2

I'm using socat to route incoming tcp6 to tcp4. The destination (tcp4) is a pod/container with the pod service external-ip. Within the container I use ncat to listen for the port 5555.

# socat TCP6-LISTEN:5555,reuseaddr,fork,bind=[fe80::250:56ff:fe91:bd5c%ens192] TCP4:10.40.5.125:5555 (Update)

socat return Connection refused (Update)

2018/07/27 01:15:41 socat[26914] E connect(5, AF=2 10.40.5.125:5555, 16): Connection refused

I'm getting no acknowledgment from within the container (# ncat -4 -vv --exec cat -l -p 5555)

I try to use -vv & -lf in the socat command to get more information about the tcp6 traffic but no significant log was written to the log file.

Before attempting tcp6 format I was able to route tcp4 traffic to tcp4 same destination listed above using socat. The command is below,

# socat TCP-LISTEN:5555,fork TCP:10.101.74.206:5555

Can someone please point what I am missing for tcp6?

OS: CentOS 7.5

0
$ ncat -4 -vv --exec cat -l -p 5555

nmap's ncat requires a full path for its --exec parameter. Use /bin/cat instead of cat.

I try to use -vv & -lf in the socat command to get more information about the tcp6 traffic but no significant log was written to the log file.

To get verbose socat output, specify the -d switch a few times.

Other than the above issues, I managed to successfully reproduce your setup, and it seems to work as you've intended. Check the debug output to narrow down your problem.

  • Thank you for responding Vladimir. I think my issue is the ipv6 I'm hitting is [fe80:::] and not [201:::]. Not sure I understand the difference one is for gateway and the 201:: is the actual IPV6 ip address? – bamb00 Jul 26 '18 at 15:02
  • Vladimir, Did you use the ipv6 fe80:::: (unicast)? Does make any different if the IPV6 address is unicast, multicast, anycast? – bamb00 Jul 26 '18 at 15:40
  • I used ::1 to connect to socat to test this setup. – Vladimir Panteleev Jul 26 '18 at 16:09
  • @bamb00 when using a link layer ipv6 address, you must include the interface name in the address to reference it unambiguously. So if an external socat was doing the IPv6 connection, that would be for eg socat 'tcp6:[fe80::1234:5678%eth0]:5555' - – A.B Jul 26 '18 at 22:41
  • @A.B I include the interface name but return "Name or service not known" the interface ens224 is running in the vm. # socat -ddd TCP6:[2001:10:40:1:cf39:d82e:c546:1aca%ens224]:5555 TCP4:10.40.5.125:5555 – bamb00 Jul 27 '18 at 0:41
0

There are many reasons why socat refuses to connect IPv4 host. Just to save your time my suggestion for you is to use stone repeater instead of socat. Install it (I hope this package has been included in CentOS):

yum install stone

Execute it with debug level 5 (verbose mode):

stone -ddddd 110.101.74.206:5555 5555/v6

Test your connection using telnet and if everything works well, remove -ddddd option and run the stone in the way you want in production mode. For example, run stone as daemon with 20 child processes spawned:

stone -D -f 20 110.101.74.206:5555 5555/v6

Check the running stone processes afterwards:

ps aux | grep stone

Additional information:

  • Thank You for responding. I will definitely check out stone. Do you know if stone is use in a production env? – bamb00 Jul 26 '18 at 15:07
  • @bamb00 Yes, you can and you'll see that stone is more stable than socat. Consider only -D option (run as daemon), -f option for number of child processe to spawn, and of course options: -u, -X, -T, -A - read FreeBSD man (link is in my answer above). – Bob Jul 26 '18 at 15:43
  • Does stone listen for tcp traffic whether is from tcp4 or tcp6 without having to specify v4 or v6 meaning does not care if is ipv4 or ipv6? – bamb00 Jul 26 '18 at 17:08
  • @bamb00 You have run two stones separately and simultaneously if you want to listen both ipv4 and ipv6. For ipv6 run it with 5555/v6 and for ipv4 - 5555. In the example in answer with /v6 option it listens 110.101.74.206:5555 <- :::5555/v6. Without /v6 the routing is 110.101.74.206:5555 <- 0.0.0.0:5555 – Bob Jul 26 '18 at 17:08
  • There are no package for CentOS 7. – bamb00 Jul 31 '18 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.