<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Le 22/03/12 17:09, Donald Pearson a écrit :
<blockquote
cite="mid:CAC=t97Crqqc-Jj=XNgy685bEAEApcdEVoWUpSAKMa_pfsvbNYA@mail.gmail.com"
type="cite">
<div>Cédric.</div>
<div><br>
</div>
When you say GATE, do you mean "GATE/NAT" or "GATE/PUB" ? <br>
<br>
<div class="gmail_quote">2012/3/22 Cédric Lemarchand <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:cedric.lemarchand@ixblue.com">cedric.lemarchand@ixblue.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"> Le 22/03/12 12:29, Guus
Sliepen a écrit :
<div class="im">
<blockquote type="cite">
<blockquote type="cite">
<pre>Video (V1) <==> Node 1 (N1) <=GATE / NAT=> WWW <=GATE / PUB=> Node 2 (N2)
V1 has fixed public IP in the range of N2, and the ip of GATE has
default gateway.
</pre>
</blockquote>
<pre>Hm, but if you want any host on the internet to be able to reach V1, the
default gateway for V1 should be N2, not GATE.</pre>
</blockquote>
</div>
This is the goal yes.<br>
<br>
"N2" and "GATE PUB" are on the same public range, GATE is
the default gateway for this public subnet, as i try to
extend the ethernet segment of this subnet, V1 should has
this default gateway too, right ?</div>
</blockquote>
<div><br>
</div>
<div>I think you mean "gate/pub" here..</div>
</div>
</blockquote>
Yes.<br>
<blockquote
cite="mid:CAC=t97Crqqc-Jj=XNgy685bEAEApcdEVoWUpSAKMa_pfsvbNYA@mail.gmail.com"
type="cite">
<div class="gmail_quote">
<div><br>
</div>
<div>Only if you want V1 to use gate/pub to reach the internet.
V1 will still need it's own "normal" gateway in order for the
VPN to be established over the internet so you will at least
need a /32 route for N2's IP address to use V1's "normal"
gateway. Unless you have a very good reason, you will also
want V1 to continue to use it's normal gateway to reach other
nodes on the internet. You probably want V1 to use the VPN
only for access to N2's subnet.</div>
</div>
</blockquote>
The VPN is established by N1 via its interface eth0, providing the
ethernet VPN on its interface eth1 (which is bridged with the tinc
interface). V1 only "see" the provided ethernet segment by N1, and
got is interface directly configured with a fixed public IP, and the
default gateway "GATE PUB" (the provider's gateway for this publix
subnet)<br>
<blockquote
cite="mid:CAC=t97Crqqc-Jj=XNgy685bEAEApcdEVoWUpSAKMa_pfsvbNYA@mail.gmail.com"
type="cite">
<div class="gmail_quote">
<div><br>
</div>
<div>So, V1 will have an interface on the same subnet has
gate/nat and it's default gateway will be gate/nat. V1 will
also have a tinc interface on the same subnet as N2. Now,
if you are trying to extend N2's subnet to multiple node's at
V1's physical location, then you will have a 2nd interface on
V1, bridged with the tinc interface, and the bridge interface
(as well as the interfaces of any other nodes in V1's physical
location that you wanted to participate in the VPN) will have
an IP on N2's subnet. <br>
</div>
</div>
</blockquote>
Like i have tried to explain before, the VPN is established by N1,
not V1. V1 has only one interface with the fixed public IP.<br>
<blockquote
cite="mid:CAC=t97Crqqc-Jj=XNgy685bEAEApcdEVoWUpSAKMa_pfsvbNYA@mail.gmail.com"
type="cite">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div class="im">
<blockquote type="cite">
<blockquote type="cite">
<pre>N1 has eth0 on the lan, br0 is a bridge of eth1 (where i want to plug
the video device) and the tinc interface.
N2 has is public IP on br0, which is a bridge of eth0 and the tinc
interface.
</pre>
</blockquote>
<pre>[...]
</pre>
<blockquote type="cite">
<pre>When i try to ping GATE from V1, i can see arp request crossing the VPN
(on both br0 interfaces), packet capture on GATE show the arp reply, but
this arp reply never come back on the bridge br0 of N2. (N2 is using
GATE has default gateway too)
</pre>
</blockquote>
<pre>I think that is normal. The ARP request is a broadcast packet, so you should
see that on all the interfaces. But the ARP reply is a unicast packet, so it is
only sent to V1. The bridge on N1 should therefore not forward it to the VPN
interface, so N2 will never see this ARP reply.</pre>
</blockquote>
</div>
Ok, but the thing is i dont anderstand is even if the ARP
reply is unicast, it should cross the VPN to go back to the
machine that request it ? (i use packet capture on
promiscuous mode on the bridge, so i should see it)</div>
</blockquote>
<div><br>
</div>
<div>Yes you should. <br>
</div>
</div>
</blockquote>
Ok.<br>
<blockquote
cite="mid:CAC=t97Crqqc-Jj=XNgy685bEAEApcdEVoWUpSAKMa_pfsvbNYA@mail.gmail.com"
type="cite">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div class="im"><br>
<blockquote type="cite">
<pre>But you seem to be implying that you cannot ping GATE from V1. It would help if
you could show is the routing tables on V1, N1 and N2, and which IP addresses
V1 and GATE have.</pre>
</blockquote>
</div>
Has i said, V1 is on the same ethernet segment / same subnet
provided by the VPN, so if i am right, routing cannot be a
part of the problem, the only needed routes are local and
default gateway.</div>
</blockquote>
<div><br>
</div>
<div>When everything works, yes. V1 and N2 will "see"
each-other as members of the same LAN, however we're still
doing this over the internet so plenty of routing is still
involved and needs to be correct. :) </div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div class="im"><br>
<blockquote type="cite"> <br>
<fieldset></fieldset>
<br>
<pre>_______________________________________________
tinc mailing list
<a moz-do-not-send="true" href="mailto:tinc@tinc-vpn.org" target="_blank">tinc@tinc-vpn.org</a>
<a moz-do-not-send="true" href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" target="_blank">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a>
</pre>
</blockquote>
<br>
<br>
</div>
<font color="#888888">
<div>-- <br>
<div style="font:bold 13px
Arial;color:#003f80;margin-top:10px">
<div>Cédric Lemarchand</div>
<div style="font-weight:normal;color:#7e7c83">System
& Network Engineer</div>
<div style="margin-top:12px">iXBlue</div>
<div
style="font-weight:normal;font-size:10px;color:#7e7c83">52,
avenue de l'Europe<br>
78160 Marly le Roi<br>
France</div>
<div
style="font-weight:normal;font-size:12px;margin:12px
0 12px 0">Tel. <a moz-do-not-send="true"
href="tel:%2B33%201%2030%2008%2088%2088"
value="+33130088888" target="_blank">+33 1 30 08
88 88</a><br>
Mob. <a moz-do-not-send="true"
href="tel:%2B33%206%2037%2023%2040%2093"
value="+33637234093" target="_blank">+33 6 37 23
40 93</a><br>
Fax <a moz-do-not-send="true"
href="tel:%2B33%201%2030%2008%2088%2000"
value="+33130088800" target="_blank">+33 1 30 08
88 00</a></div>
<div style="margin-bottom:20px"><a
moz-do-not-send="true"
href="http://www.ixblue.com" style="font:normal
12px Arial;color:#003f80" target="_blank">www.ixblue.com</a></div>
</div>
</div>
</font></div>
<br>
_______________________________________________<br>
tinc mailing list<br>
<a moz-do-not-send="true" href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>
<a moz-do-not-send="true"
href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc"
target="_blank">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
<br>
</blockquote>
</div>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
tinc mailing list
<a class="moz-txt-link-abbreviated" href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a>
<a class="moz-txt-link-freetext" href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a>
</pre>
</blockquote>
<br>
<br>
<div class="moz-signature">-- <br>
<div style="font:bold 13px Arial;color:#003F80;margin-top:10px;">
<div>Cédric Lemarchand</div>
<div style="font-weight:normal;color:#7E7C83;">System &
Network Engineer</div>
<div style="margin-top:12px;">iXBlue</div>
<div style="font-weight:normal;font-size:10px;color:#7E7C83">52,
avenue de l'Europe<br>
78160 Marly le Roi<br>
France</div>
<div style="font-weight:normal;font-size:12px;margin:12px 0 12px
0;">Tel. +33 1 30 08 88 88<br>
Mob. +33 6 37 23 40 93<br>
Fax +33 1 30 08 88 00</div>
<div style="margin-bottom:20px;"><a href="http://www.ixblue.com"
style="font:normal 12px Arial;color:#003F80;">www.ixblue.com</a></div>
</div>
</div>
</body>
</html>