TCP Packet Loss in nftable nat chain

leonard georg

8/21/24, 10:48 PM

I am trying to connect to a Minecraft server but get a connection Timeout when tryping to connect although the Server is showing up as online

Minecraft Multiplayer screen

This question meight seem out of place, but wait.

The minecraft server is running on an Proxmox Container. The Proxmox container is running on a Home-Server. The Home-Server connects to an Wireguard Server running on Linode.

So I route the Trafic comming to the public Linode Server to the Homeserver over wireguard and on the Homeserver, I route the trafic again, to the Minecraft server and Back.

Routing

For the Routing part I used nftable nat rules on both the linode Server and the proxmox server. Here is an example from the Linode server.

table ip nat {
        chain prerouting {
                type nat hook prerouting priority dstnat; policy accept;
                tcp dport 25565 dnat to 192.168.0.46
                udp dport 25565 dnat to 192.168.0.46
        }

        chain postrouting {
                type nat hook postrouting priority srcnat; policy accept;
                masquerade
        }
}

As the basic comunication to the server seems to work, I am really confused why I can't connect.

Maybe somebody can help me decipher the Wireshark log from the Minecraft client.

Minecraft client Wireshark log

Any help, suggestions or questions are more than welcome, as I have sunken more hours into this, than I am willing to admit.

Cheers Leo

PS.: I have no clue if the title is even remotely correct, so please correct me. :)

1 + 2

networking

linux

routing

tcp

nftables

Matthew Ife

8/23/24, 9:31 AM

Not needed now but `nft monitor` and using a `meta set nftrace 1` rule in your firewall rules greatly assists in debugging your firewall packet flow (how it jumps around one chain to another and the ultimate verdict it gets).

leonard georg

8/23/24, 11:31 AM

thank you, I will take a look at it :) Wasn't the first time debugging, won't be the last ^^

Score:1

Server

leonard georg

8/23/24, 9:26 AM

Found it! It was caused by the wireguard config. The default MTU was too big for my configuration. I lowered it to 1392 (I think) and it works like a charm.

For anyone wondering. Wireguard doesn't account for IPv4 through IPv6 tunneling, used by many ISP's these days to save on IPv4 addresses. This increases the header of the tcp packets and everything falls apart.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: TCP Packet Loss in nftable nat chain

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.