Mdthbs

Is safe to use va_start macro with this as parameter?

Is it common practice to audition new musicians 1-2-1 before rehearsing with the entire band?

Is there any way for the UK Prime Minister to make a motion directly dependent on Government confidence?

When the Haste spell ends on a creature, do attackers have advantage against that creature?

How to compare two different files line by line in unix?

Can you use the Shield Master feat to shove someone before you make an attack by using a Readied action?

What do you call the main part of a joke?

Did MS DOS itself ever use blinking text?

Is it cost-effective to upgrade an old-ish Giant Escape R3 commuter bike with entry-level branded parts (wheels, drivetrain)?

Is "Reachable Object" really an NP-complete problem?

An adverb for when you're not exaggerating

Has negative voting ever been officially implemented in elections, or seriously proposed, or even studied?

How to find all the available tools in mac terminal?

If a VARCHAR(MAX) column is included in an index, is the entire value always stored in the index page(s)?

Crossing US/Canada Border for less than 24 hours

Why wasn't DOSKEY integrated with COMMAND.COM?

Can a new player join a group only when a new campaign starts?

また usage in a dictionary

How could we fake a moon landing now?

Can melee weapons be used to deliver Contact Poisons?

How to down pick a chord with skipped strings?

How do I find out the mythology and history of my Fortress?

Integration Help

Wu formula for manifolds with boundary

Trying to setup port redirection through 2nd gateway

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}

0

I am trying to setup configuration where all connections to port 161 will go through another gateway (through openvpn) while others are going directly

[localhost] -> [gateway] -> [remote] - OK

[localhost] <- [gateway] <- [remote] - packet dissappears after vpn tunnel. I am able to sniff that on tun0 iface, then it dissappears.

What I did:
added gw1 to rt_tables
then used this rules

ip route add default via 10.8.0.1 dev tun0 table gw1

ip rule add fwmark 0x1 table gw1

iptables -A OUTPUT -t mangle -o eth0 -p tcp --dport 443 -j MARK --set-mark 1

iptables -A POSTROUTING -t nat -o tun0 -p tcp --dport 443 -j SNAT --to 10.8.0.2

iptables -A OUTPUT -t mangle -o eth0 -p udp --dport 161 -j MARK --set-mark 1

iptables -A POSTROUTING -t nat -o tun0 -p udp --dport 161 -j SNAT --to 10.8.0.2

So I am testing tcp and udp connections and what I see:

• On remote side everything works correctly and packet is send back
  to gateway to eth0


• On gateway packet gets passed back to vpn tunnel (tun0)


• On localhost that sent that packet I see how packet arrive to
  10.8.0.2 (tun0) in tshark and then it dissapears. And localhost does TCP-retransmission or resends UDP packet.

I checked packet capture in wireshark and all ports are correct so it's using same random dynamic port during all that trasfer: back and forward. I also tried using masquerade on localhost instead of SNAT without any success.
Tried redirecting packets with DNAT to 127.0.0.1 with no success but I am not sure, maybe I'm doing anything wrong.

Why that packet dissapears after tun0? My input chain allows everything for now. Maybe I need to enable or disable any new "features" in sysctl.conf that I am not concerned about?

Thanks

centos iptables routing nat

share|improve this question

edited 7 hours ago

POMATu

asked 7 hours ago

POMATuPOMATu

1063

add a comment | 

0

I am trying to setup configuration where all connections to port 161 will go through another gateway (through openvpn) while others are going directly

[localhost] -> [gateway] -> [remote] - OK

[localhost] <- [gateway] <- [remote] - packet dissappears after vpn tunnel. I am able to sniff that on tun0 iface, then it dissappears.

What I did:
added gw1 to rt_tables
then used this rules

ip route add default via 10.8.0.1 dev tun0 table gw1

ip rule add fwmark 0x1 table gw1

iptables -A OUTPUT -t mangle -o eth0 -p tcp --dport 443 -j MARK --set-mark 1

iptables -A POSTROUTING -t nat -o tun0 -p tcp --dport 443 -j SNAT --to 10.8.0.2

iptables -A OUTPUT -t mangle -o eth0 -p udp --dport 161 -j MARK --set-mark 1

iptables -A POSTROUTING -t nat -o tun0 -p udp --dport 161 -j SNAT --to 10.8.0.2

So I am testing tcp and udp connections and what I see:

• On remote side everything works correctly and packet is send back
  to gateway to eth0


• On gateway packet gets passed back to vpn tunnel (tun0)


• On localhost that sent that packet I see how packet arrive to
  10.8.0.2 (tun0) in tshark and then it dissapears. And localhost does TCP-retransmission or resends UDP packet.

I checked packet capture in wireshark and all ports are correct so it's using same random dynamic port during all that trasfer: back and forward. I also tried using masquerade on localhost instead of SNAT without any success.
Tried redirecting packets with DNAT to 127.0.0.1 with no success but I am not sure, maybe I'm doing anything wrong.

Why that packet dissapears after tun0? My input chain allows everything for now. Maybe I need to enable or disable any new "features" in sysctl.conf that I am not concerned about?

Thanks

centos iptables routing nat

share|improve this question

edited 7 hours ago

POMATu

asked 7 hours ago

POMATuPOMATu

1063

add a comment | 

I am trying to setup configuration where all connections to port 161 will go through another gateway (through openvpn) while others are going directly

[localhost] -> [gateway] -> [remote] - OK

[localhost] <- [gateway] <- [remote] - packet dissappears after vpn tunnel. I am able to sniff that on tun0 iface, then it dissappears.

What I did:
added gw1 to rt_tables
then used this rules

ip route add default via 10.8.0.1 dev tun0 table gw1

ip rule add fwmark 0x1 table gw1

iptables -A OUTPUT -t mangle -o eth0 -p tcp --dport 443 -j MARK --set-mark 1

iptables -A POSTROUTING -t nat -o tun0 -p tcp --dport 443 -j SNAT --to 10.8.0.2

iptables -A OUTPUT -t mangle -o eth0 -p udp --dport 161 -j MARK --set-mark 1

iptables -A POSTROUTING -t nat -o tun0 -p udp --dport 161 -j SNAT --to 10.8.0.2

So I am testing tcp and udp connections and what I see:

• On remote side everything works correctly and packet is send back
  to gateway to eth0


• On gateway packet gets passed back to vpn tunnel (tun0)


• On localhost that sent that packet I see how packet arrive to
  10.8.0.2 (tun0) in tshark and then it dissapears. And localhost does TCP-retransmission or resends UDP packet.

I checked packet capture in wireshark and all ports are correct so it's using same random dynamic port during all that trasfer: back and forward. I also tried using masquerade on localhost instead of SNAT without any success.
Tried redirecting packets with DNAT to 127.0.0.1 with no success but I am not sure, maybe I'm doing anything wrong.

Why that packet dissapears after tun0? My input chain allows everything for now. Maybe I need to enable or disable any new "features" in sysctl.conf that I am not concerned about?

Thanks

centos iptables routing nat

share|improve this question

edited 7 hours ago

POMATu

asked 7 hours ago

POMATuPOMATu

1063

ip route add default via 10.8.0.1 dev tun0 table gw1

ip rule add fwmark 0x1 table gw1

iptables -A OUTPUT -t mangle -o eth0 -p tcp --dport 443 -j MARK --set-mark 1

iptables -A POSTROUTING -t nat -o tun0 -p tcp --dport 443 -j SNAT --to 10.8.0.2

iptables -A OUTPUT -t mangle -o eth0 -p udp --dport 161 -j MARK --set-mark 1

iptables -A POSTROUTING -t nat -o tun0 -p udp --dport 161 -j SNAT --to 10.8.0.2

share|improve this question

edited 7 hours ago

POMATu

asked 7 hours ago

POMATuPOMATu

1063

share|improve this question

edited 7 hours ago

POMATu

asked 7 hours ago

POMATuPOMATu

1063

asked 7 hours ago

POMATuPOMATu

1063

asked 7 hours ago

POMATuPOMATu

1063

1 Answer
1

active

oldest

votes

0

My rules are correct

Solution:

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > $f; done

echo 1 > /proc/sys/net/ipv4/route/flush 

Now everything is working fine. Note that you need to disable that on every iface, option "all" are not working fine.

share|improve this answer

answered 5 hours ago

POMATuPOMATu

1063

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f513060%2ftrying-to-setup-port-redirection-through-2nd-gateway%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

0

My rules are correct

Solution:

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > $f; done

echo 1 > /proc/sys/net/ipv4/route/flush 

Now everything is working fine. Note that you need to disable that on every iface, option "all" are not working fine.

share|improve this answer

answered 5 hours ago

POMATuPOMATu

1063

add a comment | 

0

My rules are correct

Solution:

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > $f; done

echo 1 > /proc/sys/net/ipv4/route/flush 

Now everything is working fine. Note that you need to disable that on every iface, option "all" are not working fine.

share|improve this answer

answered 5 hours ago

POMATuPOMATu

1063

add a comment | 

My rules are correct

Solution:

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > $f; done

echo 1 > /proc/sys/net/ipv4/route/flush 

Now everything is working fine. Note that you need to disable that on every iface, option "all" are not working fine.

share|improve this answer

answered 5 hours ago

POMATuPOMATu

1063

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > $f; done

echo 1 > /proc/sys/net/ipv4/route/flush 

share|improve this answer

answered 5 hours ago

POMATuPOMATu

1063

answered 5 hours ago

POMATuPOMATu

1063

answered 5 hours ago

POMATuPOMATu

1063