Problem with TCP and GRE tunnel
-
@stephenw10 Done
-
Ok well the delay is a lot longer there but you can see the local host sends the http request almost immediately after the handshake. So packets are being lost somewhere.
Try running pcaps on both ends of the GRE tunnel at the same time. Run the curl command and see how they compare.
-
@stephenw10 Just upload them. Also how can I open the pcap files to compare them?
-
Using Wireshark is easiest. Though you can also just set the view to high or full in the pfSense webgui and see the timing info etc.
-
@stephenw10 But are you able to see any difference between them now?
-
Yes, you can see the local end sees the initial http request at 0.02 but no reply. It retransmits that request 10 times until it finally sees a reply at 114s.
At the remote end it never sees any requests arrive until 114s.
Something is dropping those packets in the route. They are not large packets so not an MTU issue that might be caused by encapsulation.
I assume you gateways setup for the GRE tunnel, do you see packet loss logged on them?
Just to confirm; are you using encryption here? GRE over IPSe transport?
-
@stephenw10 On both sides pf say 0.0% packet loss while using curl. Also no, im not using encryption or GRE over IPSe
-
Hmm. What happens if you run curl against the webgui at the remote side?
Or try running an iperf test between the two pf instances.
-
Also try running a pcap on the WAN interface of the local pf when running that same curl test. You should not see any traffic leaving there directly other than the GRE encapsulated traffic.
-
@stephenw10 I already tried to see the traffic on WAN (local pf) and theres no traffic. I will try the other 2 things give me a sec
-
The other thing to test would be a pcap on both WANs at the same time so you can check if GRE packets are leaving the local WAN and just not arriving at the remote WAN. I.E. is it an actual problem in the route somewhere.
-
@stephenw10 I can curl without problems on the remote one. Also how can i do a iperf?
-
@stephenw10 I did it now and theres no logs on the local side (WAN) while doing a pcap
-
iperf is a package you can install in the gui. You can also install just the backend pkg at the command line if you want.
@StomperG said in Problem with TCP and GRE tunnel:
I did it now and theres no logs on the local side (WAN) while doing a pcap
So the local side isn't actually sending GRE packets even though the pcap on the GRE interface shows them?
-
@stephenw10 At least the WAN pcap on the local dont show anything
-
Nothing at all? It must show the GRE packets if the curl command succeeds. Or do you mean just during the unexpected delay?
-
Hi
maybe this will help
I don't remember why I set up the rules this way (I think I read it in some article), but
1 GRE interface (MSS 1380)
2 created this floating rule for GRE interface (TUN100)
here is an example of the information transfer rate through a tunnel with these settings
-
stephenw10 Netgate Administratorlast edited by stephenw10 Apr 1, 2024, 6:27 PM Apr 1, 2024, 6:27 PM
That can be required for GRE+IPSec transport. Although there is now an option to allow it without that: https://redmine.pfsense.org/issues/12289
However in that situation the initial handshake would fail. And that shouldn't apply here because it's not encrypted. But....anything's possible!
-
@stephenw10 Hey that's for the local or remote pf? I tried on local and had the same result :/
-
@stephenw10 Nothing at all on the local WAN
Never did an iperf, is there any topic for that?
