How to route local machine traffic trough PPTP client internet connection?

0

I've been struggling with this issue for more than a week without much success, thus it's time to involve the serverfault experts ;-)

What I'm trying to achieve:

I have two LANs connected to the Internet, each with a public IP adress (thus using NAT). My goal is to have a machine on LAN A route its traffic to the Internet through Router B (so that it appears as coming from Router B public IP using Router B NAT).
For this I have setup a PPTP Tunnel between Router B (Linux based machine), which connects as a client to a PPTP server on a Raspberry PI in LAN A.

Here is a small schematic to illustrate the setup: Network diagram

What I've achieved so far:

NOTE: I have SSH access to the RPi and to Router B (via it public IP address)

  • The PPTP tunnel works fine: from the RPi, I can ping Router B and from Router B, I can also ping the RPi
  • IPv4 forwarding was enabled both on the RPi and Router B (echo 1 > /proc/sys/net/ipv4/ip_forward)
  • I've also added static routes:
    • On the RPi: route add -net 192.168.2.0/24 gw 192.168.1.234 dev ppp0
    • On Router B: route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.10 dev ppp11
  • From Router B, I can ping the RPi and other machines on LAN A
  • From the RPi, I can ping Router B and other machines on LAN B
  • Also, on PC1 (running Windows) in LAN A, I've added a route to LAN B trough the RPi (ROUTE ADD 192.168.2.0 MASK 255.255.255.0 192.168.1.10) which works OK, since I can ping Router B from PC1 --> thus routing and IP forwarding work on the RPi

Now before, trying to forward all traffic, I tried to get it working first with a single host (8.8.8.8 which I know to answer pings). Thus on the RPi, I've added a route: route add 8.8.8.8 gw 192.168.1.234 dev ppp0

The issue:

Now here is the issue, after adding the rule, ping to 8.8.8.8 from the RPi don't get any reply!
On Router B, I see packets arriving on ppp11 using tcpdump (tcpdump -i ppp11):

# tcpdump -i ppp11
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ppp11, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
14:21:16.180268 IP 192.168.1.10 > 8.8.8.8: ICMP echo request, id 24018, seq 1, length 64
14:21:17.185980 IP 192.168.1.10 > 8.8.8.8: ICMP echo request, id 24018, seq 2, length 64
14:21:18.226376 IP 192.168.1.10 > 8.8.8.8: ICMP echo request, id 24018, seq 3, length 64

But nothing going out to ppp1.2 (whereas if I launch the ping directly on Router B shell, I see the queries and replies to 8.8.8.8 on ppp1.2)

Thus I'm suspecting an issue with iptables. Unfortunately, TRACE doesn't seem to be available (or I was not able to get it working), thus I've using LOG rules:

iptables -t raw -I PREROUTING -d 8.8.8.8/32 -j LOG --log-prefix "TblrawPREROUTING:" --log-level 1
iptables -t mangle -I INPUT -d 8.8.8.8/32 -j LOG --log-prefix "TblmangleINPUT:" --log-level 1
iptables -t mangle -I FORWARD -d 8.8.8.8/32 -j LOG --log-prefix "TblmangleFORWARD:" --log-level 1
iptables -t mangle -I POSTROUTING -d 8.8.8.8/32 -j LOG --log-prefix "TblmanglePOSTROUTING:" --log-level 1
iptables -t filter -I FORWARD -d 8.8.8.8/32 -j LOG --log-prefix "TblfilterFORWARD:" --log-level 1
iptables -t filter -I -A OUTPUT -d 8.8.8.8/32 -j LOG --log-prefix "TblfilterOUTPUT:" --log-level 1
iptables -t nat -I PREROUTING -i ppp11 -j LOG --log-prefix "TblnatPREROUTING:" --log-level 1
iptables -t nat -I PREROUTING -d 8.8.8.8/32 -j LOG --log-prefix "TblnatPREROUTING:" --log-level 1

I can see the packets arriving at the beginning of chains raw/PREROUTING and nat/PREROUTING, but nothing either in mangle/INPUT or mangle/FORWARD:

TblrawPREROUTING:IN=ppp11 OUT= MAC= SRC=192.168.1.10 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=18426 DF PROTO=ICMP TYPE=8 CODE=0 ID=24018 SEQ=1 MARK=0x10000000
TblnatPREROUTING:IN=ppp11 OUT= MAC= SRC=192.168.1.10 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=18426 DF PROTO=ICMP TYPE=8 CODE=0 ID=24018 SEQ=1 MARK=0x10000000

What I find surprising is the MARK=0x10000000, which packets originating from LAN B don't seem to have:

TblrawPREROUTING:IN=br0 OUT= MAC=5c:e2:8c:ac:a5:df:ac:f1:08:11:b6:82:08:00 SRC=192.168.2.10 DST=8.8.8.8 LEN=71 TOS=0x00 PREC=0x00 TTL=64 ID=19502 DF PROTO=UDP SPT=52494 DPT=53 LEN=51
TblnatPREROUTING:IN=br0 OUT= MAC=5c:e2:8c:ac:a5:df:ac:f1:08:11:b6:82:08:00 SRC=192.168.2.10 DST=8.8.8.8 LEN=71 TOS=0x00 PREC=0x00 TTL=64 ID=19502 DF PROTO=UDP SPT=52494 DPT=53 LEN=51
TblmangleFORWARD:IN=br0 OUT=ppp1.2 MAC=5c:e2:8c:ac:a5:df:ac:f1:08:11:b6:82:08:00 SRC=192.168.2.10 DST=8.8.8.8 LEN=71 TOS=0x00 PREC=0x00 TTL=63 ID=19502 DF PROTO=UDP SPT=52494 DPT=53 LEN=51
TblfilterFORWARD:IN=br0 OUT=ppp1.2 MAC=5c:e2:8c:ac:a5:df:ac:f1:08:11:b6:82:08:00 SRC=192.168.2.10 DST=8.8.8.8 LEN=71 TOS=0x00 PREC=0x00 TTL=63 ID=19502 DF PROTO=UDP SPT=52494 DPT=53 LEN=51
TblmanglePOSTROUTING:IN= OUT=ppp1.2 SRC=192.168.2.10 DST=8.8.8.8 LEN=71 TOS=0x00 PREC=0x00 TTL=63 ID=19502 DF PROTO=UDP SPT=52494 DPT=53 LEN=51

Could this be the issue? what could be marking the packets coming from the ppp11 tunnel?
Any other ideas (either to solve this packet disappearing issue, or more generally my routing objective)?

Thanks in advance for your help!!! :-)

Note

The reverse setup (Router B going out on the Internet trough RPi and Router A) works fine:
if on Router B, I add a route route add 1.1.1.1 gw 192.168.1.10 dev ppp11, then on Router B, a traceroute shows that packets to 1.1.1.1 are now going to the RPi, then to Router A and onto the Internet (and getting a reply!)

iptables
routing
linux-networking
pptp
asked on Server Fault Jan 16, 2021 by Federico • edited Jan 17, 2021 by Federico

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0