Score:0

Server

proper way of NATing and Routing when using TUN interface with iptables

user3840019

12/1/23, 9:18 PM

edit: I'm a newbie in networking and discovering new things :)

I created a TUN interface programmatically and able to interact with.

I set it up and running by ifconfig myTun 10.10.1.1/24 up

and its up and running as I can see it in ifconfig and pinging 10.10.1.1

and to make 100% sure if my TUN interface is up and running with my written problem I did following:

I pinged 10.10.1.2 and the packet is received in my program, I wrote it back to tun then received it again in a loop.

now I am sure all packets FROM or TO 10.10.1.x are being received by and written to TUN without any problem.

when I write a packet with any destination IP outside the 10.10.1.x it successfully written to TUN but no answered received to TUN.

after searching and reading lots of article I figured its silently being dropped by the kernel.

I read lots of Q/A about TUN interfaces in serverfault.com and I found out that I've missed a serious part in my Logic which is ROUTING.

my final understanding is: the packet is OK and received by the network stack in linux, but the kernel doesn't know what to do with the packet because of its weird destination. then I discovered I must specify some routing for the kernel in iptables and enabling net.ipv4.ip_forward but doesn't know how to.

my final goal is:

when I send any packet with any destination outside 10.10.1.x to the TUN, it must be routed to my main interface (which has access to internet, and is wlps020f3) and any result of that packet receive back to my TUN interface

how to configure NAT in iptables to workaround?

thanks in advanced

486

1 + 0

nat

routing

iptables

tun

ip-forwarding

Score:0

Server

A. Trevelyan

12/2/23, 5:15 AM

Enable IPv4 forwarding:

sudo sysctl -w net.ipv4.ip_forward=1

NAT traffic from the tunnel interface behind your wireless address:

sudo iptables -t nat -A POSTROUTING -o wlps020f3 -j MASQUERADE

Neither of these changes will survive a reboot. The top link and this one have more info on that aspect.

+ 4

user3840019

12/2/23, 11:13 AM

that worked once. after relaunching the program it didn't work. and I checked both ip forwarding and nat rules in iptabbles they exist. and do that forward any destination except the interface subnet which is 10.10.1.x??? because I need the clients on that subnet interact with each other too.

A. Trevelyan

12/2/23, 5:47 PM

@user3840019 I'm not sure why it wouldn't be working after relaunching. Yes it should be forwarding to any destination outside 10.10.1.0/24 which is the ip/mask on your interface. There are probably some technicalities since I believe a tun interface is supposed to be a point to point link so there really shouldnt be more than 2 devices on the link, but I haven't played with it enough to give strong feedback. Try running a tcpdump and looking at the traffic through the machine.

user3840019

12/4/23, 1:14 AM

I've facd two problems here: 1. after setting up the interface I must ping a subnet to make it running otherwise its not running. 2. there is a routing dead loop there I think, because the tun sends me repeatitive packets

user3840019

12/8/23, 1:10 PM

thanks @user989088 ! the problem was in my code which ignored packets in my weak epoll implementation

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: proper way of NATing and Routing when using TUN interface with iptables

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.