1

I have connected two server via vpn. Server A hosts all container and server B is just a simple router. I need to attach to both server via ssh, as so, the default route of ppp0 (server A) and eth0 (server B) shall not be changed except for the packages coming out of the container hosted by server A. These container shall send all traffic to server B.

Server A                                                                                              Server B
-------------------------------------------------------------------------------------------                 ---------------------------------------------
internet ---- ppp0 (a.b.c.d/32)                                                             eth0 (e.f.g.h/32) ---- internet
                   vpn   (172.16.0.1/16)    -----------------------------------------------    vpn (172.16.0.2/16)
            +---- vswitch (172.17.0.1/16)
            |
            |                                             Container yp
            +---- yp (slave of vswitch)  ----  eth0 (172.17.0.3/16)
            |
            |                                                 Container boot
            +---- boot (slave of vswitch)  ----  eth0 (172.17.0.4/16)

The ppp0 is not a VPN connection, but the local ADSL link. The MTU of ppp0 is 1480.

Both vpn links are build on top of Wireshark. The MTU of both is 1420.

I've tried to mark the traffic of container of server A and to route this traffic to server B/internet. Further I tried to make it bidirectional as future container at server B will appear.

# iptables -t mangle -A PREROUTING -j MARK --set-mark 85 -i vswitch
# iptables -t mangle -A PREROUTING -j MARK --set-mark 95 -i vpn

# ip rule add fwmark 85 lookup 185
# ip rule add fwmark 95 lookup 195

# ip route add table 185 default via 172.16.0.1 dev vpn
# ip route add table 185 default via 172.16.0.1 dev vswitch

When logged into container yp I've tried to ping server B.

[root@yp ~]# ping 172.16.0.2
PING 172.16.0.2 (172.16.0.2) 56(84) bytes of data.
^C
--- 172.16.0.2 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1004ms

Here is the routing table of server A

# ip r show table all
default via 172.16.0.1 dev vpn table 185 
default via 172.17.0.1 dev vswitch table 195 
default dev ppp0 scope link 
a.b.c.n dev ppp0 proto kernel scope link src a.b.c.d
local a.b.c.d dev ppp0 table local proto kernel scope host src a.b.c.d 
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
broadcast 172.16.0.0 dev vpn table local proto kernel scope link src 172.16.0.1 
local 172.16.0.1 dev vpn table local proto kernel scope host src 172.16.0.1 
broadcast 172.16.255.255 dev vpn table local proto kernel scope link src 172.16.0.1 
broadcast 172.17.0.0 dev vswitch table local proto kernel scope link src 172.17.0.1 
local 172.17.0.1 dev vswitch table local proto kernel scope host src 172.17.0.1 
broadcast 172.17.255.255 dev vswitch table local proto kernel scope link src 172.17.0.1 

What am I missing to get the routing/marking correct?

0

I'm not sure I understand your diagram correctly: All you want to do is to set a route on server A so that packets coming from any of the two containers are routed to server B, is that correct?

Anyway, in general, don't use iptables to route. (This is a pet peeve of mine, for some reason people try to use iptables for routing all the time.) There are alternatives, e.g. policy routing.

So in your case, something like

ip route add table 250 172.16.0.1/16 dev vpn scope link
ip route add table 250 default via 172.16.0.2
ip rule add from 172.16.0.3 table 250
ip rule add from 172.16.0.4 table 250

(untested) should do the trick. There's plenty of online tutorials on policy routing.

  • Yes, your understanding of my problem is correct. Is it possible to involve the vswitch into the rule? So I don't need to add rules for every container seperatly. I will check for policy routing – user1587451 May 5 '18 at 16:28
  • That's a part of the diagram I don't understand: What kind of device is vswitch? A bridge? Something else? Is vpn part of vswitch, or a separate interface? And while we are at it: I doubt the VPN is built on top of Wireshark. – dirkt May 6 '18 at 4:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.