I've been struggling with this issue for more than a week without much success, thus it's time to involve the serverfault experts ;-)
I have two LANs connected to the Internet, each with a public IP adress (thus using NAT). My goal is to have a machine on LAN A
route its traffic to the Internet through Router B
(so that it appears as coming from Router B
public IP using Router B
NAT).
For this I have setup a PPTP Tunnel between Router B
(Linux based machine), which connects as a client to a PPTP server on a Raspberry PI in LAN A
.
Here is a small schematic to illustrate the setup:
NOTE: I have SSH access to the RPi
and to Router B
(via it public IP address)
RPi
, I can ping Router B
and from Router B
, I can also ping the RPi
RPi
and Router B
(echo 1 > /proc/sys/net/ipv4/ip_forward
)RPi
: route add -net 192.168.2.0/24 gw 192.168.1.234 dev ppp0
Router B
: route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.10 dev ppp11
Router B
, I can ping the RPi
and other machines on LAN A
RPi
, I can ping Router B
and other machines on LAN B
PC1
(running Windows) in LAN A
, I've added a route to LAN B
trough the RPi
(ROUTE ADD 192.168.2.0 MASK 255.255.255.0 192.168.1.10
) which works OK, since I can ping Router B
from PC1
--> thus routing and IP forwarding work on the RPi
Now before, trying to forward all traffic, I tried to get it working first with a single host (8.8.8.8 which I know to answer pings). Thus on the RPi
, I've added a route: route add 8.8.8.8 gw 192.168.1.234 dev ppp0
Now here is the issue, after adding the rule, ping to 8.8.8.8 from the RPi don't get any reply!
On Router B
, I see packets arriving on ppp11 using tcpdump (tcpdump -i ppp11
):
# tcpdump -i ppp11
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ppp11, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
14:21:16.180268 IP 192.168.1.10 > 8.8.8.8: ICMP echo request, id 24018, seq 1, length 64
14:21:17.185980 IP 192.168.1.10 > 8.8.8.8: ICMP echo request, id 24018, seq 2, length 64
14:21:18.226376 IP 192.168.1.10 > 8.8.8.8: ICMP echo request, id 24018, seq 3, length 64
But nothing going out to ppp1.2 (whereas if I launch the ping directly on Router B
shell, I see the queries and replies to 8.8.8.8 on ppp1.2)
Thus I'm suspecting an issue with iptables. Unfortunately, TRACE doesn't seem to be available (or I was not able to get it working), thus I've using LOG rules:
iptables -t raw -I PREROUTING -d 8.8.8.8/32 -j LOG --log-prefix "TblrawPREROUTING:" --log-level 1
iptables -t mangle -I INPUT -d 8.8.8.8/32 -j LOG --log-prefix "TblmangleINPUT:" --log-level 1
iptables -t mangle -I FORWARD -d 8.8.8.8/32 -j LOG --log-prefix "TblmangleFORWARD:" --log-level 1
iptables -t mangle -I POSTROUTING -d 8.8.8.8/32 -j LOG --log-prefix "TblmanglePOSTROUTING:" --log-level 1
iptables -t filter -I FORWARD -d 8.8.8.8/32 -j LOG --log-prefix "TblfilterFORWARD:" --log-level 1
iptables -t filter -I -A OUTPUT -d 8.8.8.8/32 -j LOG --log-prefix "TblfilterOUTPUT:" --log-level 1
iptables -t nat -I PREROUTING -i ppp11 -j LOG --log-prefix "TblnatPREROUTING:" --log-level 1
iptables -t nat -I PREROUTING -d 8.8.8.8/32 -j LOG --log-prefix "TblnatPREROUTING:" --log-level 1
I can see the packets arriving at the beginning of chains raw/PREROUTING and nat/PREROUTING, but nothing either in mangle/INPUT or mangle/FORWARD:
TblrawPREROUTING:IN=ppp11 OUT= MAC= SRC=192.168.1.10 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=18426 DF PROTO=ICMP TYPE=8 CODE=0 ID=24018 SEQ=1 MARK=0x10000000
TblnatPREROUTING:IN=ppp11 OUT= MAC= SRC=192.168.1.10 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=18426 DF PROTO=ICMP TYPE=8 CODE=0 ID=24018 SEQ=1 MARK=0x10000000
What I find surprising is the MARK=0x10000000
, which packets originating from LAN B
don't seem to have:
TblrawPREROUTING:IN=br0 OUT= MAC=5c:e2:8c:ac:a5:df:ac:f1:08:11:b6:82:08:00 SRC=192.168.2.10 DST=8.8.8.8 LEN=71 TOS=0x00 PREC=0x00 TTL=64 ID=19502 DF PROTO=UDP SPT=52494 DPT=53 LEN=51
TblnatPREROUTING:IN=br0 OUT= MAC=5c:e2:8c:ac:a5:df:ac:f1:08:11:b6:82:08:00 SRC=192.168.2.10 DST=8.8.8.8 LEN=71 TOS=0x00 PREC=0x00 TTL=64 ID=19502 DF PROTO=UDP SPT=52494 DPT=53 LEN=51
TblmangleFORWARD:IN=br0 OUT=ppp1.2 MAC=5c:e2:8c:ac:a5:df:ac:f1:08:11:b6:82:08:00 SRC=192.168.2.10 DST=8.8.8.8 LEN=71 TOS=0x00 PREC=0x00 TTL=63 ID=19502 DF PROTO=UDP SPT=52494 DPT=53 LEN=51
TblfilterFORWARD:IN=br0 OUT=ppp1.2 MAC=5c:e2:8c:ac:a5:df:ac:f1:08:11:b6:82:08:00 SRC=192.168.2.10 DST=8.8.8.8 LEN=71 TOS=0x00 PREC=0x00 TTL=63 ID=19502 DF PROTO=UDP SPT=52494 DPT=53 LEN=51
TblmanglePOSTROUTING:IN= OUT=ppp1.2 SRC=192.168.2.10 DST=8.8.8.8 LEN=71 TOS=0x00 PREC=0x00 TTL=63 ID=19502 DF PROTO=UDP SPT=52494 DPT=53 LEN=51
Could this be the issue? what could be marking the packets coming from the ppp11 tunnel?
Any other ideas (either to solve this packet disappearing issue, or more generally my routing objective)?
Thanks in advance for your help!!! :-)
The reverse setup (Router B
going out on the Internet trough RPi
and Router A
) works fine:
if on Router B
, I add a route route add 1.1.1.1 gw 192.168.1.10 dev ppp11
, then on Router B
, a traceroute shows that packets to 1.1.1.1 are now going to the RPi
, then to Router A
and onto the Internet (and getting a reply!)
User contributions licensed under CC BY-SA 3.0