I am trying to apply SNAT to a PPTP client. The TCP/1723 packets are being SNATed properly but not the GRE ones. Can anyone spot what's wrong?
I have the following iptables configuration:
$ sudo iptables -t nat -L POSTROUTING -v -n
Chain POSTROUTING (policy ACCEPT 616 packets, 37030 bytes)
pkts bytes target prot opt in out source destination
0 0 SNAT 47 -- * * $internal_ip 0.0.0.0/0 to:$external_ip
When inspecting outgoing traffic on the egress interface using tcpdump, I see the following:
<timestamp> IP $internal_ip > $target_ip: GREv1, call 31607, seq 1, length 36: LCP, Conf-Request (0x01), id 1, length 22
... instead of the expected $external_ip >
so clearly the SNAT
translation isn't working (as is clear from the 0 pkts 0 bytes
).
I have the following modules loaded (among others):
nf_nat_proto_gre
nf_conntrack_proto_gre
nf_conntrack_pptp
nf_nat_pptp
A few notes in case this is relevant:
- The routing is happening upstream using a 3rd party firewall (so the outgoing packets are already on the correct egress interface).
- The firewall is actually running in a VM (the above
iptables
listing is from its hypervisor), bridged to the egress interface. - The TCP/1723 packets are being SNATed by the firewall (but not the GRE ones); I'm effectively trying to use IPTables as a workaround to the firewall shortcoming. Presumably IPTables doesn't care about how the packets got there?
- The egress interface/bridge has a static IP which is different from
$external_ip
(albeit on the same subnet)
This is a Ubuntu 14.04 server running 3.13.0-123-generic