2

I am trying to forward packets from HostA to HostB using ip-in-ip tunneling. While packets are reaching their destination, they are not being decapsulated by the receiving host, and thus being dropped thereafter. I feel as though I've exhausted all of google. In essense, it looks like the receiving host never sends the packets to the tunnel device for decapsulation.

The tutorial I've used most when trying this is here, but I have tried multiple methods and different tutorials, and am continuously met with the same problem. What am I missing?

On HostA:

ip tunnel add tun0 mode ipip local $hostA remote $hostB
ip link set tun0 up
ip addr add 10.10.10.1/24 dev tun0

On HostB

ip tunnel add tun0 mode ipip local $hostB remote $hostA
ip link set tun0 up
ip addr add 10.10.10.2/24 dev tun0

Now, when I ping 10.10.10.2, I get no response. HostB is showing (via tcpdump -c 10 -nn src host 10.10.10.1 or src host $hostA):

(edited to remove actual ip address of hosts)

18:18:56.026192 IP [HostA eth0 IP] > [HostB eth0 IP]: IP 10.10.10.1 > 10.10.10.2: ICMP echo request, id 41073, seq 69, length 64 (ipip-proto-4)

The incoming packets look like they should, but they are never being decapsulated. tcpdump -nni tun0 has no output, and no response is ever made to the ping.

  • 1
    Are you sure your firewall rules allow for the request to be received by HostB? – Evan Anderson Oct 30 '14 at 18:34
  • I have (for the purpose of this test) done iptables -A INPUT -p icmp -j ACCEPT – Thomas Thorogood Oct 30 '14 at 18:35
  • Uh. Ok. Yes. So, adding -p ipencap fixed the issue...wow. You're awesome. If you want to slap that into the answers box I'll mark it as accepted. Otherwise I'll just delete the Q – Thomas Thorogood Oct 30 '14 at 18:41
  • It's always those pesky firewall rules. >smile< – Evan Anderson Oct 30 '14 at 18:43
2

Make sure your firewall rules allow for the request to be received by HostB (and, obviously, the converse on HostA, too).

In this instance, specifically, accepting the 'ipencap' protocol resolved the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.