IP routing not working

Question

I configured network bridge for my VM. VM can ping host but can't ping anything from internet. My configuration:

# ip route
default via 192.168.1.100 dev wlp3s0 
192.168.1.0/24 dev wlp3s0  proto kernel  scope link  src 192.168.1.106  metric 600 
192.168.10.0/24 dev br0  proto kernel  scope link  src 192.168.10.1 

BRIDGE

# brctl show br0
bridge name     bridge id               STP enabled     interfaces
br0             8000.7a19fd532c51       no              tap0

IFCONFIG

# ifconfig
br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.10.1  netmask 255.255.255.0  broadcast 192.168.10.255
        inet6 fe80::7819:fdff:fe53:2c51  prefixlen 64  scopeid 0x20<link>
        ether 7a:19:fd:53:2c:51  txqueuelen 1000  (Ethernet)
        RX packets 1206  bytes 110944 (108.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 296  bytes 28842 (28.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
enp2s0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 44:a8:42:ea:5e:fb  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 1348  bytes 249670 (243.8 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1348  bytes 249670 (243.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
tap0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether fe:3f:76:37:c2:8a  txqueuelen 500 (Ethernet)
        RX packets 547  bytes 57652 (56.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 229  bytes 21306 (20.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.106  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::5ee0:c5ff:fe04:ec  prefixlen 64  scopeid 0x20<link>
        ether 5c:e0:c5:04:00:ec  txqueuelen 1000  (Ethernet)
        RX packets 5061  bytes 3500576 (3.3 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4400  bytes 684177 (668.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

IP TABLES

# Generated by iptables-save v1.4.21 on Wed Jan 20 03:24:28 2016
*nat
:PREROUTING ACCEPT [6064:511451]
:INPUT ACCEPT [12:3105]
:OUTPUT ACCEPT [2082:136342]
:POSTROUTING ACCEPT [771:53334]
-A POSTROUTING -o wlp3s0 -j MASQUERADE
COMMIT
# Completed on Wed Jan 20 03:24:28 2016
# Generated by iptables-save v1.4.21 on Wed Jan 20 03:24:28 2016
*mangle
:PREROUTING ACCEPT [25489:10605237]
:INPUT ACCEPT [18617:10028011]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [19284:2260048]
:POSTROUTING ACCEPT [19284:2260048]
COMMIT
# Completed on Wed Jan 20 04:20:44 2016
# Generated by iptables-save v1.4.21 on Wed Jan 20 04:20:44 2016
*filter
:INPUT ACCEPT [28:3026]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [22:1683]
-A FORWARD -i br0 -o wlp3s0 -j ACCEPT
-A FORWARD -i wlp3s0 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Jan 20 04:20:44 2016

ip forwarding:

# cat /proc/sys/net/ipv4/ip_forward
1

TCPDUMP on br0

# tcpdump -i br0
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes
03:28:56.847387 IP wordpress.dev > google.pl: ICMP echo request, id 1630, seq 2616, length 64
03:28:57.855523 IP wordpress.dev > google.pl: ICMP echo request, id 1630, seq 2617, length 64

TCPDUMP on wlp3s0 - no packets from br0

UPDATE

I was creating my bridge by enabling systemct enable systemd-networkd and systemct enable iptables. When I create my bridge "by hand" everything works fine.

/etc/systemd/network/LocalBridge.netdev

[NetDev]
Name=br0
Kind=bridge

/etc/systemd/network/LocalBridge.network

[Match]
Name=br0

[Network]
Address=192.168.10.1/24

/etc/systemd/system/iptables.service.d/10iptables.conf

[Service]
Environment="IPTABLES_INIT=/var/lib/iptables/init-IPv4.rules"
Environment="IP6TABLES_INIT=/var/lib/iptables/init-IPv6.rules"
Environment="COUNTERS=yes"

/var/lib/iptables/init-IPv4.rules is the same as "IP TABLES" section above. /var/lib/iptables/init-IPv6.rules is not used

Any ideas whats wrong with that? Or how to properly configure initial bridge on system boot with systemd?

Answer 1

Your filter table is missing a some important lines in FORWARD.

-A FORWARD -i wlp3s0 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i br0 -o wlp3s0 -j ACCEPT

Just because you have a bridge and IP forwarding turned on in the kernel, doesn't mean the traffic is just going to magically move around and get NAT'd. iptables needs to know how to treat the traffic.

I would add those lines first and then troubleshoot further if you continue to have issues.

Answer 2

I thought systemd-networkd is only something to create interfaces on boot but it looks like something much more. It have its own routing solution and it shouldn't be used with NetworkManager which I need for managing my wireless networks. Systemd-networkd is designed for servers or computers statically connected to network.

Now I decided not using systemd-networkd. Better solution form me is to create bridge in NetworkManager to create automatically.

Problem solved.