Score:0

How to select packets in iptables in nested IPIP tunnel?

au flag

I have IPIP tunnel as shown in tcpdump output bellow: IP 192.168.240.112 > 192.168.250.112.

Inside this tunnel, there is a traffic in another IPIP tunnel IP 10.233.86.94.35938 > 10.233.100.199.3306

$ sudo tcpdump -i oet1 -n
09:53:57.455262 IP 192.168.240.112 > 192.168.250.112: IP 10.233.86.94.35938 > 10.233.100.199.3306: Flags [P.], seq 802:865, ack 3295, win 501, options [nop,nop,TS val 3263474194 ecr 1936879148], length 63

My incomplete iptables rule:

iptables -t nat -A POSTROUTING -o oet1 -s 192.168.240.112 -d here_I_will_put_IP_that_I_need_that_is_fine -j SNAT --to 192.168.250.112

I want to somehow select packets of source IP 10.233.86.94 to destination IP 10.233.100.199 and add to iptables rule. So SNAT is done only when 10.233.86.94 calls 10.233.100.199.

Any way to mark IPs that are inside nested (encapsulated) tunnel or are they not reachable to iptables?

Thanks

A.B avatar
cl flag
A.B
It would help if you gave a little ascii schematic describing your network layout and explained why there is ipip inside ipip. And why the tag wireguard? If you're not using wireguard anywhere, you should not put this tag.
A.B avatar
cl flag
A.B
Btw, I believe this feature is available with nftables 1.0.7 and kernel 6.2 (both very recent) with the @ih inner header feature. No idea for iptables.
laimison avatar
au flag
Will keep in mind about nftables and kernel 6.2, while I can't have it. In terms of setup, I mentioned Wireguard, because it is quite simple Wireguard tunnel (192.168.240 to 192.168.250) and Wireguard client uses standard IPIP tunnel (10.233.86 to 10.233.100). So there is nested tunnel.
A.B avatar
cl flag
A.B
Your question says 192.168.240-192.168.250.112 is IPIP. It is not. It's WireGuard (which is over UDP, not using IPIP). Doesn't change much but the question is inaccurate, so if it's inaccurate about this what else?... really need a schematic
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.