Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm stuck with an AT&T gateway that doesn't understand a MAC can have more than 1 IP address. So I'm using macvlan on linux to add ports with different mac addresses.

This seem to work for local connections to the macvlan ports. But, when I try and DNAT them into a private DMZ the packets seem to disappear. I have ip_forwarding turned on and other outgoing packet forwarding is working.

I've used tcpdump and trace in iptables to no avail. The DNAT rule fires, then the packets never emerge anywhere.

I'm running Centos 6.3.

share|improve this question
    
I finally solved this. Turns out all the wacky network shenanigans caused by trying to forward macvlan traffic tripped up the kernel reverse path filter causing it to drop the packets. I had to set rp_filter = 0 for any interface the traffic traversed. –  Michael Gantz Jan 8 '13 at 16:15
    
You should post that as an answer (once you are able to). –  mgorven Jan 9 '13 at 0:58
    
Thank you, thank you, thank you. I'm also using macvlan devices with DNAT to route traffic into Linux Containers. Works fine from the host, and from other machines on the same subnet; breaks horribly for machines on different subnets. Setting rp_filter = 0 (or 2) solved this for me. Thank you again. –  dty Oct 2 '13 at 15:08
add comment

1 Answer

up vote 2 down vote accepted

I finally solved this. Turns out all the wacky network shenanigans caused by trying to forward macvlan traffic tripped up the kernel reverse path filter causing it to drop the packets. I had to set rp_filter = 0 for any interface the traffic traversed.

share|improve this answer
    
Thanks for sharing this, I have spent three hours of useless attempts to make some very similar work, until I found your solution. –  MariusMatutiae Feb 12 at 13:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.