1

I created a bridge named eth2 with the interface gre1 between 2 virtual machines VM1 and VM2.

The following is VM1 with bridge device eth2.

# brctl show
bridge name     bridge id               STP enabled     interfaces
eth2            8000.162f8564eb74       no              gre1

The interface IP of VM1 is 172.80.1.1 and the interface IP of VM2 is 172.80.1.2 When iptables is stopped in VM1, I am able to ping the interface IP of VM2 from VM1. On starting iptables though, the ping will not work.

# ping 172.80.1.2
PING 172.80.1.2 (172.80.1.2) 56(84) bytes of data.
--- 172.80.1.2 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 5240ms

Here is what my iptables looks like.

    # iptables -L -n -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
72854   10M ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           /* 10defaults */
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           /* 10defaults */
   75  5428 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED /* 10defaults */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 /* 20ssh */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80 /* 30https */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443 /* 30https */
    0     0 ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp dpt:162 /* 50snmp-health */
    0     0 ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp dpt:162 /* 50snmp-health */
    0     0 ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp dpt:123 /* 60ntp */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:5671 /* 70rabbitmq */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:3999 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4000 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4001 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4002 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4003 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4004 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4005 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4006 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4007 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4008 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4009 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4010 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4011 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4012 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4013 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4014 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4015 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4016 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4017 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4018 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4019 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4020 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4021 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4022 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:4023 /* 80debug */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:15672 /* 85rabbitmq-ui */
 1250  250K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           /* 99finish */ reject-with icmp-host-prohibited
    0     0 ACCEPT     udp  --  eth2   *       0.0.0.0/0            0.0.0.0/0           udp dpt:162 /* eth2_RULE */
    0     0 ACCEPT     tcp  --  eth2   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:9990 /* eth2_RULE */
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:9990 /* eth2_RULE */
    0     0 ACCEPT     tcp  --  eth2   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443 /* eth2_RULE */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:80 state ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:443 state ESTABLISHED

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  eth2   *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 72917 packets, 10M bytes)
 pkts bytes target     prot opt in     out     source               destination

Also, sysctl -a | grep bridge-nf gives

net.bridge.bridge-nf-call-arptables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-filter-vlan-tagged = 0
net.bridge.bridge-nf-filter-pppoe-tagged = 0

What could be causing this to not work? Is there something wrong with the iptable rules here?

  • if gre1 is a GRE tunnel interface, you'll have to provide information on its endpoints: iptables might block them, thus rendering the interface inoperative. – A.B Aug 20 '18 at 19:14
  • Yes, gre1 was a GRE tunnel interface. Providing endpoint information for it worked. Thanks a lot! – rayindrane2l Aug 23 '18 at 7:03
0

I set the policy to accepted for my gre tunnel interface gre1.

iptables -I INPUT -p gre -j ACCEPT

This helped me to get it working.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.