Espero perder algo óbvio, mas preciso mesmo de um segundo par de olhos.
Em resumo, o problema é que consigo ver o tráfego entrando no meu roteador dd-wrt do tun0, mas o tráfego não está saindo no vlan2. Como corrijo isso?
A caixa DD-WRT com uma VPN de escritório para escritório. (DD-WRT está agindo como um cliente VPN aqui) Não há problema para escritórios conversando entre si, nem há um problema de usuários por trás da caixa DD-WRT de acessar a Internet mais ampla.
Eu preciso acessar o modem na frente da caixa do DD-WRT através da VPN (ou seja, usando http), mas não consigo fazer isso funcionar. Usando o tcpdump na caixa DD-WRT eu posso ver pacotes para o modem (que está em 192.168.5.1) entrando através da interface tun0, mas eles não estão deixando a interface vlan2 (ou qualquer outra). VLAN2 é, claro, a interface WAN.
/proc/sys/net/ipv4_ip_forward = 1
(na verdade, ipv4_ip_forward é 1 em todas as interfaces também. Da mesma forma, rp_filter é 0 para todas as interfaces)
O iptables na caixa dd-wrt tem a seguinte aparência:
# Generated by iptables-save v1.3.7 on Wed Jul 11 11:58:08 2018
*raw
:PREROUTING ACCEPT [47865311:28994994909]
:OUTPUT ACCEPT [9163855:1799452886]
COMMIT
# Completed on Wed Jul 11 11:58:08 2018
# Generated by iptables-save v1.3.7 on Wed Jul 11 11:58:08 2018
*nat
:PREROUTING ACCEPT [1057208:133049889]
:INPUT ACCEPT [345811:25454876]
:OUTPUT ACCEPT [89626:6090987]
:POSTROUTING ACCEPT [155806:10976951]
-A PREROUTING -d 192.168.5.150 -p icmp -j DNAT --to-destination 10.113.3.254
-A PREROUTING -d 192.168.5.150 -j TRIGGER --trigger-proto --trigger-match 0-0 --trigger-relate 0-0
-A POSTROUTING -s 10.113.3.0/255.255.255.0 -o vlan2 -j SNAT --to-source 192.168.5.150
-A POSTROUTING -m mark --mark0x80000000/0x80000000 -j MASQUERADE
COMMIT
# Completed on Wed Jul 11 11:58:08 2018
# Generated by iptables-save v1.3.7 on Wed Jul 11 11:58:08 2018
*mangle
:PREROUTING ACCEPT [47865077:28994974549]
:INPUT ACCEPT [10833466:7689826180]
:FORWARD ACCEPT [36687562:21242777711]
:OUTPUT ACCEPT [9163804:1799448597]
:POSTROUTING ACCEPT [45776394:23034636218]
-A PREROUTING -d 192.168.5.150 -i ! vlan2 -j MARK --set-xmark 0x80000000/0x80000000
-A PREROUTING -j CONNMARK --save-mark
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Wed Jul 11 11:58:08 2018
# Generated by iptables-save v1.3.7 on Wed Jul 11 11:58:08 2018
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [9163399:1799420708]
:advgrp_1 - [0:0]
:advgrp_10 - [0:0]
:advgrp_2 - [0:0]
:advgrp_3 - [0:0]
:advgrp_4 - [0:0]
:advgrp_5 - [0:0]
:advgrp_6 - [0:0]
:advgrp_7 - [0:0]
:advgrp_8 - [0:0]
:advgrp_9 - [0:0]
:grp_1 - [0:0]
:grp_10 - [0:0]
:grp_2 - [0:0]
:grp_3 - [0:0]
:grp_4 - [0:0]
:grp_5 - [0:0]
:grp_6 - [0:0]
:grp_7 - [0:0]
:grp_8 - [0:0]
:grp_9 - [0:0]
:lan2wan - [0:0]
:logaccept - [0:0]
:logdrop - [0:0]
:logreject - [0:0]
:trigger_out - [0:0]
-A INPUT -d 192.168.5.1 -j ACCEPT
-A INPUT -s 10.109.0.0/255.255.0.0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -s 10.104.0.0/255.255.0.0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -s 10.109.0.0/255.255.0.0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.104.0.0/255.255.0.0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.112.0.0/255.255.255.0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 114.23.127.210 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.109.4.0/255.255.254.0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.105.4.0/255.255.254.0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 192.168.200.253 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.108.98.1 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 192.168.200.7 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 192.168.224.1 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i vlan2 -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A INPUT -i vlan2 -p udp -m udp --dport 520 -j DROP
-A INPUT -i br0 -p udp -m udp --dport 520 -j DROP
-A INPUT -p udp -m udp --dport 520 -j ACCEPT
-A INPUT -i vlan2 -p icmp -j ACCEPT
-A INPUT -p igmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 113 -j ACCEPT
-A INPUT -i lo -m state --state NEW -j ACCEPT
-A INPUT -i br0 -m state --state NEW -j ACCEPT
-A INPUT -j DROP
-A FORWARD -d 192.168.5.1 -j ACCEPT
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.113.3.0/255.255.255.0 -o vlan2 -p gre -j ACCEPT
-A FORWARD -s 10.113.3.0/255.255.255.0 -o vlan2 -p tcp -m tcp --dport 1723 -j ACCEPT
-A FORWARD -j lan2wan
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -d 224.0.0.0/240.0.0.0 -i vlan2 -p udp -j ACCEPT
-A FORWARD -i vlan2 -o br0 -j TRIGGER --trigger-proto --trigger-match 0-0 --trigger-relate 0-0
-A FORWARD -i br0 -j trigger_out
-A FORWARD -i br0 -m state --state NEW -j ACCEPT
-A FORWARD -j DROP
-A OUTPUT -d 192.168.5.1 -j ACCEPT
-A OUTPUT -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A logaccept -j ACCEPT
-A logdrop -j DROP
-A logreject -p tcp -j REJECT --reject-with tcp-reset
COMMIT
# Completed on Wed Jul 11 11:58:08 2018
O tráfego é originário de 10.109.4.18 e destinado a 192.168.5.1. 192.168.5.1 é o endereço IP interno do modem e eu posso fazer o ping do roteador DD-WRT.
10.109.4.18 é o endereço IP do meu computador, e está sendo roteado pelo túnel e é visível no roteador DD-WRT na interface tun0.
A LAN do escritório é 10.113.0.0/16. (Eu não acho que isso seja muito relevante para o problema).
A tabela de rotas para a caixa DD-WRT é
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.5.1 0.0.0.0 UG 0 0 0 vlan2
10.103.0.0 172.17.0.13 255.255.0.0 UG 0 0 0 tun0
10.104.0.0 172.17.0.13 255.255.0.0 UG 0 0 0 tun0
10.108.0.0 172.17.0.13 255.255.0.0 UG 100 0 0 tun0
10.109.0.0 172.17.0.13 255.255.0.0 UG 0 0 0 tun0
10.112.0.0 172.17.0.13 255.255.0.0 UG 300 0 0 tun0
10.113.3.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
52.64.171.0 172.17.0.13 255.255.255.0 UG 0 0 0 tun0
52.79.94.0 172.17.0.13 255.255.255.0 UG 0 0 0 tun0
103.245.173.26 172.17.0.13 255.255.255.255 UGH 0 0 0 tun0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br0
172.17.0.0 172.17.0.13 255.255.255.128 UG 0 0 0 tun0
172.17.0.13 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.0.0 172.17.0.13 255.255.128.0 UG 0 0 0 tun0
192.168.5.0 0.0.0.0 255.255.255.0 U 0 0 0 vlan2
192.168.100.0 172.17.0.13 255.255.255.0 UG 100 0 0 tun0
192.168.128.0 172.17.0.13 255.255.128.0 UG 100 0 0 tun0
192.168.190.0 172.17.0.13 255.255.255.0 UG 100 0 0 tun0
192.168.200.0 172.17.0.13 255.255.255.0 UG 100 0 0 tun0
192.168.201.0 172.17.0.13 255.255.255.0 UG 100 0 0 tun0
192.168.202.0 172.17.0.13 255.255.255.0 UG 100 0 0 tun0
202.49.205.0 172.17.0.13 255.255.255.0 UG 100 0 0 tun0
203.171.55.96 172.17.0.13 255.255.255.240 UG 100 0 0 tun0
210.48.103.120 172.17.0.13 255.255.255.248 UG 100 0 0 tun0
210.48.111.208 172.17.0.13 255.255.255.240 UG 0 0 0 tun0
MTR do meu computador mostra:
Keys: Help Display mode Restart statistics Order of fields quit
Packets Pings
Host Loss% Snt Last Avg Best Wrst StDev
1. gwbox.companyname.co.nz 0.0% 2 0.3 0.3 0.3 0.3 0.0
2. 172.17.0.14 0.0% 2 76.5 76.7 76.5 76.9 0.0
3. ???
O roteador DD-WRT mostra:
tcpdump -n -i tun0 src or dst 192.168.5.1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
12:27:19.956766 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 59776, length 44
12:27:20.043487 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 60032, length 44
12:27:20.146912 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 60288, length 44
12:27:20.246477 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 60544, length 44
12:27:20.353698 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 60800, length 44
12:27:20.447131 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 61056, length 44
12:27:20.556747 IP 10.109.4.18 > 192.168.5.1: ICMP echo request, id 65027, seq 61312, length 44
Enquanto o tcpdump -n -i vlan2 src ou dst 192.168.5.1 não mostra nada.