LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 05-11-2009, 11:50 AM   #1
j-osh
Member
 
Registered: Nov 2008
Location: Madison, WI
Posts: 34

Rep: Reputation: 16
[SOLVED] static route for iptables NAT and tun/tap device


So there isn't much info out there related to what I am trying to do.

The basic idea is that I setup iptables for a NAT between eth0 (wired, internal side of NAT) and tun0 (virtual, external side of NAT). Then I take the packets from tun0 and encapsulated them and send them out ath0 (wireless) much like a vpn tunnel.

This basic idea works in some situations...namely as long as all the interfaces are on different networks. The problem I have is that the current setup requires that my tun0 be part of the same subnet as the machine that I am receiving all my return traffic from, i.e., the machine ath0 is connected to. After much digging I have found that the kernel just isn't properly routing the packets back to ath0.

I am really confused because I see packets in wireshark when I am capturing on the ath0 dev but my code never receives any of these packets, even though the packets have clearly the same destination IP address as that of my ath0. However if I tear down the NAT and the routes corresponding to tun0 my code receives all the packets.

The only thing I can figure is that the kernel is getting confused since the packet is sourced from an IP on the same subnet as the tun0 device.

Is there a reason why the kernel wouldn't route the packet even though the destination IP address is that of ath0?

Is there any good documentation on when/how the kernel exactly makes it's routing decisions and if the kernel tries to optimize route how it is doing that?

The routing table when using the NAT is the following:

Code:
Destination     Gateway         Genmask         Flags   Iface
w.x.y.z         0.0.0.0         255.255.255.255  UH      ath0
10.10.10.0      0.0.0.0         255.255.255.0    U       eth1
0.0.0.0         a.b.c.d         0.0.0.0          UG      tun0
0.0.0.0         0.0.0.0         0.0.0.0          U       ath0

and the packets that don't get routed are dest_ip=w.x.y.z and source_ip=a.b.c.e

And the setup is like:
internal network ---> eth1 -> NAT -> tun0 ------> ath0 ----> Internet

Thanks

Last edited by j-osh; 05-11-2009 at 03:32 PM.
 
Old 05-11-2009, 03:30 PM   #2
j-osh
Member
 
Registered: Nov 2008
Location: Madison, WI
Posts: 34

Original Poster
Rep: Reputation: 16
So I got a copy of "Understanding Linux Network Internals" and after digging through that for awhile came across something I didn't know.

There is something called Reverse Path Filtering that will drop any packet whose source IP address is not reachable through the device the packet was received from, according to the routing table.

Which was happening in my case since the tun0 device was the same subnet as the source address of packets received on ath0.

To turn it off:
Code:
echo 0 > /proc/sys/net/ipv4/conf/ath0/rp_filter
 
Old 10-05-2015, 06:26 AM   #3
muradcsc
LQ Newbie
 
Registered: Dec 2007
Posts: 14

Rep: Reputation: 0
Hi

I am having similar problem seems you can help me to way out

I have created virtual interface tap0
Situation described as below
I have eth0 interface which has internet i.e
ping -I eth0 google.com
PING google.com (103.12.179.230) from 192.168.30.34 eth0: 56(84) bytes of data.
64 bytes from cache.google.com (103.12.179.230): icmp_req=1 ttl=53 time=6.54 ms
virtual interface (tap1 )created on Ubuntu 12.04.2 LTS as follows:-

tunctl -u root
Set 'tap0' persistent and owned by 'someuser'

Then, configure the interface as normal:

#
ifconfig tap0 192.168.0.254 up
#
route add -host 192.168.0.253 dev tap0
#
bash -c 'echo 1 > /proc/sys/net/ipv4/conf/tap0/proxy_arp'
#
arp -Ds 192.168.0.253 eth0 pub



Nat command executed as follows:-

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD --in-interface tap0 -j ACCEPT



root@ubuntu:~# ping -I tap1 google.com
PING google.com (103.12.179.241) from 192.168.0.254 tap1: 56(84) bytes of data.
From 192.168.0.254 icmp_seq=1 Destination Host Unreachable
From 192.168.0.254 icmp_seq=2 Destination Host Unreachable
From 192.168.0.254 icmp_seq=3 Destination Host Unreachable
^

route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.254 0.0.0.0 UG 0 0 0 tap1
0.0.0.0 192.168.30.254 0.0.0.0 UG 100 0 0 eth0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tap1
192.168.0.253 0.0.0.0 255.255.255.255 UH 0 0 0 tap1
192.168.30.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

Internal network -> tap0 -> eth0 -> Internet

Please advise!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Static NAT with IPtables? TaNeK Linux - Networking 2 04-03-2009 12:52 PM
"getting" the TAP/TUN Device Driver.. A64 architecture jpena Linux - Networking 0 02-23-2007 12:36 AM
how to allow tun/tap device in firewall? efm Linux - Networking 12 07-22-2005 04:47 AM
Universal tun/tap device driver support giddyupman Linux - Networking 4 05-14-2004 10:04 AM
STATIC Route using IPTables Milkman00 Linux - Networking 3 03-06-2003 07:47 PM


All times are GMT -5. The time now is 01:46 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration