[Netkit.users] TAP interface & masquerade

[Cyrille OLIVIER]

Hi,

Thanks these informations.

I realized my misunderstanding of the "man vstart" content about tap interface. I thought the network interface to use in the host PC has to be a real and existing one. That's why I choose the all the IP in the same subnet :(

Using a complete different subnet solves the issue. Thanks again.

 

Now, as I need to build a lab related to IPv6, I need to setup a v4/v6 tunnel between eth0 inside r1 (so I will put a v6 IP) and the remote real PC:

 

  --------                                                                                      -------------

  |  r1  |eth0              -----------------   ------------------   real ethernet cable   eth0 |           |

  | (vm) |------------------|nk_tap_root dev|---| eth0 of host PC|------------------------------| remote PC |  

  -------- v6 IP            -----------------   ------------------                        v6 IP |           |

         (------------------------------------------------------------------------------------) -------------

         (                      IPv4/v6 tunnel                                                )

         (------------------------------------------------------------------------------------)

 

I hope it's possible. If it's seems interesting for the mailing list users, I will give feedback about my work.

 

Rgds,
Cyrille


 


Date: Thu, 9 Jul 2009 15:18:54 +0200
From: rimondin at dia.uniroma3.it
To: netkit.users at list.dia.uniroma3.it
Subject: Re: [Netkit.users] TAP interface & masquerade

Dear Cyrille,


vstart r1 --con0=this --eth0=tap,10.0.0.2,10.0.0.3 => OK, r1 boot successfully.

Ok, fine.


So, inside r1: eth0=10.0.0.3/24

Wrong. When using tap interfaces, the default classful addressing is assumed. Therefore, eth0 is configured with 10.0.0.3/8.


The host PC has a real network-interface eth0=10.0.0.2/24
To reach internet, the next-hop is the 10.0.0.1/24 in another PC.

This is likely the problem: since the same subnet (or better, in your case two overlapping subnets) is used for the tap interface and for connecting the host to the Internet, traffic directed to that subnet may be unpredictably routed to eth0 on your host or to the tap interface. Because of the subnetting plan (10.0.0.0/8 assigned to Netkit, 10.0.0.0/24 assigned to your host), it is likely that echo request packets correctly flow out of the virtual machine, while echo reply packets are incorrectly routed to your host (because of the best prefix match rule).


 
In the host PC, ping 10.0.0.1 is OK. ping 10.0.0.3 is OK.
Inside r1 vm: ping 10.0.0.2 is OK. but ping 10.0.0.1 is NOK :(

If my conjecture is correct, your ping should report a timeout.


  
In the host PC, I check: 
- /proc/sys/net/ip4/ip_forward is 1 : OK
- iptables -L does not display the masquerading in postrouting chain(result of 'iptables -t nat -A POSTROUTING -j MASQUERADE') but its seems OK.

It does not show the entry because masquerading rules lie in a different table. The entry would show up if you used "iptables -t nat -L".


 
Any idea why ping from VM to external gw is NOK ?

At this point, I suggest using a different subnet for the tap interface. Note that any subnet is fine because it will be hidden by masquerading.


 
Thanks,
Best regards to all,
Cyrille

Regards,
Massimo.


 
 
 
 



Souhaitez vous  « être au bureau sans y être » ? Oui je le veux ! 
_______________________________________________
Netkit.users mailing list
Netkit.users at list.dia.uniroma3.it
http://list.dia.uniroma3.it/mailman/listinfo/netkit.users
  
_________________________________________________________________
Inédit ! Des Emoticônes Déjantées! Installez les dans votre Messenger !
http://www.ilovemessenger.fr/Emoticones/EmoticonesDejantees.aspx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://list.dia.uniroma3.it/pipermail/netkit.users/attachments/20090710/c408dfb9/attachment-0001.htm