在Debian13中用命令行连接网络并配置路由功能

# 列出当前的网络设备
ip -br link # 这会显示MAC地址
ip -br addr # 这会显示IP地址
lo          # 这是本地回环设备     
enp1s0      # 物理网口1
enp3s0      # 物理网口2    
wlo1        # 无线网卡
br-lan      # 自建网桥
enxeafee62a8518 # 会在下次连接改变的USB共享网络临时设备
 
# 激活USB设备
ip link set enxeafee62a8518 up
# 检查当前系统自带的DHCP客户端
command -v dhcpcd dhclient udhcpc
# 以dhcpcd为例，获取共享网络分配的IP
dhcpcd enxeafee62a8518
# 此时可以检查一下是否UP
ip -br link
 
# 准备安装软件包
apt update
apt install -y network-manager wpasupplicant dnsmasq nftables firmware-iwlwifi rfkill curl git

# 清理一下原始网络配置（一般新机器不用管）
nano /etc/network/interfaces
# 这里就是删掉之前看到的那些，即将被配置的网络设备的配置段；随后重启一下服务
systemctl restart networking
 
# 将网络管理权交给`network-manager`
sed -i 's/managed=false/managed=true/g' /etc/NetworkManager/NetworkManager.conf
# 查看管理的设备
nmcli device status
 
# 开启wlo1设备管理（无线网口）
nmcli device set wlo1 managed yes
# 开机自启并重启服务
systemctl enable --now NetworkManager
systemctl restart NetworkManager
 
# 解锁无线射频并拉起wlo1
rfkill unblock wifi
nmcli radio wifi on
 
# 扫描wifi-ssid并展示
nmcli device wifi rescan ifname wlo1
nmcli device wifi list ifname wlo1
 
# 连接“校园网”
nmcli device wifi connect "<SSID>" ifname wlo1
nmcli device wifi connect "<SSID>" password "<pre-passwd>" ifname wlo1
# 设置开机自动连接
nmcli connection modify "<SSID>" connection.autoconnect yes
# 检查wlo1设备状态与分配ip
ip -br addr show wlo1

# 创建网桥 br-lan 并关闭 STP
nmcli connection add type bridge con-name br-lan ifname br-lan bridge.stp no
 
# 配置下游网关 IP（192.168.22.1/24）并设为开机自启
nmcli connection modify br-lan ipv4.addresses 192.168.22.1/24 ipv4.method manual connection.autoconnect yes
# （可选）注入策略路由：让 br-lan 流量直出主路由表，彻底隔离本机旁路代理
nmcli connection modify br-lan +ipv4.routing-rules "priority 100 iif br-lan table 254"
 
 
# 将两个物理有线口 enp1s0 和 enp3s0 加入 br-lan
nmcli connection add type ethernet slave-type bridge con-name br-lan-port1 ifname enp1s0 master br-lan connection.autoconnect yes
nmcli connection add type ethernet slave-type bridge con-name br-lan-port2 ifname enp3s0 master br-lan connection.autoconnect yes
 
# 激活配置
nmcli connection up br-lan
nmcli connection up br-lan-port1
nmcli connection up br-lan-port2
 
# PC连上物理网口，查看设备IP
ip -br addr show br-lan

# 备份初始设置
mv /etc/dnsmasq.conf /etc/dnsmasq.conf.bak 2>/dev/null
# 写入新设置
cat << 'EOF' > /etc/dnsmasq.conf
interface=br-lan
bind-dynamic
dhcp-range=192.168.22.100,192.168.22.200,255.255.255.0,12h
dhcp-option=3,192.168.22.1
dhcp-option=6,192.168.22.1
server=223.5.5.5
server=119.29.29.29
cache-size=1500
EOF
# 重启服务
systemctl enable --now dnsmasq
systemctl restart dnsmasq

# 查看当前租约表，找到路由器的MAC地址
cat /var/lib/misc/dnsmasq.leases
# 1718900000 00:e0:4c:68:01:23 192.168.22.105 XiaoQiang 01:00:e0:4c:68:01:23
# 这里的00:e0:4c:68:01:23为MAC地址
 
# 编辑配置
sudo nano /etc/dnsmasq.conf
# 在末尾写一行
dhcp-host=00:e0:4c:68:01:23,192.168.22.2,Router,infinite

# 开启内核IP转发
echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/99-router.conf
sysctl --system
 
# 备份原始设置
mv /etc/nftables.conf /etc/nftables.conf.bak 2>/dev/null
# 写入精简版配置
cat << 'EOF' > /etc/nftables.conf
#!/usr/sbin/nft -f
flush ruleset
 
table inet filter {
    chain input {
        type filter hook input priority filter; policy accept;
        ct state vmap { established : accept, related : accept, invalid : drop }
        iifname "lo" accept
        iifname "br-lan" accept
        iifname "wlo1" ip protocol icmp accept
        iifname "wlo1" drop
    }
 
    chain forward {
        type filter hook forward priority filter; policy accept;
        tcp flags syn tcp option maxseg size set rt mtu
        ct state vmap { established : accept, related : accept, invalid : drop }
        iifname "wlo1" drop
    }
}
 
table ip nat {
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        oifname "wlo1" masquerade
    }
}
EOF
# 开机自启
systemctl enable --now nftables
systemctl restart nftables

# 编辑本机DNS配置
nano /etc/resolv.conf
 
# 添加下面这一行，将请求发给本地，让dnsmasq接管
nameserver 127.0.0.1