I am trying to apply SNAT to a PPTP client. The TCP/1723 packets are being SNATed properly but not the GRE ones. Can anyone spot what's wrong?
I have the following iptables configuration:
$ sudo iptables -t nat -L POSTROUTING -v -n Chain POSTROUTING (policy ACCEPT 616 packets, 37030 bytes) pkts bytes target prot opt in out source destination 0 0 SNAT 47 -- * * $internal_ip 0.0.0.0/0 to:$external_ip
When inspecting outgoing traffic on the egress interface using tcpdump, I see the following:
<timestamp> IP $internal_ip > $target_ip: GREv1, call 31607, seq 1, length 36: LCP, Conf-Request (0x01), id 1, length 22
... instead of the expected
$external_ip > so clearly the
SNAT translation isn't working (as is clear from the
0 pkts 0 bytes).
I have the following modules loaded (among others):
nf_nat_proto_gre nf_conntrack_proto_gre nf_conntrack_pptp nf_nat_pptp
A few notes in case this is relevant:
- The routing is happening upstream using a 3rd party firewall (so the outgoing packets are already on the correct egress interface).
- The firewall is actually running in a VM (the above
iptableslisting is from its hypervisor), bridged to the egress interface.
- The TCP/1723 packets are being SNATed by the firewall (but not the GRE ones); I'm effectively trying to use IPTables as a workaround to the firewall shortcoming. Presumably IPTables doesn't care about how the packets got there?
- The egress interface/bridge has a static IP which is different from
$external_ip(albeit on the same subnet)
This is a Ubuntu 14.04 server running