMDD_HHMM.tar.xz \\\n  https://images.linuxcontainers.org\/images\/kali\/current\/arm64\/default\/YYYYMMDD_HH:MM\/rootfs.tar.xz<\/code><\/pre>\n\n\n\n
            \u6821\u9a8c\u793a\u4f8b\uff1a<\/p>\n\n\n\n
            wget -O \/tmp\/kali-SHA256SUMS \\\n  https://images.linuxcontainers.org\/images\/kali\/current\/arm64\/default\/YYYYMMDD_HH:MM\/SHA256SUMS\n\nsha256sum kali-current-arm64-default_YYYYMMDD_HHMM.tar.xz<\/code><\/pre>\n\n\n\n
            \u521b\u5efa Kali CT \u793a\u4f8b\uff1a<\/p>\n\n\n\n
            pct create 103 local:vztmpl\/kali-current-arm64-default_YYYYMMDD_HHMM.tar.xz \\\n  --arch arm64 \\\n  --ostype unmanaged \\\n  --hostname kali \\\n  --cores 1 \\\n  --memory 4096 \\\n  --swap 512 \\\n  --rootfs local:12 \\\n  --net0 name=eth0,bridge=vmbr0,ip=10.10.10.104\/24,gw=10.10.10.1 \\\n  --nameserver '1.1.1.1 8.8.8.8' \\\n  --searchdomain local \\\n  --unprivileged 0 \\\n  --features nesting=1 \\\n  --onboot 1<\/code><\/pre>\n\n\n\n
            \u542f\u52a8\uff1a<\/p>\n\n\n\n
            pct start 103<\/code><\/pre>\n\n\n\n
            \u6709\u4e9b ostype unmanaged<\/code> \u955c\u50cf\u4e0d\u4f1a\u81ea\u52a8\u5e94\u7528 PVE \u7684 IPv4 \u914d\u7f6e\u3002\u5982\u679c\u542f\u52a8\u540e\u53d1\u73b0\u53ea\u6709 IPv6 link-local\uff0c\u9700\u8981\u5728\u5bb9\u5668\u91cc\u5199\u9759\u6001\u7f51\u7edc\u3002<\/p>\n\n\n\n
            Kali \u4f7f\u7528 systemd-networkd \u7684\u793a\u4f8b\uff1a<\/p>\n\n\n\n
            pct exec 103 -- bash -lc \"cat > \/etc\/systemd\/network\/10-eth0.network <<'EOF'\n[Match]\nName=eth0\n\n[Network]\nAddress=10.10.10.104\/24\nGateway=10.10.10.1\nDNS=1.1.1.1\nDNS=8.8.8.8\nDomains=local\nEOF\nsystemctl enable --now systemd-networkd\nsystemctl restart systemd-networkd\nrm -f \/etc\/resolv.conf\nprintf 'search local\\nnameserver 1.1.1.1\\nnameserver 8.8.8.8\\n' > \/etc\/resolv.conf\"<\/code><\/pre>\n\n\n\n
            Kali \u7684 DNS \u53ef\u80fd\u4f18\u5148\u8fd4\u56de IPv6\uff0c\u4f46\u672c\u6587\u7f51\u7edc\u53ea\u6709 IPv4 NAT\u3002apt \u53ef\u4ee5\u5f3a\u5236 IPv4\uff1a<\/p>\n\n\n\n
            pct exec 103 -- bash -lc \"printf 'Acquire::ForceIPv4 \\\"true\\\";\\n' > \/etc\/apt\/apt.conf.d\/99-force-ipv4\"<\/code><\/pre>\n\n\n\n
            \u5b89\u88c5 SSH\uff1a<\/p>\n\n\n\n
            pct exec 103 -- bash -lc \"apt-get -o Acquire::ForceIPv4=true update\"\npct exec 103 -- bash -lc \"DEBIAN_FRONTEND=noninteractive apt-get -o Acquire::ForceIPv4=true install -y openssh-server\"<\/code><\/pre>\n\n\n\n
            \u5141\u8bb8 root \u5bc6\u7801\u767b\u5f55\uff1a<\/p>\n\n\n\n
            pct exec 103 -- passwd root\n\npct exec 103 -- bash -lc \"install -d -m 0755 \/etc\/ssh\/sshd_config.d\ncat > \/etc\/ssh\/sshd_config.d\/99-root-login.conf <<'EOF'\nPermitRootLogin yes\nPasswordAuthentication yes\nEOF\nsystemctl enable --now ssh || service ssh start\"<\/code><\/pre>\n\n\n\n
            \u9a8c\u8bc1\uff1a<\/p>\n\n\n\n
            pct exec 103 -- ss -ltn | grep ':22 '<\/code><\/pre>\n\n\n\n
            \u521b\u5efa Oracle Linux \u5bb9\u5668<\/h2>\n\n\n\n
            Oracle Linux ARM64 \u6a21\u677f\u76ee\u5f55\u793a\u4f8b\uff1a<\/p>\n\n\n\n
            https://images.linuxcontainers.org\/images\/oracle\/10\/arm64\/default\/<\/code><\/pre>\n\n\n\n
            \u4e0b\u8f7d\uff1a<\/p>\n\n\n\n
            cd \/var\/lib\/vz\/template\/cache\nwget -O oracle-10-arm64-default_YYYYMMDD_HHMM.tar.xz \\\n  https://images.linuxcontainers.org\/images\/oracle\/10\/arm64\/default\/YYYYMMDD_HH:MM\/rootfs.tar.xz<\/code><\/pre>\n\n\n\n
            \u6821\u9a8c\uff1a<\/p>\n\n\n\n
            wget -O \/tmp\/oracle-SHA256SUMS \\\n  https://images.linuxcontainers.org\/images\/oracle\/10\/arm64\/default\/YYYYMMDD_HH:MM\/SHA256SUMS\n\nsha256sum oracle-10-arm64-default_YYYYMMDD_HHMM.tar.xz<\/code><\/pre>\n\n\n\n
            \u521b\u5efa Oracle Linux CT\uff1a<\/p>\n\n\n\n
            pct create 104 local:vztmpl\/oracle-10-arm64-default_YYYYMMDD_HHMM.tar.xz \\\n  --arch arm64 \\\n  --ostype unmanaged \\\n  --hostname oracle \\\n  --cores 1 \\\n  --memory 2048 \\\n  --swap 512 \\\n  --rootfs local:10 \\\n  --net0 name=eth0,bridge=vmbr0,ip=10.10.10.105\/24,gw=10.10.10.1 \\\n  --nameserver '1.1.1.1 8.8.8.8' \\\n  --searchdomain local \\\n  --unprivileged 0 \\\n  --features nesting=1 \\\n  --onboot 1<\/code><\/pre>\n\n\n\n
            \u542f\u52a8\uff1a<\/p>\n\n\n\n
            pct start 104<\/code><\/pre>\n\n\n\n
            \u5982\u679c\u6ca1\u62ff\u5230 IPv4\uff0c\u53ef\u4ee5\u7528 NetworkManager \u5199\u9759\u6001\u914d\u7f6e\uff1a<\/p>\n\n\n\n
            pct exec 104 -- bash -lc \"cat > \/etc\/NetworkManager\/system-connections\/eth0.nmconnection <<'EOF'<\/code><\/pre>\n\n\n
            [connection]<\/p>\n\n\n\n
            id=eth0 type=ethernet interface-name=eth0 autoconnect=true<\/p>\n\n\n
            [ipv4]<\/p>\n\n\n\n
            method=manual addresses=10.10.10.105\/24 gateway=10.10.10.1 dns=1.1.1.1;8.8.8.8; dns-search=local;<\/p>\n\n\n
            [ipv6]<\/p>\n\n\n\n
            method=ignore EOF chmod 600 \/etc\/NetworkManager\/system-connections\/eth0.nmconnection systemctl enable –now NetworkManager nmcli connection reload nmcli connection up eth0 || systemctl restart NetworkManager”<\/p>\n\n\n\n
            Oracle Linux \u4e5f\u5efa\u8bae\u5f3a\u5236 dnf \u4f7f\u7528 IPv4\uff1a<\/p>\n\n\n\n
            pct exec 104 -- bash -lc \"mkdir -p \/etc\/dnf\/dnf.conf.d\nprintf 'ip_resolve=4\\n' > \/etc\/dnf\/dnf.conf.d\/99-force-ipv4.conf\"<\/code><\/pre>\n\n\n\n
            \u5b89\u88c5 SSH\uff1a<\/p>\n\n\n\n
            pct exec 104 -- bash -lc \"dnf -y --setopt=ip_resolve=4 install openssh-server\"<\/code><\/pre>\n\n\n\n
            \u5141\u8bb8 root \u5bc6\u7801\u767b\u5f55\uff1a<\/p>\n\n\n\n
            pct exec 104 -- passwd root\n\npct exec 104 -- bash -lc \"install -d -m 0755 \/etc\/ssh\/sshd_config.d\ncat > \/etc\/ssh\/sshd_config.d\/99-root-login.conf <<'EOF'\nPermitRootLogin yes\nPasswordAuthentication yes\nEOF\nsystemctl enable --now sshd || \/usr\/sbin\/sshd\"<\/code><\/pre>\n\n\n\n
            \u9a8c\u8bc1\uff1a<\/p>\n\n\n\n
            pct exec 104 -- ss -ltn | grep ':22 '<\/code><\/pre>\n\n\n\n
            \u6ce8\u610f\uff1a\u67d0\u4e9b\u6781\u7b80 Oracle Linux rootfs \u53ef\u80fd\u6ca1\u6709 hostname<\/code> \u547d\u4ee4\u3002\u8fd9\u4e0d\u5f71\u54cd SSH\u3002\u53ef\u4ee5\u5148\u5199 \/etc\/hostname<\/code>\uff1a<\/p>\n\n\n\n
            pct exec 104 -- sh -c \"echo oracle > \/etc\/hostname\"<\/code><\/pre>\n\n\n\n
            \u5bb9\u5668 DNS \u600e\u4e48\u586b<\/h2>\n\n\n\n
            \u672c\u6587\u5bbf\u4e3b\u673a\u53ea\u505a NAT\uff0c\u6ca1\u6709\u914d\u7f6e DNS \u8f6c\u53d1\u670d\u52a1\u3002\u6240\u4ee5\u5bb9\u5668 DNS \u4e0d\u8981\u586b 10.10.10.1<\/code>\u3002<\/p>\n\n\n\n
            \u63a8\u8350\uff1a<\/p>\n\n\n\n
            DNS\uff1a1.1.1.1\n\u5907\u7528 DNS\uff1a8.8.8.8<\/code><\/pre>\n\n\n\n
            PVE \u547d\u4ee4\u884c\u53ef\u4ee5\u5199\uff1a<\/p>\n\n\n\n
            --nameserver '1.1.1.1 8.8.8.8'<\/code><\/pre>\n\n\n\n
            PVE \u9762\u677f\u91cc\u5982\u679c\u53ea\u6709\u4e00\u4e2a\u8f93\u5165\u6846\uff0c\u4e5f\u53ef\u4ee5\u586b\uff1a<\/p>\n\n\n\n
            1.1.1.1 8.8.8.8<\/code><\/pre>\n\n\n\n
            \u7aef\u53e3\u8f6c\u53d1\u539f\u7406<\/h2>\n\n\n\n
            \u5bb9\u5668\u5728 10.10.10.0\/24<\/code> \u79c1\u7f51\u91cc\uff0c\u5916\u7f51\u4e0d\u80fd\u76f4\u63a5\u8bbf\u95ee\u3002\u8981\u8ba9\u516c\u7f51\u8bbf\u95ee\u5bb9\u5668\u670d\u52a1\uff0c\u9700\u8981\u5728 PVE \u5bbf\u4e3b\u673a\u4e0a\u505a\u4e24\u4ef6\u4e8b\uff1a<\/p>\n\n\n\n
              \n
            1. DNAT\uff1a\u628a\u5bbf\u4e3b\u673a\u516c\u7f51\u9ad8\u7aef\u53e3\u6539\u5199\u5230\u5bb9\u5668 IP \u548c\u670d\u52a1\u7aef\u53e3\u3002<\/li>\n\n\n\n
            2. FORWARD\uff1a\u5141\u8bb8\u8fd9\u6761\u8f6c\u53d1\u6d41\u91cf\u901a\u8fc7\u5bbf\u4e3b\u673a\u3002<\/li>\n<\/ol>\n\n\n\n
              \u4ee5\u628a\u5bb9\u5668 SSH \u66b4\u9732\u51fa\u53bb\u4e3a\u4f8b\uff1a<\/p>\n\n\n\n
              \u516c\u7f51\u8bbf\u95ee\uff1assh -p <HOST_PORT> root@<PUBLIC_IP>\n  \u2193\n\u5bbf\u4e3b\u673a enp0s3 \u6536\u5230 TCP <HOST_PORT>\n  \u2193\niptables PREROUTING DNAT\n  \u2193\n\u8f6c\u53d1\u5230 <CT_IP>:22\n  \u2193\n\u5bb9\u5668 sshd \u54cd\u5e94<\/code><\/pre>\n\n\n\n
              \u4ee5 Web \u670d\u52a1\u4e3a\u4f8b\uff1a<\/p>\n\n\n\n
              \u516c\u7f51\u8bbf\u95ee\uff1ahttp:\/\/<PUBLIC_IP>:<HOST_PORT>\/\n  \u2193\n\u5bbf\u4e3b\u673a enp0s3 \u6536\u5230 TCP <HOST_PORT>\n  \u2193\nDNAT \u5230 <CT_IP>:80\n  \u2193\n\u5bb9\u5668 HTTP \u670d\u52a1\u54cd\u5e94<\/code><\/pre>\n\n\n\n
              \u4e34\u65f6\u6dfb\u52a0\u7aef\u53e3\u8f6c\u53d1<\/h2>\n\n\n\n
              \u793a\u4f8b 1\uff1a\u628a OpenWrt LuCI \u4ece\u516c\u7f51\u9ad8\u7aef\u53e3\u8f6c\u53d1\u5230\u5bb9\u5668 80<\/code>\u3002<\/p>\n\n\n\n
              \u5bbf\u4e3b\u516c\u7f51\u7aef\u53e3\uff1a29971\n\u5bb9\u5668 IP\uff1a10.10.10.103\n\u5bb9\u5668\u670d\u52a1\u7aef\u53e3\uff1a80\n\u516c\u7f51\u8bbf\u95ee\uff1ahttp:\/\/<PUBLIC_IP>:29971\/<\/code><\/pre>\n\n\n\n
              \u547d\u4ee4\uff1a<\/p>\n\n\n\n
              iptables -t nat -A PREROUTING \\\n  -i enp0s3 -p tcp --dport 29971 \\\n  -j DNAT --to-destination 10.10.10.103:80\n\niptables -A FORWARD \\\n  -i enp0s3 -o vmbr0 \\\n  -p tcp -d 10.10.10.103 --dport 80 \\\n  -j ACCEPT<\/code><\/pre>\n\n\n\n
              \u793a\u4f8b 2\uff1a\u628a Kali SSH \u8f6c\u53d1\u51fa\u53bb\u3002<\/p>\n\n\n\n
              \u5bbf\u4e3b\u516c\u7f51\u7aef\u53e3\uff1a21025\n\u5bb9\u5668 IP\uff1a10.10.10.104\n\u5bb9\u5668\u670d\u52a1\u7aef\u53e3\uff1a22\n\u516c\u7f51\u8bbf\u95ee\uff1assh -p 21025 root@<PUBLIC_IP><\/code><\/pre>\n\n\n\n
              \u547d\u4ee4\uff1a<\/p>\n\n\n\n
              iptables -t nat -A PREROUTING \\\n  -i enp0s3 -p tcp --dport 21025 \\\n  -j DNAT --to-destination 10.10.10.104:22\n\niptables -A FORWARD \\\n  -i enp0s3 -o vmbr0 \\\n  -p tcp -d 10.10.10.104 --dport 22 \\\n  -j ACCEPT<\/code><\/pre>\n\n\n\n
              \u793a\u4f8b 3\uff1a\u628a Oracle Linux SSH \u8f6c\u53d1\u51fa\u53bb\u3002<\/p>\n\n\n\n
              \u5bbf\u4e3b\u516c\u7f51\u7aef\u53e3\uff1a36078\n\u5bb9\u5668 IP\uff1a10.10.10.105\n\u5bb9\u5668\u670d\u52a1\u7aef\u53e3\uff1a22\n\u516c\u7f51\u8bbf\u95ee\uff1assh -p 36078 root@<PUBLIC_IP><\/code><\/pre>\n\n\n\n
              \u547d\u4ee4\uff1a<\/p>\n\n\n\n
              iptables -t nat -A PREROUTING \\\n  -i enp0s3 -p tcp --dport 36078 \\\n  -j DNAT --to-destination 10.10.10.105:22\n\niptables -A FORWARD \\\n  -i enp0s3 -o vmbr0 \\\n  -p tcp -d 10.10.10.105 --dport 22 \\\n  -j ACCEPT<\/code><\/pre>\n\n\n\n
              \u8fd9\u4e9b\u89c4\u5219\u662f\u4e34\u65f6\u7684\uff0c\u91cd\u542f\u6216\u7f51\u7edc\u91cd\u8f7d\u540e\u53ef\u80fd\u4e22\u5931\u3002\u751f\u4ea7\u4f7f\u7528\u5efa\u8bae\u6301\u4e45\u5316\u3002<\/p>\n\n\n\n
              \u6301\u4e45\u5316\u7aef\u53e3\u8f6c\u53d1<\/h2>\n\n\n\n
              \u672c\u6587\u91c7\u7528\u628a\u89c4\u5219\u5199\u8fdb \/etc\/network\/interfaces<\/code> \u7684 vmbr0<\/code> \u6bb5\u3002<\/p>\n\n\n\n
              \u6539\u524d\u5148\u5907\u4efd\uff1a<\/p>\n\n\n\n
              cp -a \/etc\/network\/interfaces \/etc\/network\/interfaces.backup.$(date +%Y%m%d-%H%M%S)<\/code><\/pre>\n\n\n\n
              \u5728 iface vmbr0 inet static<\/code> \u4e0b\u9762\u52a0\u5165\u8f6c\u53d1\u89c4\u5219\u3002<\/p>\n\n\n\n
              OpenWrt LuCI \u793a\u4f8b\uff1a<\/p>\n\n\n\n
                      # openwrt-luci-forward\n        post-up iptables -t nat -C PREROUTING -i enp0s3 -p tcp --dport 29971 -j DNAT --to-destination 10.10.10.103:80 2>\/dev\/null || iptables -t nat -A PREROUTING -i enp0s3 -p tcp --dport 29971 -j DNAT --to-destination 10.10.10.103:80\n        post-up iptables -C FORWARD -i enp0s3 -o vmbr0 -p tcp -d 10.10.10.103 --dport 80 -j ACCEPT 2>\/dev\/null || iptables -A FORWARD -i enp0s3 -o vmbr0 -p tcp -d 10.10.10.103 --dport 80 -j ACCEPT\n        post-down iptables -t nat -D PREROUTING -i enp0s3 -p tcp --dport 29971 -j DNAT --to-destination 10.10.10.103:80 2>\/dev\/null || true\n        post-down iptables -D FORWARD -i enp0s3 -o vmbr0 -p tcp -d 10.10.10.103 --dport 80 -j ACCEPT 2>\/dev\/null || true<\/code><\/pre>\n\n\n\n
              Kali SSH \u793a\u4f8b\uff1a<\/p>\n\n\n\n
                      # kali-ssh-forward\n        post-up iptables -t nat -C PREROUTING -i enp0s3 -p tcp --dport 21025 -j DNAT --to-destination 10.10.10.104:22 2>\/dev\/null || iptables -t nat -A PREROUTING -i enp0s3 -p tcp --dport 21025 -j DNAT --to-destination 10.10.10.104:22\n        post-up iptables -C FORWARD -i enp0s3 -o vmbr0 -p tcp -d 10.10.10.104 --dport 22 -j ACCEPT 2>\/dev\/null || iptables -A FORWARD -i enp0s3 -o vmbr0 -p tcp -d 10.10.10.104 --dport 22 -j ACCEPT\n        post-down iptables -t nat -D PREROUTING -i enp0s3 -p tcp --dport 21025 -j DNAT --to-destination 10.10.10.104:22 2>\/dev\/null || true\n        post-down iptables -D FORWARD -i enp0s3 -o vmbr0 -p tcp -d 10.10.10.104 --dport 22 -j ACCEPT 2>\/dev\/null || true<\/code><\/pre>\n\n\n\n
              Oracle Linux SSH \u793a\u4f8b\uff1a<\/p>\n\n\n\n
                      # oracle-ssh-forward\n        post-up iptables -t nat -C PREROUTING -i enp0s3 -p tcp --dport 36078 -j DNAT --to-destination 10.10.10.105:22 2>\/dev\/null || iptables -t nat -A PREROUTING -i enp0s3 -p tcp --dport 36078 -j DNAT --to-destination 10.10.10.105:22\n        post-up iptables -C FORWARD -i enp0s3 -o vmbr0 -p tcp -d 10.10.10.105 --dport 22 -j ACCEPT 2>\/dev\/null || iptables -A FORWARD -i enp0s3 -o vmbr0 -p tcp -d 10.10.10.105 --dport 22 -j ACCEPT\n        post-down iptables -t nat -D PREROUTING -i enp0s3 -p tcp --dport 36078 -j DNAT --to-destination 10.10.10.105:22 2>\/dev\/null || true\n        post-down iptables -D FORWARD -i enp0s3 -o vmbr0 -p tcp -d 10.10.10.105 --dport 22 -j ACCEPT 2>\/dev\/null || true<\/code><\/pre>\n\n\n\n
              \u8fd9\u91cc\u7684 -C ... || -A ...<\/code> \u662f\u4e3a\u4e86\u907f\u514d\u91cd\u590d\u6dfb\u52a0\u540c\u4e00\u6761\u89c4\u5219\u3002<\/p>\n\n\n\n
              \u9009\u62e9\u516c\u7f51\u9ad8\u7aef\u53e3<\/h2>\n\n\n\n
              \u5efa\u8bae\u7528 10000<\/code> \u4ee5\u4e0a\u7684\u968f\u673a\u7aef\u53e3\uff0c\u907f\u5f00\u5e38\u89c1\u670d\u52a1\u7aef\u53e3\u3002<\/p>\n\n\n\n
              \u67e5\u770b\u5f53\u524d\u76d1\u542c\u7aef\u53e3\uff1a<\/p>\n\n\n\n
              ss -ltn<\/code><\/pre>\n\n\n\n
              \u67e5\u770b\u5df2\u6709 DNAT \u7aef\u53e3\uff1a<\/p>\n\n\n\n
              iptables -t nat -S PREROUTING<\/code><\/pre>\n\n\n\n
              \u968f\u673a\u6311\u4e00\u4e2a\u7aef\u53e3\uff1a<\/p>\n\n\n\n
              shuf -i 10000-60999 -n 1<\/code><\/pre>\n\n\n\n
              \u786e\u8ba4\u7aef\u53e3\u6ca1\u88ab\u5360\u7528\uff1a<\/p>\n\n\n\n
              PORT=21025\nss -ltn | grep -q \":$PORT \" && echo \"port in use\" || echo \"port free\"\niptables -t nat -S PREROUTING | grep -- \"--dport $PORT \" && echo \"dnat exists\" || echo \"dnat free\"<\/code><\/pre>\n\n\n\n
              OCI \u5b89\u5168\u5217\u8868 \/ \u7f51\u7edc\u5b89\u5168\u7ec4<\/h2>\n\n\n\n
              \u5bbf\u4e3b\u673a iptables \u914d\u597d\u4ee5\u540e\uff0cOCI \u4fa7\u4e5f\u8981\u653e\u884c\u5bf9\u5e94\u516c\u7f51\u7aef\u53e3\u3002<\/p>\n\n\n\n
              \u4f8b\u5982\u4f60\u8981\u8bbf\u95ee\uff1a<\/p>\n\n\n\n
              ssh -p 21025 root@<PUBLIC_IP><\/code><\/pre>\n\n\n\n
              OCI \u5b89\u5168\u5217\u8868\u6216 NSG \u9700\u8981\u5141\u8bb8\uff1a<\/p>\n\n\n\n
              \u6e90\uff1a\u4f60\u7684\u5ba2\u6237\u7aef IP\uff0c\u6216 0.0.0.0\/0\n\u534f\u8bae\uff1aTCP\n\u76ee\u6807\u7aef\u53e3\uff1a21025<\/code><\/pre>\n\n\n\n
              PVE \u9762\u677f\u5219\u9700\u8981\u5141\u8bb8\uff1a<\/p>\n\n\n\n
              TCP 8006<\/code><\/pre>\n\n\n\n
              OpenWrt LuCI \u793a\u4f8b\u9700\u8981\u5141\u8bb8\uff1a<\/p>\n\n\n\n
              TCP 29971<\/code><\/pre>\n\n\n\n
              \u5982\u679c iptables \u6ca1\u95ee\u9898\u4f46\u516c\u7f51\u8bbf\u95ee\u4e0d\u901a\uff0c\u4f18\u5148\u67e5 OCI \u5b89\u5168\u5217\u8868\/NSG\u3002<\/p>\n\n\n\n
              \u9a8c\u8bc1\u7aef\u53e3\u8f6c\u53d1<\/h2>\n\n\n\n
              \u9a8c\u8bc1\u5bb9\u5668\u670d\u52a1\u662f\u5426\u76d1\u542c\uff1a<\/p>\n\n\n\n
              pct exec 103 -- ss -ltn | grep ':22 '\npct exec 104 -- ss -ltn | grep ':22 '\npct exec 102 -- netstat -ltnp | grep ':80 '<\/code><\/pre>\n\n\n\n
              \u9a8c\u8bc1\u5bbf\u4e3b\u673a\u89c4\u5219\uff1a<\/p>\n\n\n\n
              iptables -t nat -S PREROUTING | grep 21025\niptables -S FORWARD | grep 10.10.10.104<\/code><\/pre>\n\n\n\n
              \u4ece\u5916\u90e8\u9a8c\u8bc1 SSH\uff1a<\/p>\n\n\n\n
              ssh -p 21025 root@<PUBLIC_IP>\nssh -p 36078 root@<PUBLIC_IP><\/code><\/pre>\n\n\n\n
              \u4ece\u5916\u90e8\u9a8c\u8bc1 HTTP\uff1a<\/p>\n\n\n\n
              curl -I http:\/\/<PUBLIC_IP>:29971\/<\/code><\/pre>\n\n\n\n
              \u5982\u679c\u8fd4\u56de HTTP\/1.1 200 OK<\/code>\u3001302<\/code> \u6216 LuCI \u767b\u5f55\u9875\u5185\u5bb9\uff0c\u8bf4\u660e\u901a\u4e86\u3002<\/p>\n\n\n\n
              \u57fa\u7840\u68c0\u67e5\u547d\u4ee4<\/h2>\n\n\n\n
              \u67e5\u770b\u5bb9\u5668\u5217\u8868\uff1a<\/p>\n\n\n\n
              pct list<\/code><\/pre>\n\n\n\n
              \u67e5\u770b\u5bb9\u5668\u914d\u7f6e\uff1a<\/p>\n\n\n\n
              pct config 103<\/code><\/pre>\n\n\n\n
              \u8fdb\u5165\u5bb9\u5668\uff1a<\/p>\n\n\n\n
              pct enter 103<\/code><\/pre>\n\n\n\n
              \u5728\u5bb9\u5668\u91cc\u6267\u884c\u547d\u4ee4\uff1a<\/p>\n\n\n\n
              pct exec 103 -- uname -m\npct exec 103 -- cat \/etc\/os-release<\/code><\/pre>\n\n\n\n
              \u68c0\u67e5 PVE \u5b58\u50a8\uff1a<\/p>\n\n\n\n
              pvesm status<\/code><\/pre>\n\n\n\n
              \u68c0\u67e5\u672c\u5730\u6a21\u677f\uff1a<\/p>\n\n\n\n
              pveam list local<\/code><\/pre>\n\n\n\n
              \u68c0\u67e5 bridge\uff1a<\/p>\n\n\n\n
              ip -br addr\nbridge link\npvesh get \/nodes\/$(hostname)\/network --type any_bridge<\/code><\/pre>\n\n\n\n
              \u68c0\u67e5 NAT\uff1a<\/p>\n\n\n\n
              sysctl net.ipv4.ip_forward\niptables -t nat -S\niptables -S FORWARD<\/code><\/pre>\n\n\n\n
              \u5e38\u89c1\u95ee\u9898<\/h2>\n\n\n\n
              PVE \u521b\u5efa CT \u65f6\u6865\u63a5\u4e0b\u62c9\u6846\u6ca1\u6709 vmbr0<\/h3>\n\n\n\n
              \u4f18\u5148\u68c0\u67e5\uff1a<\/p>\n\n\n\n
              pvesh get \/nodes\/$(hostname)\/network --type any_bridge<\/code><\/pre>\n\n\n\n
              \u5982\u679c\u770b\u4e0d\u5230 vmbr0<\/code>\uff0c\u5c1d\u8bd5\uff1a<\/p>\n\n\n\n
                \n
              • \u628a vmbr0<\/code> \u914d\u7f6e\u5199\u5165 \/etc\/network\/interfaces<\/code> \u4e3b\u6587\u4ef6\u3002<\/li>\n\n\n\n
              • \u4e0d\u8981\u53ea\u5199\u5728 \/etc\/network\/interfaces.d\/vmbr0<\/code>\u3002<\/li>\n\n\n\n
              • \u7ed9 vmbr0<\/code> \u4f7f\u7528 bridge-ports dummy0<\/code>\u3002<\/li>\n\n\n\n
              • \u91cd\u542f pvedaemon<\/code> \u548c pveproxy<\/code>\u3002<\/li>\n<\/ul>\n\n\n\n
                systemctl restart pvedaemon pveproxy<\/code><\/pre>\n\n\n\n
                ifupdown2 \u4e0d\u63a5\u53d7 bridge-ports none<\/h3>\n\n\n\n
                \u67d0\u4e9b\u73af\u5883\u4f1a\u62a5\uff1a<\/p>\n\n\n\n
                bridge-ports: invalid value \"none\"<\/code><\/pre>\n\n\n\n
                \u53ef\u4ee5\u6539\u7528 dummy0<\/code>\uff1a<\/p>\n\n\n\n
                auto dummy0\niface dummy0 inet manual\n        pre-up ip link add dummy0 type dummy || true\n        post-down ip link delete dummy0 type dummy 2>\/dev\/null || true\n\nauto vmbr0\niface vmbr0 inet static\n        address 10.10.10.1\/24\n        bridge-ports dummy0\n        bridge-stp off\n        bridge-fd 0<\/code><\/pre>\n\n\n\n
                \u5bb9\u5668\u6ca1\u6709 IPv4<\/h3>\n\n\n\n
                \u5982\u679c pct exec <VMID> -- ip addr<\/code> \u53ea\u770b\u5230 fe80::<\/code>\uff0c\u8bf4\u660e\u955c\u50cf\u6ca1\u6709\u5e94\u7528 PVE \u6ce8\u5165\u7684\u9759\u6001 IP\u3002<\/p>\n\n\n\n
                \u5904\u7406\u65b9\u5f0f\uff1a<\/p>\n\n\n\n
                  \n
                • Debian\/Kali \u8fd9\u7c7b systemd \u955c\u50cf\uff1a\u5199 \/etc\/systemd\/network\/10-eth0.network<\/code>\u3002<\/li>\n\n\n\n
                • Oracle Linux\/Fedora \u7cfb\uff1a\u5199 NetworkManager \u8fde\u63a5\u6587\u4ef6\u3002<\/li>\n\n\n\n
                • OpenWrt\uff1a\u6539 \/etc\/config\/network<\/code>\u3002<\/li>\n<\/ul>\n\n\n\n
                  \u5bb9\u5668\u80fd ping IP\uff0c\u4e0d\u80fd\u89e3\u6790\u57df\u540d<\/h3>\n\n\n\n
                  \u68c0\u67e5\uff1a<\/p>\n\n\n\n
                  pct exec <VMID> -- cat \/etc\/resolv.conf<\/code><\/pre>\n\n\n\n
                  \u63a8\u8350\u5199\uff1a<\/p>\n\n\n\n
                  nameserver 1.1.1.1\nnameserver 8.8.8.8<\/code><\/pre>\n\n\n\n
                  \u4e0d\u8981\u5199 10.10.10.1<\/code>\uff0c\u9664\u975e\u5bbf\u4e3b\u673a\u4e0a\u914d\u7f6e\u4e86 DNS \u8f6c\u53d1\u3002<\/p>\n\n\n\n
                  Kali apt \u89e3\u6790\u5230 IPv6 \u540e\u5931\u8d25<\/h3>\n\n\n\n
                  \u5982\u679c\u7f51\u7edc\u53ea\u6709 IPv4 NAT\uff0cKali apt \u53ef\u80fd\u89e3\u6790\u5230 IPv6 \u5730\u5740\u540e\u5931\u8d25\u3002\u5f3a\u5236 apt \u7528 IPv4\uff1a<\/p>\n\n\n\n
                  pct exec 103 -- bash -lc \"printf 'Acquire::ForceIPv4 \\\"true\\\";\\n' > \/etc\/apt\/apt.conf.d\/99-force-ipv4\"<\/code><\/pre>\n\n\n\n
                  \u7136\u540e\uff1a<\/p>\n\n\n\n
                  pct exec 103 -- apt-get update<\/code><\/pre>\n\n\n\n
                  Oracle dnf \u89e3\u6790\u5230 IPv6 \u540e\u5931\u8d25<\/h3>\n\n\n\n
                  \u5f3a\u5236 dnf \u7528 IPv4\uff1a<\/p>\n\n\n\n
                  pct exec 104 -- bash -lc \"mkdir -p \/etc\/dnf\/dnf.conf.d\nprintf 'ip_resolve=4\\n' > \/etc\/dnf\/dnf.conf.d\/99-force-ipv4.conf\"<\/code><\/pre>\n\n\n\n
                  \u6216\u8005\u6267\u884c\u5b89\u88c5\u65f6\u4e34\u65f6\u52a0\uff1a<\/p>\n\n\n\n
                  dnf -y --setopt=ip_resolve=4 install openssh-server<\/code><\/pre>\n\n\n\n
                  \u516c\u7f51\u7aef\u53e3\u8bbf\u95ee\u4e0d\u901a<\/h3>\n\n\n\n
                  \u6309\u987a\u5e8f\u67e5\uff1a<\/p>\n\n\n\n
                    \n
                  1. OCI \u5b89\u5168\u5217\u8868\u6216 NSG \u662f\u5426\u653e\u884c <HOST_PORT><\/code>\u3002<\/li>\n\n\n\n
                  2. \u5bbf\u4e3b\u673a iptables -t nat -S PREROUTING<\/code> \u662f\u5426\u6709 DNAT\u3002<\/li>\n\n\n\n
                  3. \u5bbf\u4e3b\u673a iptables -S FORWARD<\/code> \u662f\u5426\u653e\u884c\u5230\u5bb9\u5668\u3002<\/li>\n\n\n\n
                  4. net.ipv4.ip_forward<\/code> \u662f\u5426\u4e3a 1<\/code>\u3002<\/li>\n\n\n\n
                  5. \u5bb9\u5668\u670d\u52a1\u662f\u5426\u76d1\u542c\u5bf9\u5e94\u7aef\u53e3\u3002<\/li>\n\n\n\n
                  6. \u5bb9\u5668 IP \u662f\u5426\u6b63\u786e\u3002<\/li>\n<\/ol>\n\n\n\n
                    \u547d\u4ee4\uff1a<\/p>\n\n\n\n
                    sysctl net.ipv4.ip_forward\niptables -t nat -S PREROUTING\niptables -S FORWARD\npct exec <VMID> -- ss -ltn<\/code><\/pre>\n\n\n\n
                    PVE \u9762\u677f\u663e\u793a\u786c\u76d8\u53d8\u5c0f<\/h3>\n\n\n\n
                    50G \u4e91\u76d8\u5728 Linux \u91cc\u53ef\u80fd\u663e\u793a\u7ea6 49G\uff0c\u8fd9\u662f GB\/GiB \u6362\u7b97\u5dee\u5f02\u3002ext4 \u8fd8\u4f1a\u9884\u7559\u4e00\u90e8\u5206\u7a7a\u95f4\u7ed9 root\uff0cPVE \u672c\u8eab\u4e5f\u4f1a\u5360\u7528\u51e0 GB\u3002<\/p>\n\n\n\n
                    \u8fd9\u5c5e\u4e8e\u6b63\u5e38\u60c5\u51b5\uff0c\u4e0d\u662f\u786c\u76d8\u771f\u7684\u53d8\u5c0f\u3002<\/p>\n\n\n\n
                    \u4e00\u4e2a\u5b8c\u6574\u4f8b\u5b50<\/h2>\n\n\n\n
                    \u76ee\u6807\uff1a<\/p>\n\n\n\n
                    PVE \u5bbf\u4e3b\u516c\u7f51 IP\uff1a<PUBLIC_IP>\nLXC \u7f51\u6bb5\uff1a10.10.10.0\/24\nOpenWrt\uff1a102\uff0c10.10.10.103\uff0cLuCI 80 -> \u516c\u7f51 29971\nKali\uff1a103\uff0c10.10.10.104\uff0cSSH 22 -> \u516c\u7f51 21025\nOracle Linux\uff1a104\uff0c10.10.10.105\uff0cSSH 22 -> \u516c\u7f51 36078<\/code><\/pre>\n\n\n\n
                    \u516c\u7f51\u8bbf\u95ee\u65b9\u5f0f\uff1a<\/p>\n\n\n\n
                    # OpenWrt LuCI\nhttp://<PUBLIC_IP>:29971\/\n\n# Kali SSH\nssh -p 21025 root@<PUBLIC_IP>\n\n# Oracle Linux SSH\nssh -p 36078 root@<PUBLIC_IP><\/code><\/pre>\n\n\n\n
                    \u5bbf\u4e3b\u673a\u6301\u4e45\u5316\u89c4\u5219\u653e\u5728 \/etc\/network\/interfaces<\/code> \u7684 vmbr0<\/code> \u6bb5\uff0c\u5bb9\u5668\u5185\u90e8\u53ea\u9700\u8981\u786e\u4fdd\u670d\u52a1\u76d1\u542c\u81ea\u5df1\u7684\u5185\u7f51\u7aef\u53e3\u3002<\/p>\n\n\n\n
                    \u5b89\u5168\u5efa\u8bae<\/h2>\n\n\n\n
                      \n
                    • \u4e0d\u8981\u628a root \u5bc6\u7801\u5199\u8fdb\u516c\u5f00\u6559\u7a0b\u3002<\/li>\n\n\n\n
                    • \u516c\u7f51 SSH \u7aef\u53e3\u5efa\u8bae\u4f7f\u7528\u9ad8\u7aef\u53e3\uff0c\u5e76\u5728 OCI \u5b89\u5168\u5217\u8868\u91cc\u9650\u5236\u6765\u6e90 IP\u3002<\/li>\n\n\n\n
                    • \u5982\u679c\u957f\u671f\u4f7f\u7528\uff0c\u5efa\u8bae\u6539\u6210\u5bc6\u94a5\u767b\u5f55\uff0c\u7136\u540e\u5173\u95ed\u5bc6\u7801\u767b\u5f55\u3002<\/li>\n\n\n\n
                    • \u516c\u5f00 Web \u9762\u677f\u524d\u5148\u8bbe\u7f6e\u5f3a\u5bc6\u7801\u3002<\/li>\n\n\n\n
                    • \u7b2c\u4e09\u65b9 OpenWrt \u4e3b\u9898\u6216 IPK \u5305\u5148\u6821\u9a8c hash\uff0c\u518d\u5b89\u88c5\u3002<\/li>\n\n\n\n
                    • \u6bcf\u6b21\u6539 \/etc\/network\/interfaces<\/code> \u524d\u5148\u5907\u4efd\u3002<\/li>\n\n\n\n
                    • \u8fdc\u7a0b reload \u7f51\u7edc\u524d\u786e\u8ba4\u6709\u4e91\u63a7\u5236\u53f0\u6216\u6551\u63f4\u65b9\u5f0f\u3002<\/li>\n<\/ul>\n\n\n\n
                      \u603b\u7ed3<\/h2>\n\n\n\n
                      Oracle Cloud ARM \u4e0a\u5b89\u88c5 Proxmox VE 9 \u662f\u53ef\u884c\u7684\uff0c\u4f46\u6700\u9002\u5408\u4f5c\u4e3a LXC \u5bb9\u5668\u5e73\u53f0\u3002<\/p>\n\n\n\n
                      \u5173\u952e\u70b9\uff1a<\/p>\n\n\n\n
                        \n
                      • \u7528 Debian 13 trixie ARM64\u3002<\/li>\n\n\n\n
                      • \u7528 Proxmox VE 9 trixie arm64 \u6e90\u3002<\/li>\n\n\n\n
                      • \u6ca1\u6709 \/dev\/kvm<\/code> \u4e0d\u5f71\u54cd LXC\u3002<\/li>\n\n\n\n
                      • OCI \u4e3b\u7f51\u5361\u4e0d\u8981\u6865\u8fdb vmbr0<\/code>\u3002<\/li>\n\n\n\n
                      • \u5bb9\u5668\u4f7f\u7528 vmbr0<\/code> + IPv4 NAT \u51fa\u7f51\u3002<\/li>\n\n\n\n
                      • \u516c\u7f51\u8bbf\u95ee\u5bb9\u5668\u670d\u52a1\uff0c\u5728\u5bbf\u4e3b\u673a enp0s3<\/code> \u4e0a\u505a DNAT + FORWARD\u3002<\/li>\n\n\n\n
                      • \u8f6c\u53d1\u89c4\u5219\u5199\u8fdb \/etc\/network\/interfaces<\/code> \u7684 vmbr0<\/code> \u6bb5\u6301\u4e45\u5316\u3002<\/li>\n\n\n\n
                      • ARM64 \u6a21\u677f\u4ece Linux Containers \u955c\u50cf\u7ad9\u4e0b\u8f7d\uff0c\u5e76\u5c3d\u91cf\u505a SHA256 \u6821\u9a8c\u3002<\/li>\n<\/ul>\n\n\n\n
                        \u8fd9\u5957\u65b9\u6848\u4e0d\u9700\u8981 DD \u91cd\u88c5\uff0c\u98ce\u9669\u6bd4\u5237\u7b2c\u4e09\u65b9\u955c\u50cf\u4f4e\uff0c\u4e5f\u66f4\u9002\u5408 OCI \u8fd9\u79cd\u4e91\u7f51\u7edc\u73af\u5883\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
                        Oracle Cloud ARM \u5b89\u88c5 Proxmox VE 9\uff1a\u9762\u5411 LXC \u7684\u5b8c\u6574\u5b9e\u6218\u6559\u7a0b \u672c\u6587\u8bb0\u5f55\u4e00\u6b21\u5728 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-109","post","type-post","status-publish","format-standard","hentry","category-learn"],"_links":{"self":[{"href":"https:\/\/blog.yunbai.icu\/index.php?rest_route=\/wp\/v2\/posts\/109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.yunbai.icu\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.yunbai.icu\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.yunbai.icu\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.yunbai.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=109"}],"version-history":[{"count":3,"href":"https:\/\/blog.yunbai.icu\/index.php?rest_route=\/wp\/v2\/posts\/109\/revisions"}],"predecessor-version":[{"id":112,"href":"https:\/\/blog.yunbai.icu\/index.php?rest_route=\/wp\/v2\/posts\/109\/revisions\/112"}],"wp:attachment":[{"href":"https:\/\/blog.yunbai.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.yunbai.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.yunbai.icu\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}