I've been dealing with quite an odd issue for about the past week now, and I'm wondering if anyone had any advice to continue debugging. We have a machine with two ethernet interfaces, one of which serves as our internet connection (let's say IP A), and the other which has a subnet of our network's traffic (which includes IP A) mirrored to it through our router; that interface has IP B. We have an application that takes in traffic from the mirrored interface and filters it, dumping some packets to tun interfaces (let's simplify and only say tun0 here, though in the real application we have one for each core on which the filtering is performed). We then attempt to DNAT packets received on tun0 back to IP B on port C so that another application can ingest them.
We have a rule set up in the nat table's PREROUTING chain to perform the DNAT, as follows:
iptables -t nat -I PREROUTING -p tcp -i tun0 -j DNAT --to <B>:<C>
I have confirmed that this rule is being hit, both with packet traces as well as looking at the packet numbers from iptables. After that, however, the packets seem to disappear—I would expect them to next enter the INPUT chain as IP B is a local address (I've confirmed
ip route get <B> refers to
lo), however the packets don't enter the INPUT or FORWARD chains, which leads me to believe they're dropped in the routing decision. Everything that I've seen online seems to point to this being an issue with
route_localnet, however I've confirmed all of the following:
net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.tun0.rp_filter = 0 net.ipv4.conf.lo.rp_filter = 0 net.ipv4.ip_forward = 1 net.ipv4.conf.tun0.forwarding = 1 net.ipv4.conf.lo.forwarding = 1 net.ipv4.conf.all.route_localnet = 1 net.ipv4.conf.tun0.route_localnet = 1 net.ipv4.conf.lo.route_localnet = 1
When I turn on martian logging, I see the following:
IPv4: martian source <B> from <A>, on dev tun0
Which seems to confirm that the DNAT is having some effect, but given that
rp_filter=0 this confuses me.
At this point, I'm out of ideas on how to continue debugging, as the packets seem to disappear from the face of the earth after the DNAT step other than the martian logs, and would greatly appreciate some guidance! Thanks!