1

I'm trying to configure a host with Centos 7 and one network interface (eth0) to be a gateway.

The problem is that Gateway can forward package, receive the answer but it fails with sending response to the Host:

Host --> Gateway --> Destination --> Gateway -/-> Host

Actually I can see in tcpdump that Gateway is sending response but Host is not receiving it.

tcpdump for nc -v 192.168.253.113 22 request:

  • Host:

    12:10:22.038563 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 74: 10.0.0.47.21739 > 192.168.253.113.ssh: Flags [S], seq 3208534021, win 29200, options [mss 1460,sackOK,TS val 259369415 ecr 0,nop,wscale 9], length 0
    12:10:23.040527 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 74: 10.0.0.47.21739 > 192.168.253.113.ssh: Flags [S], seq 3208534021, win 29200, options [mss 1460,sackOK,TS val 259370418 ecr 0,nop,wscale 9], length 0
    
  • Gateway:

    12:10:22.038972 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 74: 10.0.0.47.21739 > 192.168.253.113.ssh: Flags [S], seq 3208534021, win 29200, options [mss 1460,sackOK,TS val 259369415 ecr 0,nop,wscale 9], length 0
    12:10:22.039017 22:22:22:22:22:22 > 33:33:33:33:33:33, ethertype IPv4 (0x0800), length 74: 10.0.0.19.21739 > 192.168.253.113.ssh: Flags [S], seq 3208534021, win 29200, options [mss 1460,sackOK,TS val 259369415 ecr 0,nop,wscale 9], length 0
    12:10:22.140408 33:33:33:33:33:33 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 74: 192.168.253.113.ssh > 10.0.0.19.21739: Flags [S.], seq 2142167154, ack 3208534022, win 28480, options [mss 1436,sackOK,TS val 2418584010 ecr 259369415,nop,wscale 10], length 0
    12:10:22.140427 22:22:22:22:22:22 > 11:11:11:11:11:11, ethertype IPv4 (0x0800), length 74: 192.168.253.113.ssh > 10.0.0.47.21739: Flags [S.], seq 2142167154, ack 3208534022, win 28480, options [mss 1436,sackOK,TS val 2418584010 ecr 259369415,nop,wscale 10], length 0
    12:10:23.040940 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 74: 10.0.0.47.21739 > 192.168.253.113.ssh: Flags [S], seq 3208534021, win 29200, options [mss 1460,sackOK,TS val 259370418 ecr 0,nop,wscale 9], length 0
    12:10:23.040958 22:22:22:22:22:22 > 33:33:33:33:33:33, ethertype IPv4 (0x0800), length 74: 10.0.0.19.21739 > 192.168.253.113.ssh: Flags [S], seq 3208534021, win 29200, options [mss 1460,sackOK,TS val 259370418 ecr 0,nop,wscale 9], length 0
    12:10:23.141986 33:33:33:33:33:33 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 74: 192.168.253.113.ssh > 10.0.0.19.21739: Flags [S.], seq 2142167154, ack 3208534022, win 28480, options [mss 1436,sackOK,TS val 2418584260 ecr 259369415,nop,wscale 10], length 0
    12:10:23.141998 22:22:22:22:22:22 > 11:11:11:11:11:11, ethertype IPv4 (0x0800), length 74: 192.168.253.113.ssh > 10.0.0.47.21739: Flags [S.], seq 2142167154, ack 3208534022, win 28480, options [mss 1436,sackOK,TS val 2418584260 ecr 259369415,nop,wscale 10], length 0
    

When I try the same request with Gateway as a destination (nc -v 10.0.0.19 22) all works fine:

  • Host:

    12:16:46.222903 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 74: 10.0.0.47.46354 > 10.0.0.19.ssh: Flags [S], seq 725877336, win 29200, options [mss 1460,sackOK,TS val 259753600 ecr 0,nop,wscale 9], length 0
    12:16:46.224050 22:22:22:22:22:22 > 11:11:11:11:11:11, ethertype IPv4 (0x0800), length 74: 10.0.0.19.ssh > 10.0.0.47.46354: Flags [S.], seq 3167329297, ack 725877337, win 28960, options [mss 1460,sackOK,TS val 96976164 ecr 259753600,nop,wscale 9], length 0
    12:16:46.224104 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 66: 10.0.0.47.46354 > 10.0.0.19.ssh: Flags [.], ack 1, win 58, options [nop,nop,TS val 259753601 ecr 96976164], length 0
    12:16:46.232678 22:22:22:22:22:22 > 11:11:11:11:11:11, ethertype IPv4 (0x0800), length 87: 10.0.0.19.ssh > 10.0.0.47.46354: Flags [P.], seq 1:22, ack 1, win 57, options [nop,nop,TS val 96976173 ecr 259753601], length 21
    12:16:46.232731 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 66: 10.0.0.47.46354 > 10.0.0.19.ssh: Flags [.], ack 22, win 58, options [nop,nop,TS val 259753610 ecr 96976173], length 0
    12:16:49.692764 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 66: 10.0.0.47.46354 > 10.0.0.19.ssh: Flags [F.], seq 1, ack 22, win 58, options [nop,nop,TS val 259757070 ecr 96976173], length 0
    12:16:49.693905 22:22:22:22:22:22 > 11:11:11:11:11:11, ethertype IPv4 (0x0800), length 66: 10.0.0.19.ssh > 10.0.0.47.46354: Flags [F.], seq 22, ack 2, win 57, options [nop,nop,TS val 96979634 ecr 259757070], length 0
    12:16:49.693938 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 66: 10.0.0.47.46354 > 10.0.0.19.ssh: Flags [.], ack 23, win 58, options [nop,nop,TS val 259757071 ecr 96979634], length 0
    
  • Gateway:

    12:16:46.223731 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 74: 10.0.0.47.46354 > 10.0.0.19.ssh: Flags [S], seq 725877336, win 29200, options [mss 1460,sackOK,TS val 259753600 ecr 0,nop,wscale 9], length 0
    12:16:46.223793 22:22:22:22:22:22 > 11:11:11:11:11:11, ethertype IPv4 (0x0800), length 74: 10.0.0.19.ssh > 10.0.0.47.46354: Flags [S.], seq 3167329297, ack 725877337, win 28960, options [mss 1460,sackOK,TS val 96976164 ecr 259753600,nop,wscale 9], length 0
    12:16:46.224401 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 66: 10.0.0.47.46354 > 10.0.0.19.ssh: Flags [.], ack 1, win 58, options [nop,nop,TS val 259753601 ecr 96976164], length 0
    12:16:46.232728 22:22:22:22:22:22 > 11:11:11:11:11:11, ethertype IPv4 (0x0800), length 87: 10.0.0.19.ssh > 10.0.0.47.46354: Flags [P.], seq 1:22, ack 1, win 57, options [nop,nop,TS val 96976173 ecr 259753601], length 21
    12:16:46.233033 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 66: 10.0.0.47.46354 > 10.0.0.19.ssh: Flags [.], ack 22, win 58, options [nop,nop,TS val 259753610 ecr 96976173], length 0
    12:16:49.693106 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 66: 10.0.0.47.46354 > 10.0.0.19.ssh: Flags [F.], seq 1, ack 22, win 58, options [nop,nop,TS val 259757070 ecr 96976173], length 0
    12:16:49.693928 22:22:22:22:22:22 > 11:11:11:11:11:11, ethertype IPv4 (0x0800), length 66: 10.0.0.19.ssh > 10.0.0.47.46354: Flags [F.], seq 22, ack 2, win 57, options [nop,nop,TS val 96979634 ecr 259757070], length 0
    12:16:49.694218 11:11:11:11:11:11 > 22:22:22:22:22:22, ethertype IPv4 (0x0800), length 66: 10.0.0.47.46354 > 10.0.0.19.ssh: Flags [.], ack 23, win 58, options [nop,nop,TS val 259757071 ecr 96979634], length 0
    

I can also do the same thing from Gateway to the Host.

I have no idea what can be possibly wrong. It is my Gateway configuration:

Routes:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG    100    0        0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U     100    0        0 eth0

Iptables on Gateway (saved using iptables-save):

*filter
:INPUT ACCEPT [46:4191]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [38:11217]
-A FORWARD -i eth0 -j ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT [19:1044]
:INPUT ACCEPT [13:684]
:OUTPUT ACCEPT [10:1312]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT

What I did is:

echo 1 > /proc/sys/net/ipv4/ip_forward
echo FORWARD_IPV4=true >> /etc/sysconfig/network
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -j ACCEPT
  • A single-interface gateway is generally called "router on a stick," see if that doesn't help you find more info. – Eric Oct 15 '17 at 18:56
  • Did you remove the established traffic rule from iptables? Can you try adding this rule and restarting iptables: iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT – BriGuy Oct 19 '17 at 14:44
  • Could you post the output of iptables -nL. Your tcpdump output and your saved iptables rules don't seam to fit together. Also: Could you post the tcpdump command lines you used to produce the output above. – sborsky Oct 19 '17 at 18:04
0

I don't see you set any specific routes to the remote host.

To allow a host to reach remote host (presumely it is on a different network), it needs a route to get there. And the remote host itself needs to know how to get back to this host, which needs a route to return to the network the local host stays in.

If the remote host is in a network like 10.0.5.0/24 with remote gateway at 10.0.5.1. And your local gateway is: 10.0.3.1 and your local network is: 10.0.3.0/24. Adding a staic route on local host: ip route add 10.0.5.0/24 via 10.0.3.1

And add another static route on remote host:

ip route add 10.0.3.0/24 via 10.0.5.1

This is how I configure my network with similar situation like yours.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.