Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1201975 > unrolled thread

IPv6 and private net with masquerading not working correctly

Started byGerhard Wiesinger <lists@wiesinger.com>
First post2015-08-06 20:50 +0200
Last post2015-08-10 19:40 +0200
Articles 3 — 2 participants

Back to article view | Back to linux.kernel

Contents

  IPv6 and private net with masquerading not working correctly Gerhard Wiesinger <lists@wiesinger.com> - 2015-08-06 20:50 +0200
    Re: IPv6 and private net with masquerading not working correctly Gerhard Wiesinger <lists@wiesinger.com> - 2015-08-07 15:10 +0200
      Re: IPv6 and private net with masquerading not working correctly Cong Wang <xiyou.wangcong@gmail.com> - 2015-08-10 19:40 +0200

#1201975 — IPv6 and private net with masquerading not working correctly

FromGerhard Wiesinger <lists@wiesinger.com>
Date2015-08-06 20:50 +0200
SubjectIPv6 and private net with masquerading not working correctly
Message-ID<pUyoN-zG-3@gated-at.bofh.it>
Hello,

I'm having the following problem with IPv6 and a private internal LAN 
which will be masqueraded to the public internet (I don't want to have 
public IPs in the LAN because of some static IPs and tracking) . Rules 
are generated by shorewall.

Problem is that ICMP6 packets source address is not translated by the 
kernel on the reply when MTU has to be discovered because of too big 
packets and limited MTU capabilities on the path (happens also on tcp6 
which works thereofore not correctly).

# From an internal host on net fd00:1234:5678::/64
ping6 -s 2000 2a02:1234:5678:7::2

/etc/shorewall6/masq
EXT_IF                   fc00::/7

ip6tables rule:
MASQUERADE  all      *      *       fc00::/7             ::/0

# Internal interface
IP6 fd00:1234:5678::9 > 2a02:1234:5678:7::2: frag (0|1432) ICMP6, echo 
request, seq 1, length 1432
IP6 fd00:1234:5678::9 > 2a02:1234:5678:7::2: frag (1432|576)
IP6 2a02:1234:5678:9abc::115 > fd00:1234:5678::9: ICMP6, packet too big, 
mtu 1440, length 1240

# External interface
IP6 2001:1234:5678:9abc::1 > 2a02:1234:5678:7::2: frag (0|1432) ICMP6, 
echo request, seq 1, length 1432
IP6 2001:1234:5678:9abc::1 > 2a02:1234:5678:7::2: frag (1432|576)
IP6 2a02:1234:5678:9abc::115 > 2001:1234:5678:9abc::1: ICMP6, packet too 
big, mtu 1440, length 1240

Looks to me like a a major kernel bug.
Kernel version is: 4.1.3-201.fc22.x86_64 from Fedora 22

Any ideas?

Thank you.

Ciao,
Gerhard

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1202668

FromGerhard Wiesinger <lists@wiesinger.com>
Date2015-08-07 15:10 +0200
Message-ID<pUPzk-lu-11@gated-at.bofh.it>
In reply to#1201975
On 06.08.2015 20:43, Gerhard Wiesinger wrote:
> Hello,
>
> I'm having the following problem with IPv6 and a private internal LAN 
> which will be masqueraded to the public internet (I don't want to have 
> public IPs in the LAN because of some static IPs and tracking) . Rules 
> are generated by shorewall.
>
> Problem is that ICMP6 packets source address is not translated by the 
> kernel on the reply when MTU has to be discovered because of too big 
> packets and limited MTU capabilities on the path (happens also on tcp6 
> which works thereofore not correctly).
>
> # From an internal host on net fd00:1234:5678::/64
> ping6 -s 2000 2a02:1234:5678:7::2
>
> /etc/shorewall6/masq
> EXT_IF                   fc00::/7
>
> ip6tables rule:
> MASQUERADE  all      *      *       fc00::/7             ::/0
>
> # Internal interface
> IP6 fd00:1234:5678::9 > 2a02:1234:5678:7::2: frag (0|1432) ICMP6, echo 
> request, seq 1, length 1432
> IP6 fd00:1234:5678::9 > 2a02:1234:5678:7::2: frag (1432|576)
> IP6 2a02:1234:5678:9abc::115 > fd00:1234:5678::9: ICMP6, packet too 
> big, mtu 1440, length 1240
>
> # External interface
> IP6 2001:1234:5678:9abc::1 > 2a02:1234:5678:7::2: frag (0|1432) ICMP6, 
> echo request, seq 1, length 1432
> IP6 2001:1234:5678:9abc::1 > 2a02:1234:5678:7::2: frag (1432|576)
> IP6 2a02:1234:5678:9abc::115 > 2001:1234:5678:9abc::1: ICMP6, packet 
> too big, mtu 1440, length 1240
>
> Looks to me like a a major kernel bug.
> Kernel version is: 4.1.3-201.fc22.x86_64 from Fedora 22
>
> Any ideas?
>

Any comments?

Ciao,
Gerhard

--
http://www.wiesinger.com/

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1204452

FromCong Wang <xiyou.wangcong@gmail.com>
Date2015-08-10 19:40 +0200
Message-ID<pVZdf-4Jg-11@gated-at.bofh.it>
In reply to#1202668
(Cc'ing netdev and netfilter-devel)

On Fri, Aug 7, 2015 at 6:00 AM, Gerhard Wiesinger <lists@wiesinger.com> wrote:
> On 06.08.2015 20:43, Gerhard Wiesinger wrote:
>>
>> Hello,
>>
>> I'm having the following problem with IPv6 and a private internal LAN
>> which will be masqueraded to the public internet (I don't want to have
>> public IPs in the LAN because of some static IPs and tracking) . Rules are
>> generated by shorewall.
>>
>> Problem is that ICMP6 packets source address is not translated by the
>> kernel on the reply when MTU has to be discovered because of too big packets
>> and limited MTU capabilities on the path (happens also on tcp6 which works
>> thereofore not correctly).
>>
>> # From an internal host on net fd00:1234:5678::/64
>> ping6 -s 2000 2a02:1234:5678:7::2
>>
>> /etc/shorewall6/masq
>> EXT_IF                   fc00::/7
>>
>> ip6tables rule:
>> MASQUERADE  all      *      *       fc00::/7             ::/0
>>
>> # Internal interface
>> IP6 fd00:1234:5678::9 > 2a02:1234:5678:7::2: frag (0|1432) ICMP6, echo
>> request, seq 1, length 1432
>> IP6 fd00:1234:5678::9 > 2a02:1234:5678:7::2: frag (1432|576)
>> IP6 2a02:1234:5678:9abc::115 > fd00:1234:5678::9: ICMP6, packet too big,
>> mtu 1440, length 1240
>>
>> # External interface
>> IP6 2001:1234:5678:9abc::1 > 2a02:1234:5678:7::2: frag (0|1432) ICMP6,
>> echo request, seq 1, length 1432
>> IP6 2001:1234:5678:9abc::1 > 2a02:1234:5678:7::2: frag (1432|576)
>> IP6 2a02:1234:5678:9abc::115 > 2001:1234:5678:9abc::1: ICMP6, packet too
>> big, mtu 1440, length 1240
>>
>> Looks to me like a a major kernel bug.
>> Kernel version is: 4.1.3-201.fc22.x86_64 from Fedora 22
>>
>> Any ideas?
>>
>
> Any comments?
>
> Ciao,
> Gerhard
>
> --
> http://www.wiesinger.com/
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web