netdev - Why might packets go into a tunnel and not come out

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sun, 02 Oct 2011 11:25:04 +0200
From:	Jan Ceuleers <jan.ceuleers@...puter.org>
To:	netdev@...r.kernel.org
Subject: Why might packets go into a tunnel and not come out

All,

This is a question that I would have posted to linux-net had it still 
existed. I beg your indulgence.

I have established an SSH tunnel (device tunX) between two remote hosts. 
This tunnel is operating properly in that I can ping each peer from the 
other.

I am now trying to route traffic through this tunnel to onward 
destinations. This is not working: when I ping such an onward 
destination I can see the packets going into the tunnel (using tcpdump) 
but they're not coming out of the other end (again as seen by tcpdump).

I have added logging to all firewall rules that drop or reject traffic; 
nothing is logged. (And yes I have checked that logging itself works by 
briefly adding logging to an ACCEPT rule). Routing is enabled on both 
hosts. The counters for the tun devices (as seen using ifconfig) do not 
show any dropped traffic.

I am not asking you to debug my problem for me, but could anyone please 
point me to an overview of the reasons why packets might be going into 
one end of a tunnel and not come out the other end? I have studied the 
diagram at the following link and I think I've checked the potential 
issues that it prompts:

http://www.shorewall.net/Shorewall_and_Routing.html

Many thanks.

Jan
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html