I am tunneling an outgoing TCP connection over a TUN interface set up by a program I wrote. The TUN interface basically just relays the packets to/from a proxy server, with minimal modifications (source/destination IP/port, TCP checksum).

Running wget on an IP routed thru this TUN interface, the packets appear to be sent and received correctly (see the trace), but somehow the SYN/ACK that comes back from the server does not register with the TCP stack, and the socket remains in a SYN_SENT state in "netstat -t". Spurious retransmits are then generated endlessly (until timeout) in both directions.

Here are the commands I use to set it up:

ip link set dev tun0 up
ip addr add dev tun0 
ip route add dev tun0

followed by


Here is the wireshark trace pcap here:

wget wireshark trace


I seem to have found the problem: I needed to compute the IPv4 header checksum for the incoming packets before writing them to the TUN interface, since I modify them.

  • To be honest, I though of that too, but since you were writing you were already dealing with that...why are you mucking up directly with packets instead of trying to put iptables to use? – Rui F Ribeiro May 26 '16 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.