Problem with TCP and GRE tunnel
-
@stephenw10 Nothing at all on the local WAN
Never did an iperf, is there any topic for that? -
Yeah I wouldn't expect it to make any difference there because you're not using IPSec transport.
To my earlier question; do you really see no GRE packets in the pcap on the local WAN? Or just during the gap?
-
At the command line on each end you can run
iperf3. So runiperf3 -sto start a server at one end. Theniperf3 -c <server IP>at the other. -
@stephenw10 On the local WAN i literally see 0 lines of logs during de pcap
-
@stephenw10 I just need to run this 2 commands and wait? Or did i need to do something else on the VM with the problem? And the server IP is the GRE IP right?
-
Hmm, are you filtering the pcap on the local pf?
Yes the server side runs continually until you kill it. The client will run for 30s by default.
https://man.freebsd.org/cgi/man.cgi?query=iperf3 -
-
Hmm, same both ways?
Try using one of the other IPs on the server as the target. The GRE endpoint IP can behave in an odd way.
-
@stephenw10 I tried but or give me firewall problem because the port isnt exposed or give me that
-
Which way are you testing? The server end should listen on all available IPs by default. I would expect the client end to have a route to any of them.
-
@stephenw10 Im starting the server on the VPC (from the company where i bought the IP's and VPC) and client on the local pf VM
-
Ok so you should be able to use the VPC WAN address as the target for the client.
-
-
Aha, and that could be the problem. That IP is in the same /24 as the local LAN side clients. If you have those set to a /24 subnet it will try to ARP for it directly and fail.
-
@stephenw10 Uh, im very noob with this sorry, what exacly i need to change?
-
Ok we're back to how the VPC is providing the IPs to you. You have 4 consecutive IPs at the local pf LAN? Including the pf LAN interface address?
The VPC pf WAN address is not consecutive to those?
You probably need to device those into to subnets so routing works correctly.
The routing table at the local pf cannot include the remote side WAN address.
The remote side must be using a smaller subnet than /24 because otherwise connectivity would be completely broken.
-
@stephenw10 But my lan IP (185.113.141.1 ) is private on my lan and is the public gateway from the ISP and isn't being forwared trough the tunnel. My 4 ips are (185.113.141.214, 185.113.141.215,185.113.141.216, 185.113.141.217)
On the VPC pf i've 185.113.141.132 as WAN IP -
What subnets do you have on those interfaces?
@StomperG said in Problem with TCP and GRE tunnel:
my lan IP (185.113.141.1 ) is private on my lan and is the public gateway from the ISP
Hmm do you mean the LAN interface on the local pf is using the gateway IP address of the VPC side pf?
That would certainly break routing. It's surprising that ping works to be honest.
-
@stephenw10
Local Pf:
Remote Pf:
-
What subnet size do you have on the local pf LAN or the hosts on it?
What subnet size is on the VPC pf WAN?
The fact this works at all implies the VPC provider must be routing the additional IPs to the VPN WAN address.
