LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 05-11-2009, 11:50 AM   #1
j-osh
Member
 
Registered: Nov 2008
Location: Madison, WI
Posts: 34

Rep: Reputation: 16
[SOLVED] static route for iptables NAT and tun/tap device


So there isn't much info out there related to what I am trying to do.

The basic idea is that I setup iptables for a NAT between eth0 (wired, internal side of NAT) and tun0 (virtual, external side of NAT). Then I take the packets from tun0 and encapsulated them and send them out ath0 (wireless) much like a vpn tunnel.

This basic idea works in some situations...namely as long as all the interfaces are on different networks. The problem I have is that the current setup requires that my tun0 be part of the same subnet as the machine that I am receiving all my return traffic from, i.e., the machine ath0 is connected to. After much digging I have found that the kernel just isn't properly routing the packets back to ath0.

I am really confused because I see packets in wireshark when I am capturing on the ath0 dev but my code never receives any of these packets, even though the packets have clearly the same destination IP address as that of my ath0. However if I tear down the NAT and the routes corresponding to tun0 my code receives all the packets.

The only thing I can figure is that the kernel is getting confused since the packet is sourced from an IP on the same subnet as the tun0 device.

Is there a reason why the kernel wouldn't route the packet even though the destination IP address is that of ath0?

Is there any good documentation on when/how the kernel exactly makes it's routing decisions and if the kernel tries to optimize route how it is doing that?

The routing table when using the NAT is the following:

Code:
Destination     Gateway         Genmask         Flags   Iface
w.x.y.z         0.0.0.0         255.255.255.255  UH      ath0
10.10.10.0      0.0.0.0         255.255.255.0    U       eth1
0.0.0.0         a.b.c.d         0.0.0.0          UG      tun0
0.0.0.0         0.0.0.0         0.0.0.0          U       ath0

and the packets that don't get routed are dest_ip=w.x.y.z and source_ip=a.b.c.e

And the setup is like:
internal network ---> eth1 -> NAT -> tun0 ------> ath0 ----> Internet

Thanks

Last edited by j-osh; 05-11-2009 at 03:32 PM.
 
Old 05-11-2009, 03:30 PM   #2
j-osh
Member
 
Registered: Nov 2008
Location: Madison, WI
Posts: 34

Original Poster
Rep: Reputation: 16
So I got a copy of "Understanding Linux Network Internals" and after digging through that for awhile came across something I didn't know.

There is something called Reverse Path Filtering that will drop any packet whose source IP address is not reachable through the device the packet was received from, according to the routing table.

Which was happening in my case since the tun0 device was the same subnet as the source address of packets received on ath0.

To turn it off:
Code:
echo 0 > /proc/sys/net/ipv4/conf/ath0/rp_filter
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Static NAT with IPtables? TaNeK Linux - Networking 2 04-03-2009 12:52 PM
"getting" the TAP/TUN Device Driver.. A64 architecture jpena Linux - Networking 0 02-23-2007 12:36 AM
how to allow tun/tap device in firewall? efm Linux - Networking 12 07-22-2005 04:47 AM
Universal tun/tap device driver support giddyupman Linux - Networking 4 05-14-2004 10:04 AM
STATIC Route using IPTables Milkman00 Linux - Networking 3 03-06-2003 07:47 PM


All times are GMT -5. The time now is 05:56 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration