kanocz/lcvpn
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

how service side send out the ip packets to target server #15

New issue
Closed
opened 2019-12-18 04:27:10 -05:00 by shyandsy · 13 comments
shyandsy commented 2019-12-18 04:27:10 -05:00 (Migrated from github.com)
Copy link

I notice you just write ip packets into the tun device after decryption, is that data will go to the LAN?

in my test case code, the icmp request packet disappered after writtrn to tun

I notice you just write ip packets into the tun device after decryption, is that data will go to the LAN? in my test case code, the icmp request packet disappered after writtrn to tun
kanocz commented 2019-12-18 06:07:07 -05:00 (Migrated from github.com)
Copy link

@shyandsy tun is just normal (but little bit virtual) network device, so after I'm writing to tun device packet appears in linux network stack and then regular routing (and firewall) rules apply... so at least net.ipv4.ip_forward (please read for example https://linuxconfig.org/how-to-turn-on-off-ip-forwarding-in-linux) must be set and if you have any rules in iptables (or other firewall implementation) you need allow both INPUT and FORWARD rules for packets incoming from tun interface

@shyandsy tun is just normal (but little bit virtual) network device, so after I'm writing to tun device packet appears in linux network stack and then regular routing (and firewall) rules apply... so at least `net.ipv4.ip_forward` (please read for example https://linuxconfig.org/how-to-turn-on-off-ip-forwarding-in-linux) must be set and if you have any rules in iptables (or other firewall implementation) you need allow both INPUT and FORWARD rules for packets incoming from tun interface
shyandsy commented 2019-12-19 00:44:33 -05:00 (Migrated from github.com)
Copy link

hi, thanks for your reply

I added two iptables rule

iptables -A INPUT -i mytun -j ACCEPT
iptables -A FORWARD -i mytun -j ACCEPT

my code is really simple. I just run the following command to test it

ping -I mytun "another server ip"

image

The iptable config shows below
image

image

theres no icmp received in another vps yet

could you help to check why it doesnt work?

hi, thanks for your reply I added two iptables rule ``` iptables -A INPUT -i mytun -j ACCEPT iptables -A FORWARD -i mytun -j ACCEPT ``` my code is really simple. I just run the following command to test it ``` ping -I mytun "another server ip" ``` ![image](https://user-images.githubusercontent.com/5271457/71147583-291c0e80-2264-11ea-855e-77993feb18e1.png) The iptable config shows below ![image](https://user-images.githubusercontent.com/5271457/71147962-53220080-2265-11ea-8dc6-eeca47d1d5f2.png) ![image](https://user-images.githubusercontent.com/5271457/71148013-7947a080-2265-11ea-878c-b554b5623e0f.png) theres no icmp received in another vps yet could you help to check why it doesnt work?
shyandsy commented 2019-12-19 01:33:34 -05:00 (Migrated from github.com)
Copy link

i also tried this, still not working

image

i also tried this, still not working ![image](https://user-images.githubusercontent.com/5271457/71150481-861bc280-226c-11ea-9c45-0a8e05c405aa.png)
kanocz commented 2019-12-19 09:34:44 -05:00 (Migrated from github.com)
Copy link

@shyandsy if you want to get "one more loopback" you'll probably need to create 2 different tun devices and copy from one to other, as linux will drop packages with "wrong direction" (look at https://www.theurbanpenguin.com/rp_filter-and-lpic-3-linux-security/
but anyway this will be tricky and can't understand practical value or just can't understand your network structure :)

@shyandsy if you want to get "one more loopback" you'll probably need to create 2 different tun devices and copy from one to other, as linux will drop packages with "wrong direction" (look at https://www.theurbanpenguin.com/rp_filter-and-lpic-3-linux-security/ but anyway this will be tricky and can't understand practical value or just can't understand your network structure :)
shyandsy commented 2019-12-19 16:18:35 -05:00 (Migrated from github.com)
Copy link

is that mean i have to create another tune device named like tun2, and write the ip packet from mytun and write to tun2, then the packet will be send out by tun2?

is that mean i have to create another tune device named like tun2, and write the ip packet from mytun and write to tun2, then the packet will be send out by tun2?
kanocz commented 2019-12-19 16:31:57 -05:00 (Migrated from github.com)
Copy link

@shyandsy if you'll turn off rp_filter and setup ip_forward this may work 😅 if no you can write me directly and I'll try to help

@shyandsy if you'll turn off rp_filter and setup ip_forward this may work 😅 if no you can write me directly and I'll try to help
shyandsy commented 2019-12-20 02:21:54 -05:00 (Migrated from github.com)
Copy link

hi its still not work

could u help online by teamview? emm, I will pay some to you for your work

hi its still not work could u help online by teamview? emm, I will pay some to you for your work
kanocz commented 2019-12-20 03:21:19 -05:00 (Migrated from github.com)
Copy link

@shyandsy theoretically yes, but somewhen after x-mas and New Year... and no, I don't need your money if you're not developing some commercial project :)

@shyandsy theoretically yes, but somewhen after x-mas and New Year... and no, I don't need your money if you're not developing some commercial project :)
shyandsy commented 2019-12-20 10:22:25 -05:00 (Migrated from github.com)
Copy link

Could you help on-site today?
There's just 20 lines of code

I guess the working is about iptables

Could you help on-site today? There's just 20 lines of code I guess the working is about iptables
shyandsy commented 2019-12-21 02:22:28 -05:00 (Migrated from github.com)
Copy link

the icmp request routed to eno1(127.0.0.1) after close rp_filter

net.ipv4.conf.all.rp_filter = 0

why not go though enp0s25(public ip)?

image

image

the icmp request routed to eno1(127.0.0.1) after close rp_filter ``` net.ipv4.conf.all.rp_filter = 0 ``` why not go though enp0s25(public ip)? ![image](https://user-images.githubusercontent.com/5271457/71304752-a59a2300-2405-11ea-9b30-c1022e2f78f5.png) ![image](https://user-images.githubusercontent.com/5271457/71304758-afbc2180-2405-11ea-8712-301e86b71232.png)
shyandsy commented 2019-12-23 01:00:05 -05:00 (Migrated from github.com)
Copy link

hi
The problem still there

hi The problem still there
kanocz commented 2019-12-23 06:19:29 -05:00 (Migrated from github.com)
Copy link

@shyandsy you have too complicated setup - using interfaces on the same computer is always a problem as linux network stack will try to drop anything "looped"... and as I say I may help with this not lcvpn-related problem somewhen after begin of next year - I just have no time for such activity
and it's strange for me if somebody demands immediate response and help in such situation
so I closing this issue as irrelevant

@shyandsy you have too complicated setup - using interfaces on the same computer is always a problem as linux network stack will try to drop anything "looped"... and as I say I may help with this not lcvpn-related problem somewhen after begin of next year - I just have no time for such activity and it's strange for me if somebody demands immediate response and help in such situation so I closing this issue as irrelevant
shyandsy commented 2020-01-04 10:25:46 -05:00 (Migrated from github.com)
Copy link

sorry for disturbing

are u avalable now?

sorry for disturbing are u avalable now?
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
0.2.0b
v0.1.0a
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
kanocz/lcvpn#15
No description provided.