dd-wrt não encaminhando pacotes entre vpn e wan

0

Espero perder algo óbvio, mas preciso mesmo de um segundo par de olhos.

Em resumo, o problema é que consigo ver o tráfego entrando no meu roteador dd-wrt do tun0, mas o tráfego não está saindo no vlan2. Como corrijo isso?

A caixa DD-WRT com uma VPN de escritório para escritório. (DD-WRT está agindo como um cliente VPN aqui) Não há problema para escritórios conversando entre si, nem há um problema de usuários por trás da caixa DD-WRT de acessar a Internet mais ampla.

Eu preciso acessar o modem na frente da caixa do DD-WRT através da VPN (ou seja, usando http), mas não consigo fazer isso funcionar. Usando o tcpdump na caixa DD-WRT eu posso ver pacotes para o modem (que está em 192.168.5.1) entrando através da interface tun0, mas eles não estão deixando a interface vlan2 (ou qualquer outra). VLAN2 é, claro, a interface WAN.

/proc/sys/net/ipv4_ip_forward = 1

(na verdade, ipv4_ip_forward é 1 em todas as interfaces também. Da mesma forma, rp_filter é 0 para todas as interfaces)

O iptables na caixa dd-wrt tem a seguinte aparência:

    # Generated by iptables-save v1.3.7 on Wed Jul 11 11:58:08 2018
*raw
:PREROUTING ACCEPT [47865311:28994994909]
:OUTPUT ACCEPT [9163855:1799452886]
COMMIT
# Completed on Wed Jul 11 11:58:08 2018
# Generated by iptables-save v1.3.7 on Wed Jul 11 11:58:08 2018
*nat
:PREROUTING ACCEPT [1057208:133049889]
:INPUT ACCEPT [345811:25454876]
:OUTPUT ACCEPT [89626:6090987]
:POSTROUTING ACCEPT [155806:10976951]
-A PREROUTING -d 192.168.5.150 -p icmp -j DNAT --to-destination 10.113.3.254 
-A PREROUTING -d 192.168.5.150 -j TRIGGER --trigger-proto --trigger-match 0-0 --trigger-relate 0-0 
-A POSTROUTING -s 10.113.3.0/255.255.255.0 -o vlan2 -j SNAT --to-source 192.168.5.150 
-A POSTROUTING -m mark  --mark0x80000000/0x80000000 -j MASQUERADE 
COMMIT
# Completed on Wed Jul 11 11:58:08 2018
# Generated by iptables-save v1.3.7 on Wed Jul 11 11:58:08 2018
*mangle
:PREROUTING ACCEPT [47865077:28994974549]
:INPUT ACCEPT [10833466:7689826180]
:FORWARD ACCEPT [36687562:21242777711]
:OUTPUT ACCEPT [9163804:1799448597]
:POSTROUTING ACCEPT [45776394:23034636218]
-A PREROUTING -d 192.168.5.150 -i ! vlan2 -j MARK  --set-xmark 0x80000000/0x80000000
-A PREROUTING -j CONNMARK --save-mark 
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
COMMIT
# Completed on Wed Jul 11 11:58:08 2018
# Generated by iptables-save v1.3.7 on Wed Jul 11 11:58:08 2018
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [9163399:1799420708]
:advgrp_1 - [0:0]
:advgrp_10 - [0:0]
:advgrp_2 - [0:0]
:advgrp_3 - [0:0]
:advgrp_4 - [0:0]
:advgrp_5 - [0:0]
:advgrp_6 - [0:0]
:advgrp_7 - [0:0]
:advgrp_8 - [0:0]
:advgrp_9 - [0:0]
:grp_1 - [0:0]
:grp_10 - [0:0]
:grp_2 - [0:0]
:grp_3 - [0:0]
:grp_4 - [0:0]
:grp_5 - [0:0]
:grp_6 - [0:0]
:grp_7 - [0:0]
:grp_8 - [0:0]
:grp_9 - [0:0]
:lan2wan - [0:0]
:logaccept - [0:0]
:logdrop - [0:0]
:logreject - [0:0]
:trigger_out - [0:0]
-A INPUT -d 192.168.5.1 -j ACCEPT 
-A INPUT -s 10.109.0.0/255.255.0.0 -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -s 10.104.0.0/255.255.0.0 -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -s 10.109.0.0/255.255.0.0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -s 10.104.0.0/255.255.0.0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -s 10.112.0.0/255.255.255.0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -s 114.23.127.210 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -s 10.109.4.0/255.255.254.0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -s 10.105.4.0/255.255.254.0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -s 192.168.200.253 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -s 10.108.98.1 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -s 192.168.200.7 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -s 192.168.224.1 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -i vlan2 -p udp -m udp --sport 67 --dport 68 -j ACCEPT 
-A INPUT -i vlan2 -p udp -m udp --dport 520 -j DROP 
-A INPUT -i br0 -p udp -m udp --dport 520 -j DROP 
-A INPUT -p udp -m udp --dport 520 -j ACCEPT 
-A INPUT -i vlan2 -p icmp -j ACCEPT 
-A INPUT -p igmp -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 113 -j ACCEPT 
-A INPUT -i lo -m state --state NEW -j ACCEPT 
-A INPUT -i br0 -m state --state NEW -j ACCEPT 
-A INPUT -j DROP 
-A FORWARD -d 192.168.5.1 -j ACCEPT 
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -s 10.113.3.0/255.255.255.0 -o vlan2 -p gre -j ACCEPT 
-A FORWARD -s 10.113.3.0/255.255.255.0 -o vlan2 -p tcp -m tcp --dport 1723 -j ACCEPT 
-A FORWARD -j lan2wan 
-A FORWARD -i br0 -o br0 -j ACCEPT 
-A FORWARD -d 224.0.0.0/240.0.0.0 -i vlan2 -p udp -j ACCEPT 
-A FORWARD -i vlan2 -o br0 -j TRIGGER --trigger-proto --trigger-match 0-0 --trigger-relate 0-0 
-A FORWARD -i br0 -j trigger_out 
-A FORWARD -i br0 -m state --state NEW -j ACCEPT 
-A FORWARD -j DROP 
-A OUTPUT -d 192.168.5.1 -j ACCEPT 
-A OUTPUT -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
-A logaccept -j ACCEPT 
-A logdrop -j DROP 
-A logreject -p tcp -j REJECT --reject-with tcp-reset 
COMMIT
# Completed on Wed Jul 11 11:58:08 2018

O tráfego é originário de 10.109.4.18 e destinado a 192.168.5.1. 192.168.5.1 é o endereço IP interno do modem e eu posso fazer o ping do roteador DD-WRT.

10.109.4.18 é o endereço IP do meu computador, e está sendo roteado pelo túnel e é visível no roteador DD-WRT na interface tun0.

A LAN do escritório é 10.113.0.0/16. (Eu não acho que isso seja muito relevante para o problema).

A tabela de rotas para a caixa DD-WRT é

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.5.1     0.0.0.0         UG    0      0        0 vlan2
10.103.0.0      172.17.0.13     255.255.0.0     UG    0      0        0 tun0
10.104.0.0      172.17.0.13     255.255.0.0     UG    0      0        0 tun0
10.108.0.0      172.17.0.13     255.255.0.0     UG    100    0        0 tun0
10.109.0.0      172.17.0.13     255.255.0.0     UG    0      0        0 tun0
10.112.0.0      172.17.0.13     255.255.0.0     UG    300    0        0 tun0
10.113.3.0      0.0.0.0         255.255.255.0   U     0      0        0 br0
52.64.171.0     172.17.0.13     255.255.255.0   UG    0      0        0 tun0
52.79.94.0      172.17.0.13     255.255.255.0   UG    0      0        0 tun0
103.245.173.26  172.17.0.13     255.255.255.255 UGH   0      0        0 tun0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 br0
172.17.0.0      172.17.0.13     255.255.255.128 UG    0      0        0 tun0
172.17.0.13     0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.0.0     172.17.0.13     255.255.128.0   UG    0      0        0 tun0
192.168.5.0     0.0.0.0         255.255.255.0   U     0      0        0 vlan2
192.168.100.0   172.17.0.13     255.255.255.0   UG    100    0        0 tun0
192.168.128.0   172.17.0.13     255.255.128.0   UG    100    0        0 tun0
192.168.190.0   172.17.0.13     255.255.255.0   UG    100    0        0 tun0
192.168.200.0   172.17.0.13     255.255.255.0   UG    100    0        0 tun0
192.168.201.0   172.17.0.13     255.255.255.0   UG    100    0        0 tun0
192.168.202.0   172.17.0.13     255.255.255.0   UG    100    0        0 tun0
202.49.205.0    172.17.0.13     255.255.255.0   UG    100    0        0 tun0
203.171.55.96   172.17.0.13     255.255.255.240 UG    100    0        0 tun0
210.48.103.120  172.17.0.13     255.255.255.248 UG    100    0        0 tun0
210.48.111.208  172.17.0.13     255.255.255.240 UG    0      0        0 tun0

MTR do meu computador mostra:

Keys:  Help   Display mode   Restart statistics   Order of fields   quit
                                       Packets               Pings
 Host                                Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. gwbox.companyname.co.nz           0.0%     2    0.3   0.3   0.3   0.3   0.0
 2. 172.17.0.14                       0.0%     2   76.5  76.7  76.5  76.9   0.0
 3. ???

O roteador DD-WRT mostra:

tcpdump -n -i tun0 src or dst 192.168.5.1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
12:27:19.956766 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 59776, length 44
12:27:20.043487 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 60032, length 44
12:27:20.146912 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 60288, length 44
12:27:20.246477 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 60544, length 44
12:27:20.353698 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 60800, length 44
12:27:20.447131 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 61056, length 44
12:27:20.556747 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 61312, length 44

Enquanto o tcpdump -n -i vlan2 src ou dst 192.168.5.1 não mostra nada.

    
por davidgo 11.07.2018 / 04:32

0 respostas