[{"data":1,"prerenderedAt":563},["ShallowReactive",2],{"notes-\u002Fnotes\u002Fwireguard-ping-stale-mac":3},{"id":4,"title":5,"body":6,"date":550,"description":551,"draft":552,"extension":553,"meta":554,"navigation":472,"path":555,"seo":556,"stem":557,"tags":558,"__hash__":562},"notes\u002Fnotes\u002Fwireguard-ping-stale-mac.md","VPN 連得進來，卻 ping 不到家裡那一台：換主機板後殘留的舊 MAC",{"type":7,"value":8,"toc":538},"minimark",[9,13,38,42,55,58,62,138,149,153,381,384,388,398,415,419,424,430,435,438,443,446,451,456,460,499,503],[10,11,12],"h2",{"id":12},"目錄",[14,15,16,20,23,26,29,32,35],"ol",{},[17,18,19],"li",{},"問題",[17,21,22],{},"環境",[17,24,25],{},"排查時間序",[17,27,28],{},"根本原因",[17,30,31],{},"幾個一開始想不通的地方",[17,33,34],{},"待辦",[17,36,37],{},"學到的事",[10,39,41],{"id":40},"_1-問題","1. 問題",[43,44,45,46,50,51,54],"p",{},"從外面透過 WireGuard 連回家（Mac，VPN IP ",[47,48,49],"code",{},"10.66.0.2","），ping 不到 HomeStation（",[47,52,53],{},"192.168.66.180","）。但同一個 LAN 裡的另一台主機 WKPHP 可以 ping 得到。",[43,56,57],{},"兩天前也發生過一次，當時重開 HomeStation 就好了，所以這次決定查到底。",[10,59,61],{"id":60},"_2-環境","2. 環境",[63,64,65,81],"table",{},[66,67,68],"thead",{},[69,70,71,75,78],"tr",{},[72,73,74],"th",{},"設備",[72,76,77],{},"角色",[72,79,80],{},"IP",[82,83,84,98,113,126],"tbody",{},[69,85,86,90,93],{},[87,88,89],"td",{},"ER605",[87,91,92],{},"路由器，WireGuard server，DHCP",[87,94,95],{},[47,96,97],{},"192.168.66.1",[69,99,100,103,109],{},[87,101,102],{},"HomeStation",[87,104,105,106],{},"要連的目標，網卡 ",[47,107,108],{},"eno1",[87,110,111],{},[47,112,53],{},[69,114,115,118,121],{},[87,116,117],{},"WKPHP",[87,119,120],{},"同一個 LAN 的另一台主機",[87,122,123],{},[47,124,125],{},"192.168.66.190",[69,127,128,131,134],{},[87,129,130],{},"Mac",[87,132,133],{},"從外面連 VPN 的客戶端",[87,135,136],{},[47,137,49],{},[43,139,140,141,144,145,148],{},"MAC 位址用代號替代：HomeStation 新主機板的網卡是 ",[47,142,143],{},"AA:BB:CC:DD:EE:FF","，換掉的舊網卡是 ",[47,146,147],{},"11:22:33:44:55:66","。",[10,150,152],{"id":151},"_3-排查時間序2026-10-23","3. 排查時間序（2026-10-23）",[63,154,155,168],{},[66,156,157],{},[69,158,159,162,165],{},[72,160,161],{},"時間",[72,163,164],{},"動作",[72,166,167],{},"結果與判斷",[82,169,170,184,201,214,226,248,262,276,290,304,315,332,354,370],{},[69,171,172,175,181],{},[87,173,174],{},"21:24",[87,176,177,178],{},"Mac 透過 VPN ping ",[47,179,180],{},".180",[87,182,183],{},"不通",[69,185,186,189,195],{},[87,187,188],{},"21:25",[87,190,177,191,194],{},[47,192,193],{},".190","（WKPHP）",[87,196,197,198,200],{},"通，TTL 63。VPN 和 ER605 的轉送都正常，問題出在 ",[47,199,180],{}," 這台",[69,202,203,206,211],{},[87,204,205],{},"21:27",[87,207,208,209],{},"從 WKPHP ping ",[47,210,180],{},[87,212,213],{},"通。HomeStation 本身在線，LAN 內也正常",[69,215,216,219,222],{},[87,217,218],{},"21:28",[87,220,221],{},"查 Mac 的 VPN IP",[87,223,224],{},[47,225,49],{},[69,227,228,231,238],{},[87,229,230],{},"21:29 到 21:30",[87,232,233,234,237],{},"Mac 無法直接 SSH 到 HomeStation，改從 WKPHP 跳板（",[47,235,236],{},"ssh -J","）進去，檢查路由和防火牆",[87,239,240,241,243,244,247],{},"回程路由正常走 ",[47,242,97],{},"，default route 正確。iptables 裡有殘留的 ufw 規則，但 ",[47,245,246],{},"ufw"," 指令已經不存在",[69,249,250,253,259],{},[87,251,252],{},"21:31 到 21:32",[87,254,255,256],{},"HomeStation 上跑 ",[47,257,258],{},"tcpdump",[87,260,261],{},"看得到 request，但沒有 reply",[69,263,264,267,273],{},[87,265,266],{},"21:34",[87,268,269,270],{},"加 ",[47,271,272],{},"iptables -I INPUT 1 -s 10.66.0.0\u002F24 -j ACCEPT",[87,274,275],{},"還是不通，排除 INPUT 白名單的問題",[69,277,278,281,287],{},[87,279,280],{},"21:36",[87,282,283,284,286],{},"看 INPUT 的計數，",[47,285,258],{}," 改抓所有介面",[87,288,289],{},"計數是 0，封包根本沒進到 INPUT",[69,291,292,294,297],{},[87,293,280],{},[87,295,296],{},"檢查 nft、raw、mangle",[87,298,299,300,303],{},"只有 Docker 自動產生的規則，計數都是 0。Docker 的網段也避開了 ",[47,301,302],{},"192.168.64.0\u002F20","，排除網段衝突",[69,305,306,309,312],{},[87,307,308],{},"21:42 到 21:43",[87,310,311],{},"ER605 的 log 出現 PPPoE PADI timeout，VPN 整個斷線",[87,313,314],{},"HiNet 主線短暫斷線。這是另一件事，之後自己恢復",[69,316,317,320,326],{},[87,318,319],{},"21:46",[87,321,322,323,325],{},"查 ER605 的 DHCP 保留清單，和 HomeStation ",[47,324,108],{}," 的 MAC",[87,327,328,329,331],{},"兩邊都是 ",[47,330,143],{},"，一致",[69,333,334,337,343],{},[87,335,336],{},"21:47",[87,338,339,342],{},[47,340,341],{},"tcpdump -e"," 看封包的 MAC",[87,344,345,346,348,349,353],{},"ER605 把封包送到 ",[47,347,147],{},"，",[350,351,352],"strong",{},"不是"," HomeStation 的 MAC",[69,355,356,359,362],{},[87,357,358],{},"21:50",[87,360,361],{},"查 ER605 的 ARP 表",[87,363,364,366,367],{},[47,365,180],{}," 確實對應到 ",[47,368,369],{},"11-22-33-44-55-66",[69,371,372,375,378],{},[87,373,374],{},"21:54",[87,376,377],{},"確認這個 MAC 是誰",[87,379,380],{},"HomeStation 換主機板之前的舊網卡",[43,382,383],{},"轉折點在 21:36 和 21:47：INPUT 計數是 0，代表封包在進防火牆之前就被丟了。往防火牆規則裡找是找不到的，要往更底層的第二層（MAC）看。",[10,385,387],{"id":386},"_4-根本原因","4. 根本原因",[43,389,390,391,393,394,397],{},"ER605 的設定裡還留著「",[47,392,180],{}," 對應舊主機板 MAC」的紀錄，留在 ",[350,395,396],{},"IP-MAC Binding"," 裡（2026-10-23 在路由器上找到並改掉）。",[14,399,400,403,406,412],{},[17,401,402],{},"換主機板後，新網卡上線時廣播了正確的 MAC，ER605 學到之後暫時用這筆新的動態紀錄，所以看起來一切正常",[17,404,405],{},"過一陣子，舊的紀錄又蓋回來",[17,407,408,409,411],{},"ER605 把要送給 ",[47,410,180],{}," 的封包，全部用舊網卡的 MAC 送出去",[17,413,414],{},"那張網卡已經不存在，HomeStation 收到「目的 MAC 不是自己」的封包，kernel 在進入防火牆之前就丟掉了",[10,416,418],{"id":417},"_5-幾個一開始想不通的地方","5. 幾個一開始想不通的地方",[43,420,421],{},[350,422,423],{},"為什麼 WKPHP ping 得到？",[43,425,426,427,429],{},"WKPHP 和 HomeStation 在同一個 LAN，WKPHP 自己發 ARP 問「誰是 ",[47,428,180],{},"」，HomeStation 用新的 MAC 回答，整個過程不經過 ER605 的 ARP 表。從 VPN 進來的封包要經過 ER605 轉送，才會用到那筆錯的紀錄。",[43,431,432],{},[350,433,434],{},"為什麼重開 HomeStation 會暫時好？",[43,436,437],{},"開機時網卡上線會重新廣播自己的 MAC，ER605 又學到正確的那筆，直到舊紀錄再次蓋回來。所以兩天前的「重開就好」只是暫時的。",[43,439,440],{},[350,441,442],{},"目的 MAC 是一張不存在的網卡，HomeStation 為什麼還收得到？",[43,444,445],{},"交換器的 MAC 表裡沒有這個舊 MAC，遇到不認識的目的地就會把封包送到所有埠（unknown unicast flooding），所以 HomeStation 的網卡還是收得到。",[43,447,448],{},[350,449,450],{},"收得到，為什麼 tcpdump 看得到、INPUT 計數卻是 0？",[43,452,453,455],{},[47,454,258],{}," 會把網卡切成混雜模式（promiscuous mode），連目的 MAC 不是自己的封包也會抓下來。但 kernel 處理時，目的 MAC 不符的封包會被標成「給別台主機的」，在進入 IP 層和 netfilter 之前就丟掉了。所以出現「tcpdump 看得到 request、防火牆計數是 0、沒有 reply」的組合。",[10,457,459],{"id":458},"_6-待辦","6. 待辦",[461,462,465,478,487,493],"ul",{"className":463},[464],"contains-task-list",[17,466,469,474,475,477],{"className":467},[468],"task-list-item",[470,471],"input",{"checked":472,"disabled":472,"type":473},true,"checkbox"," ER605：把 IP-MAC Binding 裡 ",[47,476,180],{}," 的 MAC 改成新網卡的 MAC，並存檔（2026-10-23）",[17,479,481,483,484,486],{"className":480},[468],[470,482],{"checked":472,"disabled":472,"type":473}," HomeStation：移除測試時加的 ",[47,485,272],{},"（重開機也會自動消失）",[17,488,490,492],{"className":489},[468],[470,491],{"checked":472,"disabled":472,"type":473}," 觀察：改完兩天後（2026-10-25）從 VPN ping 得到。上次「重開就好」大約兩天後就復發，這次撐過了同樣的時間",[17,494,496,498],{"className":495},[468],[470,497],{"disabled":472,"type":473}," 順手整理：殘留的 ufw 規則是從哪裡載入的，另外處理",[10,500,502],{"id":501},"_7-學到的事","7. 學到的事",[461,504,505,511,523,532],{},[17,506,507,510],{},[350,508,509],{},"換硬體要連路由器的設定一起換","：DHCP 保留和 IP-MAC Binding 都綁 MAC，換主機板、換網卡時兩邊都要更新，只改一邊會出現這種「時好時壞」的問題",[17,512,513,516,517,519,520,522],{},[350,514,515],{},"先用對照組縮小範圍","：ping 同網段的另一台（",[47,518,193],{},"）通、ping 目標（",[47,521,180],{},"）不通，一步就排除了 VPN 和路由器轉送",[17,524,525,528,529,531],{},[350,526,527],{},"防火牆計數是 0，就往下一層找","：封包沒進 INPUT，規則寫得再對也沒用。",[47,530,341],{}," 印出 MAC，第二層的問題才看得到",[17,533,534,537],{},[350,535,536],{},"「重開就好」不是修好","：會自己恢復的問題，背後通常有個會被重新蓋回來的狀態",{"title":539,"searchDepth":540,"depth":540,"links":541},"",2,[542,543,544,545,546,547,548,549],{"id":12,"depth":540,"text":12},{"id":40,"depth":540,"text":41},{"id":60,"depth":540,"text":61},{"id":151,"depth":540,"text":152},{"id":386,"depth":540,"text":387},{"id":417,"depth":540,"text":418},{"id":458,"depth":540,"text":459},{"id":501,"depth":540,"text":502},"2026-10-23","同一個 LAN 內 ping 得到，從 WireGuard 進來就不通。最後發現是路由器還記著換主機板之前的舊網卡 MAC。",false,"md",{},"\u002Fnotes\u002Fwireguard-ping-stale-mac",{"title":5,"description":551},"notes\u002Fwireguard-ping-stale-mac",[559,560,561],"網路","WireGuard","排查紀錄","o-NFGtShQbPRSYAxvAJ6acAOkSbrYF9kngwOagKLd6s",1793181520358]