<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr">Le mar. 15 janv. 2019 à 03:13, Lars Kruse <<a href="mailto:lists@sumpfralle.de">lists@sumpfralle.de</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello Julien,<br>
<br>
<br>
Am Mon, 14 Jan 2019 22:15:47 +0100<br>
schrieb Julien dupont <<a href="mailto:marcelvierzon@gmail.com" target="_blank">marcelvierzon@gmail.com</a>>:<br>
<br>
<br>
> ** Test 1 **<br>
> On VPN_office I use 'tcpdump -npi any icmp and host 192.168.1.3'<br>
> When pinging 192.168.1.1 from client 1, with no success, I see no packet<br>
> passing.<br>
<br>
Sorry - the tcpdump command should end with "192.168.1.1" instead of<br>
"192.168.1.3".<br>
(everything following "any" is a filter for the interesting traffic)<br>
<br></blockquote><div><br></div><div>Yes obviously. </div><div>In that case I see:</div><div>IP 172.16.0.3 > <a href="http://192.168.1.1">192.168.1.1</a>: ICMP echo request, id2135, seq1, length 64</div><div>IP 172.16.0.3 > <a href="http://192.168.1.1">192.168.1.1</a>: ICMP echo request, id2135, seq2, length 64</div><div>IP 172.16.0.3 > <a href="http://192.168.1.1">192.168.1.1</a>: ICMP echo request, id2135, seq3, length 64</div><div class="gmail_quote"><br></div><div class="gmail_quote">Packet goes through but no PONG back if I understand correctly. That's probably where it goes wrong.</div><br class="gmail-Apple-interchange-newline"><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
> When pinging 192.168.1.3 from client 1, with success, I see packet passing:<br>
> IP 172.16.0.3 > <a href="http://192.168.1.3" rel="noreferrer" target="_blank">192.168.1.3</a>: ICMP echo request, id 2648, seq 23, length 64<br>
> IP 192.168.1.3 > <a href="http://172.16.0.3" rel="noreferrer" target="_blank">172.16.0.3</a>: ICMP echo request, id 2648, seq 23, length 64<br>
> ...<br>
<br>
OK. As you said, this works.<br>
<br>
<br>
> ** Test 2 *<br>
> I use a machine from the office LAN with IP 192.168.1.100 to ping<br>
> VPN_office (172.16.0.2), VPN_out (172.16.0.1) and VPN_client (172.16.0.3) -<br>
> I can't access the router right now. They all work. Here is the output of<br>
> VPN_client:<br>
> > ping 172.16.0.3 <br>
> PING 172.16.0.3 (172.16.0.3) 56(84) bytes of data.<br>
> From 192.168.1.1 icmp_seq=2 Redirect Host (New nexthop: 192.168.1.3)<br>
> From <a href="http://192.168.1.1" rel="noreferrer" target="_blank">192.168.1.1</a>: icmp_seq=2 Redirect Host (New nexthop: 192.168.1.3)<br>
> ...<br>
> <br>
> This is the result of the traffic redirection rule I put in the router.<br>
<br>
OK. So the route is properly configured on your router.<br>
<br>
Now you should check whether such a ping results in the expected traffic.<br>
E.g. you could execute "tcpdump -npi any icmp" on 192.168.1.3. Here you should<br>
see incoming packets from 192.168.1.100 and (a few milliseconds later) forwarded<br>
packets towards the VPN. If this works, then you could check, whether the<br>
forwarded traffic really goes into the tinc VPN<br>
(e.g. "tcpdump -npi YOUR_TINC_INTERFACE icmp").<br>
If everything goes well, then you can check, whether your tinc node on the<br>
other side also sees the expected traffic (using tcpdump on "any" interface<br>
again): incoming as well as forwarded. Play around with the selected network<br>
interface for tcpdump on different hosts until you understand, where your<br>
packets get lost.<br>
<br></blockquote><div><br></div><div>On VPN_office 'tcdump -npi any icmp', on 192.168.1.100 'ping 172.16.0.3':</div><div>192.168.1.100 > <a href="http://172.16.0.3">172.16.0.3</a>: ICMP echo request, id 11452, seq1, length 64</div><div><div>192.168.1.100 > <a href="http://172.16.0.3">172.16.0.3</a>: ICMP echo request, id 11452, seq2, length 64</div><div>192.168.1.100 > <a href="http://172.16.0.3">172.16.0.3</a>: ICMP echo request, id 11452, seq3, length 64</div>...</div><div><br></div><div>Does that mean there is no PONG back?</div><div><br></div><div><div>On VPN_office 'tcdump -npi any icmp', on 192.168.1.100 'ping 172.16.0.2' (VPN_office):</div><div><div>192.168.1.100 > <a href="http://172.16.0.2">172.16.0.2</a>: ICMP echo request, id 40111, seq1, length 64</div><div>172.16.0.2 > <a href="http://192.168.1.100">192.168.1.100</a>: ICMP echo reply, id 40111, seq1, length 64</div><br class="gmail-Apple-interchange-newline"></div></div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Happy packet hunting!<br>
<br>
Cheers,<br>
Lars<br>
<br>
PS: currently you are using the two of the most popular private IP ranges<br>
(<a href="http://172.16.0.0/24" rel="noreferrer" target="_blank">172.16.0.0/24</a> and <a href="http://192.168.1.0/24" rel="noreferrer" target="_blank">192.168.1.0/24</a>) for your two networks. This will inevitably<br>
cause problems as soon as people want to work within these networks from home<br>
(e.g. via a VPN). Maybe this is the right time to change these subnets into<br>
something less widely used?<br>
_______________________________________________<br>
tinc mailing list<br>
<a href="mailto:tinc@tinc-vpn.org" target="_blank">tinc@tinc-vpn.org</a><br>
<a href="https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" rel="noreferrer" target="_blank">https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
</blockquote></div></div>