Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a program (written by me) that creates a tun0 device and sets up a route so that packets destined for the subnet can be read from this device. I'm trying to go in the other direction now and write packets to the tun device that can be received by

My first effort, just changing the source and destination address and ports worked fine. I can run the following:

nc -u -s MY_IP -p 4001 4000

and my input gets echoed.

My second effort, actually generating output packets from scratch, is currently failing.

I can run tcpdump -i tun0 and see the packets that I've written:

11:30:14.433489 IP (tos 0x0, ttl 32, id 0, offset 0, flags [none], proto UDP (17), length 56) > Ubuntu-dbacher.local.4011: [udp sum ok] UDP, length 28

But my listener (nc -l -u -s MY_IP -p 4011) doesn't see anything.

I suspect there's something wrong that's preventing the tun0 device from routing its packets out, but I don't know how to get visibility into where the packets are being dropped.

$ ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:  P-t-P:  Mask:
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   UG    0      0        0 tun0   U     1      0        0 eth0     U     1000   0        0 eth0         UG    0      0        0 eth0

$ cat /proc/sys/net/ipv4/ip_forward

How do I debug where the tun packets are being dropped?

(BTW, all packets are UDP.)

share|improve this question

just a hunch - does linux allow packet routing?

run *cat /proc/sys/net/ipv4/ip_forward* - you expect to see 1. if it's 0 run:

echo 1 > /proc/sys/net/ipv4/ip_forward

also check your iptables - at the beginning you probably want to have ACCEPT for FORWARD chain:

iptables -F FORWARD

when troubleshooting routing / firewalls i most often use tcpdump [ which you've mentioned ].

share|improve this answer
I should have mentioned that ip_forward is 1. iptables shows "Chain FORWARD (policy ACCEPT)" but no targets are listed, so I think that's OK. – Dave Bacher Feb 3 '10 at 22:48
Thanks for the iptables mention. I added some LOG actions to try to catch where the packets were being dropped. – Dave Bacher Feb 5 '10 at 4:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.