OpenVZ Forum


Home » General » Support » NATed GRE packets does not reach VETH (NAT,GRE,VETH)
NATed GRE packets does not reach VETH (NAT,GRE,VETH) [message #33684] Fri, 31 October 2008 12:10 Go to next message
a1bert is currently offline  a1bert
Messages: 9
Registered: October 2007
Location: .cz
Junior Member
I am SNATing outgoing GRE packets, but they never show up in the outgoing VETH interface ....

the last trace of packet is in nat POSTROUTING table, it increases rule counter but then it disappears. no record in /proc/net/ip_conntrack ....


any idea?

[Updated on: Fri, 31 October 2008 12:34]

Report message to a moderator

Re: NATed GRE packets does not reach VETH (NAT,GRE,VETH) [message #33692 is a reply to message #33684] Fri, 31 October 2008 13:47 Go to previous messageGo to next message
maratrus is currently offline  maratrus
Messages: 1495
Registered: August 2007
Location: Moscow
Senior Member
Hello,

please describe your network configuration explicitly.
What commands have you issued?

Report message to a moderator

Re: NATed GRE packets does not reach VETH (NAT,GRE,VETH) [message #33694 is a reply to message #33692] Fri, 31 October 2008 14:36 Go to previous messageGo to next message
a1bert is currently offline  a1bert
Messages: 9
Registered: October 2007
Location: .cz
Junior Member
gre packet arrives via tun102 iface, should be NATed and then go out via eth0:


Linux routername 2.6.24-6-fza-686 #1 SMP Mon May 19 06:30:48 UTC 2008 i686 GNU/Linux


ip ro:
10.255.255.32 dev tun102  proto kernel  scope link  src 10.255.255.31 
x.x.202.20 dev lo  scope link 
y.y.227.192/27 dev eth0  proto kernel  scope link  src y.y.227.193 
10.24.127.0/24 dev eth0  proto kernel  scope link  src 10.24.127.8 
10.1.0.0/16 via 10.255.255.32 dev tun102 
default via 10.24.127.1 dev eth0 



  
# Generated by iptables-save v1.3.6 on Fri Oct 31 15:26:39 2008
*mangle
:PREROUTING ACCEPT [1537:90221]
:INPUT ACCEPT [328:27453]
:FORWARD ACCEPT [1199:62254]
:OUTPUT ACCEPT [233:35478]
:POSTROUTING ACCEPT [1432:97732]
COMMIT
# Completed on Fri Oct 31 15:26:39 2008
# Generated by iptables-save v1.3.6 on Fri Oct 31 15:26:39 2008
*filter
:INPUT ACCEPT [328:27453]
:FORWARD ACCEPT [1199:62254]
:OUTPUT ACCEPT [235:35742]
COMMIT
# Completed on Fri Oct 31 15:26:39 2008
# Generated by iptables-save v1.3.6 on Fri Oct 31 15:26:39 2008
*nat
:PREROUTING ACCEPT [23:1847]
:POSTROUTING ACCEPT [3:230]
:OUTPUT ACCEPT [2:175]
[2:175] -A POSTROUTING -s 10.24.127.8 -o eth0 -j RETURN 
[8:456] -A POSTROUTING -s 10.0.0.0/255.0.0.0 -o eth0 -p gre -j SNAT --to-source x.x.202.20 
[2:108] -A POSTROUTING -s 10.0.0.0/255.0.0.0 -o eth0 -j SNAT --to-source x.x.202.20 
COMMIT


tcpdump -i tun102 proto gre -n
tcpdump: WARNING: arptype 65534 not supported by libpcap - falling back to  
cooked socket
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun102, link-type LINUX_SLL (Linux cooked), capture size 96    
bytes
15:26:12.752991 IP 10.1.60.35 > 1.1.1.1: GREv1, call 5159, seq 0,length 37: LCP, Conf-Request (0x01), id 0, length 23
15:26:14.743937 IP 10.1.60.35 > 1.1.1.1: GREv1, call 5159, seq 1,length 37: LCP, Conf-Request (0x01), id 1, length 23
15:26:17.742849 IP 10.1.60.35 > 1.1.1.1: GREv1, call 5159, seq 2,length 37: LCP, Conf-Request (0x01), id 2, length 23
15:26:21.741342 IP 10.1.60.35 > 1.1.1.1: GREv1, call 5159, seq 3,length 37: LCP, Conf-Request (0x01), id 3, length 23
15:26:25.739857 IP 10.1.60.35 > 1.1.1.1: GREv1, call 5159, seq 4,length 37: LCP, Conf-Request (0x01), id 4, length 23


tcpdump -i eth0 proto gre -n
(note, only GRE from remote end, no NATted gre packets)
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
15:26:12.735405 IP1.1.1.1 > x.x.202.20: GREv1, call 32768, seq 1, ack 4294967295, length 35: LCP, Conf-Request (0x01), id 0, length 17
15:26:15.673657 IP1.1.1.1 > x.x.202.20: GREv1, call 32768, seq 2, length 31: LCP, Conf-Request (0x01), id 1, length 17
15:26:18.672094 IP1.1.1.1 > x.x.202.20: GREv1, call 32768, seq 3, length 31: LCP, Conf-Request (0x01), id 2, length 17
15:26:21.672513 IP1.1.1.1 > x.x.202.20: GREv1, call 32768, seq 4, length 31: LCP, Conf-Request (0x01), id 3, length 17
15:26:24.670767 IP1.1.1.1 > x.x.202.20: GREv1, call 32768, seq 5, length 31: LCP, Conf-Request (0x01), id 4, length 17
15:26:27.669076 IP1.1.1.1 > x.x.202.20: GREv1, call 32768, seq 6, length 31: LCP, Conf-Request (0x01), id 5, length 17

Report message to a moderator

Re: NATed GRE packets does not reach VETH (NAT,GRE,VETH) [message #33695 is a reply to message #33694] Fri, 31 October 2008 16:07 Go to previous messageGo to next message
maratrus is currently offline  maratrus
Messages: 1495
Registered: August 2007
Location: Moscow
Senior Member
Hello,

could you please answer some question:

- are we talking about VE? Are previous outputs from inside the VE?

- could you please show "ip a l" from inside the VE and also "ip rule list".

- I don't quite understand the following thing: have you masked ip address "1.1.1.1" that are shown in tcpdump ouput. Should your VE forward that packets?

- why do you need "-A POSTROUTING -s 10.24.127.8 -o eth0 -j RETURN " rule?

- could you please show "ip r get "1.1.1.1""

- could you please also run tcpdump on lo interface

Report message to a moderator

Re: NATed GRE packets does not reach VETH (NAT,GRE,VETH) [message #33713 is a reply to message #33695] Sun, 02 November 2008 18:54 Go to previous message
a1bert is currently offline  a1bert
Messages: 9
Registered: October 2007
Location: .cz
Junior Member
maratrus wrote on Fri, 31 October 2008 11:07


- are we talking about VE? Are previous outputs from inside the VE?



yes, it's all from inside VE

maratrus wrote on Fri, 31 October 2008 11:07


- could you please show "ip a l" from inside the VE and also "ip rule list".


1: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: venet0: <BROADCAST,POINTOPOINT,NOARP> mtu 1500 qdisc noop 
    link/void 
3: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue 
    link/ether 00:19:51:32:02:01 brd ff:ff:ff:ff:ff:ff
    inet 10.24.127.8/24 brd 10.24.127.255 scope global eth0
    inet 2.2.2.2/27 scope global eth0 
    inet6 fe80::219:51ff:fe32:201/64 scope link 
       valid_lft forever preferred_lft forever

2.2.2.2 is on different A network than 1.1.1.1

there is no special source routing:
# ip ru
0:      from all lookup 255 
32766:  from all lookup main 
32767:  from all lookup default

Quote:


- I don't quite understand the following thing: have you masked ip address "1.1.1.1" that are shown in tcpdump ouput. Should your VE forward that packets?


yes real addres is masked as 1.1.1.1 and is routable , everything works except proto 47 (GRE) packets. NATed ip is trying to establish pptp connection with 1.1.1.1, tcp handshake (port 1723) is succesfully established but not GRE ...

Quote:


- why do you need "-A POSTROUTING -s 10.24.127.8 -o eth0 -j RETURN " rule?



to not to NAT locally originating packets (10.24.127.8 is bind on eth0 interface)

Quote:


- could you please show "ip r get "1.1.1.1""



ip ro get 1.1.1.1
1.1.1.1 via 10.24.127.1 dev eth0  src 10.24.127.8 
    cache  mtu 1500 advmss 1460 hoplimit 64

As I said above 1.1.1.1 is routable , everything (UDP,TCP,ICMP) works except GRE

Quote:


- could you please also run tcpdump on lo interface



I have tried also lo, no GRE packets enters lo interface, GRE packets just disapear Sad, that is why I have created this thread

Report message to a moderator

Previous Topic: SSH and IPTABLES
Next Topic: Install OS without a OSTemplate?
Goto Forum:
  

[ Syndicate this forum (XML) ] [ RSS ] [ PDF ]

Current Time: Sat Jul 27 22:21:22 GMT 2024

Total time taken to generate the page: 0.02728 seconds
Powered by FUDforum Powered by Virtuozzo Containers