0

I established a L2TP/IPsec client connection on the gateway, and I'm trying to redirect my host on LAN to use this connection when accessing the Internet.

Here is the network topology.

network topology

This is my gateway's routing table:

$ ip route
default dev pppoe-wan  scope link 
1.0.0.1 dev ppp1  proto kernel  scope link  src 192.168.179.11
6.6.6.6 dev pppoe-wan  scope link 
5.5.5.5 dev pppoe-wan  proto kernel  scope link  src 5.5.5.5
192.168.1.0/24 dev br-lan  proto kernel  scope link  src 192.168.1.1 

$ ip rule
1:  from all lookup local 
10: from 192.168.1.2 lookup 10 
32766:  from all lookup main 
32767:  from all lookup default 

$ ip route show table 10
default dev ppp1  scope link 
6.6.6.6 via 5.5.5.5 dev pppoe-wan 
192.168.1.0/24 via 192.168.1.1 dev br-lan

The problem is that after I add the default route to table 10, my host can no longer access the Internet. Using tcpdump to listen on the interface ppp1 (tcpdump -i ppp1) reveals that no packets flow through it.

I tried masquerade the ppp1 interface with:

$ iptables -t nat -A POSTROUTING -o ppp1 -j MASQUERADE

It didn't help, still no packets flowed through the interface. Also the kernel is allowed to redirect packets:

$ cat /proc/sys/net/ipv4/ip_forward
1

But if I use the interface directly on the gateway, it works just fine:

$ curl --interface ppp1 google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.google.com.hk/?gfe_rd=cr&amp;ei=suORVbLfOKXC8Af3noGwDA">here</A>.
</BODY></HTML>

So looks like the gateway's linux kernel somehow dropped the packets from my host. But none of the interface has reverse path filtering enabled:

$ cat /proc/sys/net/ipv4/conf/ppp1/rp_filter
0

$ cat /proc/sys/net/ipv4/conf/pppoe-wan/rp_filter
0

So I'm at my wits' end. Why the host traffic never goes through ppp1? How could I redirect my host to the L2TP/IPsec client connection?

I used the same configuration for a PPTP client, and it worked just fine. Somehow it doesn't work for a L2TP/IPsec client.

The gateway is an OpenWrt box (Chaos Calmer 15.05-rc2, kernel 3.18.14). I use strongSwan(5.3.0) + xl2tpd(1.3.6) to set up the L2TP/IPsec client.

This is configuration for strongSwan:

conn example
    auto=start
    keyexchange=ikev1
    type=transport
    left=%defaultroute
    leftauth=psk
    right=server.example.com
    rightid=%any
    rightauth=psk
    dpdaction=restart
    dpddelay=10s
    dpdtimeout=60s

and configuration for xl2tpd

[lac example]
lns = server.example.com
length bit = yes
redial = yes
max redials = 5
pppoptfile = /etc/ppp/options.xl2tpd

and configuration for ppp

noauth
mru 1452
mtu 1452
nomppe
ipcp-accept-remote
ipcp-accept-local
nopcomp
noaccomp
lcp-echo-interval 10
lcp-echo-failure 5

The host is a Mac (Yosemite 10.10.3).

Thanks in advance for the help.

P.S. Only the gateway's Internet IP and server's Internet IP have been replaced with fake IPs, all other IPs are the real used ones.

  • Did you remember to allow IPv4 forwarding? echo 1 > /proc/sys/net/ipv4/ip_forward as sudo. – MariusMatutiae Jun 30 '15 at 5:17
  • Yes, I did. Thanks for mentioning it. I've edit the question to mention the kernel allows forwarding. (OpenWrt allows forwarding by default.) – hgl Jun 30 '15 at 5:26
  • How do you know your L2TP/IPSec connection is working? If you curl Google from the gateway, you are using the main ruting table, not the routing table 10. Check that the VPN connection works by changing ip rules to force google connection through the tunnel. But do so in a temporary way, anything goes wrong (like I think) you reboot the router and you are ok. – MariusMatutiae Jun 30 '15 at 5:30
  • Note the --interface flag. I'm pretty sure the L2TP/IPSec connection is working. If I run curl --interface ppp1 ipinfo.io, it reports the country location of my l2tp server, which is different from that of the gateway. – hgl Jun 30 '15 at 6:37
  • Will you pls try my answer, to check whether it is right? Ty – MariusMatutiae Jun 30 '15 at 14:11
1

I finally solved it. The packets are dropped by netfilter(iptables).

OpenWrt by default drops packets forwarded from br-lan. So we need to allow forwarding packets from br-lan to ppp1..

$ iptables -I FORWARD -i br-lan -o ppp1 -j ACCEPT

After that the host gains internet access.

Note that you need to use -I so that this rule is inserted before the dropping rule, making it take precedence.

  • So my comment about using tcpdump to check that packets from br-lan could reach ppp1 and ppoe-wan did work, after all. Glad to see this. – MariusMatutiae Jul 3 '15 at 8:15
  • Sorry, I didn't understand you intention very well. pinging interface didn't strike me that netfilter might be the devil. :) But why I'm down voted? – hgl Jul 3 '15 at 12:49
  • You are not downvoted by me. – MariusMatutiae Jul 3 '15 at 14:37
0

You are masquerading the wrong interface. You need to masquerade because, basically, you are NATTING, but the virtual interface cannot be directly masqueraded.

Instead you should use:

      iptables -t nat -A POSTROUTING -o pppoe-wan -j MASQUERADE 

This will masquerade anything coming out of your regular interface, among these there will be the NATted packets from your Yosemite host.

It struck me that this is the only weak point in your discussion above. After some searching around, I could confirm that this should indeed be the case by reading this Debian Wiki Web page. For once, my beloved Arch Linux Wiki left me down.

  • First I really want to thank you for your effort. I really wish I could accept your answer, but unfortunately this rule is added by openwrt by default, otherwise the host would never have been able to access the internet, even without the default route to l2tp connection. – hgl Jun 30 '15 at 15:07
  • @hgl Can you run tcpdump on your router? just ping from the host, and listen on pp1 first, then on ppoe-wan. – MariusMatutiae Jun 30 '15 at 15:27
  • Sure. I'm pretty sure pinging from host to br-lan generates no packets on ppp1 or pppoe-wan; to pppoe-wan, ppp1 nothing, pppoe-wan, well, I'm not sure what packets to filter on pppoe-wan. – hgl Jun 30 '15 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.