Problem with TCP and GRE tunnel
-
Hmm, are you filtering the pcap on the local pf?
Yes the server side runs continually until you kill it. The client will run for 30s by default.
https://man.freebsd.org/cgi/man.cgi?query=iperf3 -
-
Hmm, same both ways?
Try using one of the other IPs on the server as the target. The GRE endpoint IP can behave in an odd way.
-
@stephenw10 I tried but or give me firewall problem because the port isnt exposed or give me that
-
Which way are you testing? The server end should listen on all available IPs by default. I would expect the client end to have a route to any of them.
-
@stephenw10 Im starting the server on the VPC (from the company where i bought the IP's and VPC) and client on the local pf VM
-
Ok so you should be able to use the VPC WAN address as the target for the client.
-
-
Aha, and that could be the problem. That IP is in the same /24 as the local LAN side clients. If you have those set to a /24 subnet it will try to ARP for it directly and fail.
-
@stephenw10 Uh, im very noob with this sorry, what exacly i need to change?
-
Ok we're back to how the VPC is providing the IPs to you. You have 4 consecutive IPs at the local pf LAN? Including the pf LAN interface address?
The VPC pf WAN address is not consecutive to those?
You probably need to device those into to subnets so routing works correctly.
The routing table at the local pf cannot include the remote side WAN address.
The remote side must be using a smaller subnet than /24 because otherwise connectivity would be completely broken.
-
@stephenw10 But my lan IP (185.113.141.1 ) is private on my lan and is the public gateway from the ISP and isn't being forwared trough the tunnel. My 4 ips are (185.113.141.214, 185.113.141.215,185.113.141.216, 185.113.141.217)
On the VPC pf i've 185.113.141.132 as WAN IP -
What subnets do you have on those interfaces?
@StomperG said in Problem with TCP and GRE tunnel:
my lan IP (185.113.141.1 ) is private on my lan and is the public gateway from the ISP
Hmm do you mean the LAN interface on the local pf is using the gateway IP address of the VPC side pf?
That would certainly break routing. It's surprising that ping works to be honest.
-
@stephenw10
Local Pf:
Remote Pf:
-
What subnet size do you have on the local pf LAN or the hosts on it?
What subnet size is on the VPC pf WAN?
The fact this works at all implies the VPC provider must be routing the additional IPs to the VPN WAN address.
-
@stephenw10 All ips I have are "single" i dont have an entire subnet
-
Yeah those IPs are inconveniently not in a single /29!
But what subnet sizes (masks) do you have set on the interfaces?
-
-
OK so everything is /24 and thus you have the same subnet at both ends on the tunnel. Hence, routing conflict with that iperf command and anything else sourced from the firewall itself.
Really you want those things is different subnets but because the remote WAN is using .132 you can't use /25 there.
I would try to set the gateway as outside the subnet. There's a setting for that in the advanced gateway settings: 'Use non-local gateway'
You can then set the remote WAN subnet to something much smaller, /32 even.
Then you can set the other IPs in a different subnet such as 185.113.141.208/28. You can add that as the static route on the remote pf and then use the IPs directly on the local pf.
The local pf LAN should use one of those IPs.
As an alternative to all of that you could just add all the IPs at the remote side as VIPs and then NAT the traffic to/from them and use private IPs at the local LAN.
Steve
-
S stephenw10 referenced this topic on
