12

I have a asymmetric dual bridge topology as shown below when i connect from 172.16.11.5 and 172.16.10.6 with ssh but i can not connect because of SynProxy.

                  -------
                  |     |
                  ---o--- 172.16.11.5
                     |
                     |
                -----o----- 172.16.11.6
                |         |
                |         | default gw 1.1.1.1
                |         |
     1.1.1.2/30 --o----o--- 2.2.2.2/30
                  |    |
                  |    |
                  |    | (enp10s0f0)
              ----o----o-----
              |             |
              |     XXX     |
              |             |
              |  br1   br0  | synproxy
              |             |
              ----o----o-----
                  |    |
                  |    |
                  |    |
     1.1.1.1/30 --o----o--- 2.2.2.1/30
                |         |
                |         | default gw 2.2.2.2
                |         |
                -----o----- 172.16.10.1
                     |
                     |
                  ---o--- 172.16.10.6
                  |     |
                  -------

On all machines between 172.16.11.5 and 172.16.10.6 "rp filtering" is off and "ip forwarding" is on. There is a machine at the middle of topology which is called "XXX" machine. XXX has two bridges and a SynProxy.

When SynProxy is turned OFF on XXX, I can ping from 172.16.11.5 to 172.16.10.6 and icmp packets follow this path: br1->172.16.10.1->172.16.10.6->172.16.10.1->br0. In addition, I can access from 172.16.11.5 to 172.16.10.6 with ssh. So the TCP traffic works as I expect.

However, when SynProxy is turned ON on XXX, I can ping from 172.16.11.5 to 172.16.10.6 and icmp packets follow the same path. But I can not access from 172.16.11.5 to 172.16.10.6 using ssh. This is because synproxy can not send syn ack replies through br1 iface. If I add a route for synack packets on XXX, i can connect from 172.16.11.5 to 172.16.10.6 with ssh.

route add 172.16.11.5 dev enp10s0f0

SynProxy rules for XXX:

iptables -t raw -A PREROUTING -i br0 -p tcp -m physdev --physdev-in 
enp10s0f0 -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CT --notrack
iptables -t raw -A PREROUTING -i br1 -p tcp -m physdev --physdev-in 
enp11s0f0 -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CT --notrack

iptables -t filter -A FORWARD -i br0 -p tcp -m physdev --physdev-in 
enp10s0f0 -m tcp -m state --state INVALID,UNTRACKED -j SYNPROXY 
--sack-perm --timestamp --wscale 7 --mss 1460
iptables -t filter -A FORWARD -i br0 -m physdev --physdev-in enp10s0f0 
-m state --state INVALID -j DROP
iptables -t filter -A FORWARD -i br1 -p tcp -m physdev --physdev-in 
enp11s0f0 -m tcp -m state --state INVALID,UNTRACKED -j SYNPROXY 
--sack-perm --timestamp --wscale 7 --mss 1460
iptables -t filter -A FORWARD -i br1 -m physdev --physdev-in enp11s0f0 
-m state --state INVALID -j DROP

But this is not acceptable because 172.16.11.0 network is cloud. So i could not add route all cloud network to route table and could not add mac address to arp table.

How can I connect from 172.16.11.5 to the 172.16.10.6 machine using ssh when SynProxy is turned ON on XXX? or Is It possible?

Thanks in advance,

  • Can you tell what values the medium_id of the bridge interfaces on synproxy have? Also, what are your actual SYNPROXY rules in all tables? – Alexander Janssen Jun 15 '15 at 9:36
  • I added iptables rules for SynProxy. But i dont know anything about medium_id. I searched rapidly on internet but it is not heplful @AlexanderJanssen – nyzsirt Jun 16 '15 at 6:48
0

The simplest way I can see to fix this is to change the default routes on the gateway machines to use the same bridge so its no longer asymmetric.

  • On 172.16.11.6 set the default as 2.2.2.1 (via br0)
  • On 172.16.10.1 set the default as 2.2.2.2 (via br0)

I'm curious as to why it's been engineered this way... what's the purpose of the second bridge ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.