• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Problem with TCP and GRE tunnel

Scheduled Pinned Locked Moved General pfSense Questions
64 Posts 3 Posters 8.7k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    stephenw10 Netgate Administrator
    last edited by Apr 1, 2024, 3:27 PM

    Using Wireshark is easiest. Though you can also just set the view to high or full in the pfSense webgui and see the timing info etc.

    S 1 Reply Last reply Apr 1, 2024, 3:38 PM Reply Quote 0
    • S
      StomperG @stephenw10
      last edited by Apr 1, 2024, 3:38 PM

      @stephenw10 But are you able to see any difference between them now?

      1 Reply Last reply Reply Quote 0
      • S
        stephenw10 Netgate Administrator
        last edited by Apr 1, 2024, 3:50 PM

        Yes, you can see the local end sees the initial http request at 0.02 but no reply. It retransmits that request 10 times until it finally sees a reply at 114s.

        At the remote end it never sees any requests arrive until 114s.

        Something is dropping those packets in the route. They are not large packets so not an MTU issue that might be caused by encapsulation.

        I assume you gateways setup for the GRE tunnel, do you see packet loss logged on them?

        Just to confirm; are you using encryption here? GRE over IPSe transport?

        S 1 Reply Last reply Apr 1, 2024, 4:01 PM Reply Quote 0
        • S
          StomperG @stephenw10
          last edited by Apr 1, 2024, 4:01 PM

          @stephenw10 On both sides pf say 0.0% packet loss while using curl. Also no, im not using encryption or GRE over IPSe

          1 Reply Last reply Reply Quote 0
          • S
            stephenw10 Netgate Administrator
            last edited by Apr 1, 2024, 4:03 PM

            Hmm. What happens if you run curl against the webgui at the remote side?

            Or try running an iperf test between the two pf instances.

            1 Reply Last reply Reply Quote 0
            • S
              stephenw10 Netgate Administrator
              last edited by Apr 1, 2024, 4:05 PM

              Also try running a pcap on the WAN interface of the local pf when running that same curl test. You should not see any traffic leaving there directly other than the GRE encapsulated traffic.

              S 1 Reply Last reply Apr 1, 2024, 4:06 PM Reply Quote 0
              • S
                StomperG @stephenw10
                last edited by Apr 1, 2024, 4:06 PM

                @stephenw10 I already tried to see the traffic on WAN (local pf) and theres no traffic. I will try the other 2 things give me a sec

                1 Reply Last reply Reply Quote 1
                • S
                  stephenw10 Netgate Administrator
                  last edited by Apr 1, 2024, 4:08 PM

                  The other thing to test would be a pcap on both WANs at the same time so you can check if GRE packets are leaving the local WAN and just not arriving at the remote WAN. I.E. is it an actual problem in the route somewhere.

                  S 2 Replies Last reply Apr 1, 2024, 4:11 PM Reply Quote 0
                  • S
                    StomperG @stephenw10
                    last edited by Apr 1, 2024, 4:11 PM

                    @stephenw10 I can curl without problems on the remote one. Also how can i do a iperf?

                    1 Reply Last reply Reply Quote 0
                    • S
                      StomperG @stephenw10
                      last edited by StomperG Apr 1, 2024, 4:19 PM Apr 1, 2024, 4:14 PM

                      @stephenw10 I did it now and theres no logs on the local side (WAN) while doing a pcap

                      1 Reply Last reply Reply Quote 0
                      • S
                        stephenw10 Netgate Administrator
                        last edited by Apr 1, 2024, 5:19 PM

                        iperf is a package you can install in the gui. You can also install just the backend pkg at the command line if you want.

                        @StomperG said in Problem with TCP and GRE tunnel:

                        I did it now and theres no logs on the local side (WAN) while doing a pcap

                        So the local side isn't actually sending GRE packets even though the pcap on the GRE interface shows them?

                        S 1 Reply Last reply Apr 1, 2024, 5:59 PM Reply Quote 0
                        • S
                          StomperG @stephenw10
                          last edited by Apr 1, 2024, 5:59 PM

                          @stephenw10 At least the WAN pcap on the local dont show anything

                          K 1 Reply Last reply Apr 1, 2024, 6:09 PM Reply Quote 0
                          • S
                            stephenw10 Netgate Administrator
                            last edited by Apr 1, 2024, 6:02 PM

                            Nothing at all? It must show the GRE packets if the curl command succeeds. Or do you mean just during the unexpected delay?

                            S 2 Replies Last reply Apr 1, 2024, 6:55 PM Reply Quote 0
                            • K
                              Konstanti @StomperG
                              last edited by Konstanti Apr 1, 2024, 6:16 PM Apr 1, 2024, 6:09 PM

                              @StomperG

                              Hi
                              maybe this will help
                              I don't remember why I set up the rules this way (I think I read it in some article), but
                              1 GRE interface (MSS 1380)
                              2 created this floating rule for GRE interface (TUN100)

                              2905ff65-7d7b-44ad-886b-194a33695453-image.png

                              5f98e495-11ba-4640-9423-b5f92765c0ba-image.png

                              7bdb0851-9887-4081-8261-86ebdd87988a-image.png

                              here is an example of the information transfer rate through a tunnel with these settings

                              d5ea36cd-2932-4b0b-841b-aca9563b9b03-image.png

                              1 Reply Last reply Reply Quote 0
                              • S
                                stephenw10 Netgate Administrator
                                last edited by stephenw10 Apr 1, 2024, 6:27 PM Apr 1, 2024, 6:27 PM

                                That can be required for GRE+IPSec transport. Although there is now an option to allow it without that: https://redmine.pfsense.org/issues/12289

                                However in that situation the initial handshake would fail. And that shouldn't apply here because it's not encrypted. But....anything's possible!

                                1 Reply Last reply Reply Quote 0
                                • S
                                  StomperG @stephenw10
                                  last edited by StomperG Apr 1, 2024, 6:59 PM Apr 1, 2024, 6:55 PM

                                  @stephenw10 Hey that's for the local or remote pf? I tried on local and had the same result :/

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    StomperG @stephenw10
                                    last edited by StomperG Apr 1, 2024, 7:02 PM Apr 1, 2024, 7:01 PM

                                    @stephenw10 Nothing at all on the local WAN
                                    Never did an iperf, is there any topic for that?

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      stephenw10 Netgate Administrator
                                      last edited by Apr 1, 2024, 8:10 PM

                                      Yeah I wouldn't expect it to make any difference there because you're not using IPSec transport.

                                      To my earlier question; do you really see no GRE packets in the pcap on the local WAN? Or just during the gap?

                                      S 1 Reply Last reply Apr 1, 2024, 9:23 PM Reply Quote 0
                                      • S
                                        stephenw10 Netgate Administrator
                                        last edited by Apr 1, 2024, 8:12 PM

                                        At the command line on each end you can run iperf3. So run iperf3 -s to start a server at one end. Then iperf3 -c <server IP> at the other.

                                        S 1 Reply Last reply Apr 1, 2024, 9:30 PM Reply Quote 0
                                        • S
                                          StomperG @stephenw10
                                          last edited by Apr 1, 2024, 9:23 PM

                                          @stephenw10 On the local WAN i literally see 0 lines of logs during de pcap

                                          1 Reply Last reply Reply Quote 0
                                          44 out of 64
                                          • First post
                                            44/64
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received