Packet forwarding to tun device on OpenBSD

AlanCF · 06-20-2010, 04:29 AM

I set up a PPP connection over a serial cable between a PC running OpenBSD and another PC running Windows 3.1 with Trumpet Winsock. The Windows 3.1 PC doesn't have a NIC in it, but the OpenBSD one does. I can successfully ping the PCs from each other, but the Windows PC can't connect to the internet through the OpenBSD PC. I have set net.ip.forwarding to be 1, so that's not the problem. The OpenBSD PC has one NIC in it, using the we(4) driver. I'm trying to get all packets from the Windows machine to be forwarded to the default gateway (10.0.0.1). And all packets addressed to the Windows machine's address (10.0.0.105) to be forwarded to it. I tried pinging the default gateway from the Windows box and it didn't work.

Please help!
Thanks,
AlanCF

nimnull22 · 06-20-2010, 07:29 AM

If OpenBSD has "tcpdump", use it to find out where your packets go and what IP do they have.

AlanCF · 06-20-2010, 03:19 PM

I tried tcpdump, and I ran it with the "-i" argument to specify the interface (tun0) that I wanted to listen on. I saw the connection from 10.0.0.105 (windows box) to 10.0.0.2 (another box). I waited, and another of the same message came up. This is because (I think) the windows box couldn't establish a connection, so it timed out, and tried again. I can connect to 10.0.0.2 from 10.0.0.104 (the PPP tunnel server)

http://bin.z80.us/145 (ASCII ART diagram in pastebin because spaces didn't work correctly here)

10.0.0.105 can ping 10.0.0.103 and 10.0.0.104
10.0.0.105 CANNOT ping 10.0.0.2 (on interface we1)
10.0.0.103 can ping 10.0.0.2 (on interface we1)

I need all packets coming from tun0 to be forwarded out interface we1 and to the default gateway (10.0.0.1). It seems that packets coming into tun0 are ignored if their destination address is one other than assigned to an interface on the PPP server.

On both machines I have a default route to 10.0.0.1

Please help!

Thanks,
AlanCF

nimnull22 · 06-20-2010, 03:48 PM

Can you execute command on OpenBSD's root console (if it is the same with linux):
route -n

It should give routing table on OpenBSD.
Because, according to your picture, packets from 10.0.0.105 go through 10.0.0.104, then 10.0.0.103, and then they reach 10.0.0.2. And sender is 10.0.0.105, so 10.0.0.2 will replay to it and your router (on OpenBSD) should send that packets to ppp interface, what (I think) it doesn't do.
So we need to know routing table on OpenBSD, please delete ALL private addresses before post.

AlanCF · 06-20-2010, 04:33 PM

Okay, I fixed it. Apparrently, the packets were making it to the server, but not back. Because my network uses ARP, I had to configure an ARP entry in the ARP tables on the PPP host (10.0.0.104, 10.0.0.103) so that when the server (10.0.0.2) sent out an ARP request to try to figure out where to send the packets, it got nothing. When I created and ARP entry, the packets were successfully routed back to the computer. Using tcpdump on the interface connected to the internet helped a lot (thanks nimnull22)

AlanCF · 06-20-2010, 07:45 PM

Another problem just came up. If I have a SSH VPN tunnel, I get tun adapter on both ends. These adapters look like this in ifconfig:

Machine A:

Code:

tun0: flags=51<UP,POINTOPOINT,RUNNING> mtu 1500
	priority: 0
	groups: tun
	media: Ethernet autoselect
	status: active
	inet 10.0.0.201 --> 10.0.0.200 netmask 0xffffff00

Machine B:

Code:

tun0: flags=51<UP,POINTOPOINT,RUNNING> mtu 1500
	priority: 0
	groups: tun
	media: Ethernet autoselect
	status: active
	inet 10.0.0.200 --> 10.0.0.201 netmask 0xffffff00
                                 ^
                            "remote" address

I can ping both sides from each other, but when I enable routing on 10.0.0.201 (Machine A), and add the correct ARP entries, another computer on the same network cannot ping 10.0.0.200 (Machine B) through 10.0.0.201 (Machine A). However, if I change 10.0.0.200 (Machine A)'s "remote" address to be the address of the computer that I'm pinging from, it works. I am trying to figure out how to get rid of the remote address, so that any computer can connect to 10.0.0.200 (Machine B) through 10.0.0.201 (Machine A).

Thanks,
AlanCF

nimnull22 · 06-21-2010, 12:09 PM

Quote:

I am trying to figure out how to get rid of the remote address, so that any computer can connect to 10.0.0.200 (Machine B) through 10.0.0.201 (Machine A).

The same way as usual, you need to to add route with GW=tun IP and network behind it.
For instance, if host wants to go to 10.0.0.200 it needs to send packets to GW=10.0.0.201.