LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 05-17-2018, 06:33 PM   #1
Thansen971
LQ Newbie
 
Registered: May 2018
Posts: 1

Rep: Reputation: Disabled
Trying to get a firewall to only accept GRE


I have PC1 going to Router1 going to firewall going to Router2 going to PC2. This seems like a simple solution but i cannot get it to work.

All it has to do is accept any GRE traffic and drop everything else. It seems like its only pinging correctly when sent directly to the router or firewall but when I ping from pc to pc it ignores the rule completely.

https://imgur.com/a/e1x9mor
https://imgur.com/a/HbJal63

Above are what i have so far. Any help would be greatly appreciated.

Last edited by Thansen971; 05-17-2018 at 06:34 PM.
 
Old 05-18-2018, 12:56 PM   #2
/dev/random
Member
 
Registered: Aug 2012
Location: Ontario, Canada
Distribution: Slackware 14.1, LFS-current, NetBSD 6.1.3
Posts: 278

Rep: Reputation: 104Reputation: 104
Quote:
Originally Posted by Thansen971 View Post
I have PC1 going to Router1 going to firewall going to Router2 going to PC2. This seems like a simple solution but i cannot get it to work.

All it has to do is accept any GRE traffic and drop everything else. It seems like its only pinging correctly when sent directly to the router or firewall but when I ping from pc to pc it ignores the rule completely.

https://imgur.com/a/e1x9mor
https://imgur.com/a/HbJal63

Above are what i have so far. Any help would be greatly appreciated.
Try something like this:

modprobe nf_conntrack_proto_gre

Code:
tunnel_server_ip=217.x.x.x
false_ip=192.168.2.2
real_ip=82.x.x.x
/sbin/iptables -t nat -A PREROUTING -p 47 --src $tunnel_server_ip -j DNAT --to-destination $false_ip 
/sbin/iptables -t nat -A POSTROUTING nat -p 47 --src $false_ip -j SNAT --to-source $real_ip    
/sbin/iptables -A INPUT -p 47 -j ACCEPT
This will effectively NAT all your GRE traffic.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Vpn poptop - CTRL: PTY read or GRE write failed (pty,gre)=(5,6) dezeque Linux - Networking 9 08-26-2016 10:39 AM
[SOLVED] Virtual firewall that can support GRE/BGP Habitual Linux - Networking 4 04-24-2014 11:32 AM
how can firewall accept and reject the packets hinda Programming 2 05-14-2012 12:54 PM
icmp: 224.0.0.5 protocol 89 port 44 unreachable (gre encap) - Error over IPSEC/GRE kayasaman *BSD 5 03-03-2012 01:23 PM
GRE keepalives. How can a SUSE 9.0 Linux box send GRE keepalives? dlef Linux - Networking 1 06-28-2005 12:00 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 10:34 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration