Help answer threads with 0 replies.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 05-11-2009, 12:50 PM   #1
Registered: Nov 2008
Location: Madison, WI
Posts: 34

Rep: Reputation: 16
[SOLVED] static route for iptables NAT and tun/tap device

So there isn't much info out there related to what I am trying to do.

The basic idea is that I setup iptables for a NAT between eth0 (wired, internal side of NAT) and tun0 (virtual, external side of NAT). Then I take the packets from tun0 and encapsulated them and send them out ath0 (wireless) much like a vpn tunnel.

This basic idea works in some situations...namely as long as all the interfaces are on different networks. The problem I have is that the current setup requires that my tun0 be part of the same subnet as the machine that I am receiving all my return traffic from, i.e., the machine ath0 is connected to. After much digging I have found that the kernel just isn't properly routing the packets back to ath0.

I am really confused because I see packets in wireshark when I am capturing on the ath0 dev but my code never receives any of these packets, even though the packets have clearly the same destination IP address as that of my ath0. However if I tear down the NAT and the routes corresponding to tun0 my code receives all the packets.

The only thing I can figure is that the kernel is getting confused since the packet is sourced from an IP on the same subnet as the tun0 device.

Is there a reason why the kernel wouldn't route the packet even though the destination IP address is that of ath0?

Is there any good documentation on when/how the kernel exactly makes it's routing decisions and if the kernel tries to optimize route how it is doing that?

The routing table when using the NAT is the following:

Destination     Gateway         Genmask         Flags   Iface
w.x.y.z  UH      ath0    U       eth1         a.b.c.d          UG      tun0          U       ath0

and the packets that don't get routed are dest_ip=w.x.y.z and source_ip=a.b.c.e

And the setup is like:
internal network ---> eth1 -> NAT -> tun0 ------> ath0 ----> Internet


Last edited by j-osh; 05-11-2009 at 04:32 PM.
Old 05-11-2009, 04:30 PM   #2
Registered: Nov 2008
Location: Madison, WI
Posts: 34

Original Poster
Rep: Reputation: 16
So I got a copy of "Understanding Linux Network Internals" and after digging through that for awhile came across something I didn't know.

There is something called Reverse Path Filtering that will drop any packet whose source IP address is not reachable through the device the packet was received from, according to the routing table.

Which was happening in my case since the tun0 device was the same subnet as the source address of packets received on ath0.

To turn it off:
echo 0 > /proc/sys/net/ipv4/conf/ath0/rp_filter
Old 10-05-2015, 07:26 AM   #3
LQ Newbie
Registered: Dec 2007
Posts: 14

Rep: Reputation: 0

I am having similar problem seems you can help me to way out

I have created virtual interface tap0
Situation described as below
I have eth0 interface which has internet i.e
ping -I eth0
PING ( from eth0: 56(84) bytes of data.
64 bytes from ( icmp_req=1 ttl=53 time=6.54 ms
virtual interface (tap1 )created on Ubuntu 12.04.2 LTS as follows:-

tunctl -u root
Set 'tap0' persistent and owned by 'someuser'

Then, configure the interface as normal:

ifconfig tap0 up
route add -host dev tap0
bash -c 'echo 1 > /proc/sys/net/ipv4/conf/tap0/proxy_arp'
arp -Ds eth0 pub

Nat command executed as follows:-

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD --in-interface tap0 -j ACCEPT

root@ubuntu:~# ping -I tap1
PING ( from tap1: 56(84) bytes of data.
From icmp_seq=1 Destination Host Unreachable
From icmp_seq=2 Destination Host Unreachable
From icmp_seq=3 Destination Host Unreachable

route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface UG 0 0 0 tap1 UG 100 0 0 eth0 U 0 0 0 tap1 UH 0 0 0 tap1 U 0 0 0 eth0

Internal network -> tap0 -> eth0 -> Internet

Please advise!


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Static NAT with IPtables? TaNeK Linux - Networking 2 04-03-2009 01:52 PM
"getting" the TAP/TUN Device Driver.. A64 architecture jpena Linux - Networking 0 02-23-2007 01:36 AM
how to allow tun/tap device in firewall? efm Linux - Networking 12 07-22-2005 05:47 AM
Universal tun/tap device driver support giddyupman Linux - Networking 4 05-14-2004 11:04 AM
STATIC Route using IPTables Milkman00 Linux - Networking 3 03-06-2003 08:47 PM

All times are GMT -5. The time now is 02:25 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration