On 08/21/2014 12:52 PM, Gert Doering wrote: > Hi, > > On Thu, Aug 21, 2014 at 05:22:28PM +0100, Ian Brooks wrote: >> I can see the traffic leaving the vm, hitting the internal gateway for the >> bridge, hit the correct tunnel to the destination server and arrive on tun0 >> on the destination server, but for some reason the packets arent then passed >> to the internal bridge network, > > Sounds like linux' rp_filter is biting you "if the packet is not supposed > to go there in the forward way, do not accept it on incoming". > > Look in "sysctl -a" for "rp_filter", set it to "0" for the relevant tun > interfaces.
Disabling rp_filter completely should do it but I'd just want to add that "recent" linux version also allow loose mode rp filtering that seems all indicated for asymmetric routing like this case. https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt: > rp_filter - INTEGER > 0 - No source validation. > 1 - Strict mode as defined in RFC3704 Strict Reverse Path > Each incoming packet is tested against the FIB and if the interface > is not the best reverse path the packet check will fail. > By default failed packets are discarded. > 2 - Loose mode as defined in RFC3704 Loose Reverse Path > Each incoming packet's source address is also tested against the FIB > and if the source address is not reachable via any interface > the packet check will fail. > > Current recommended practice in RFC3704 is to enable strict mode > to prevent IP spoofing from DDos attacks. If using asymmetric routing > or other complicated routing, then loose mode is recommended. Regards, Simon ------------------------------------------------------------------------------ Slashdot TV. Video for Nerds. Stuff that matters. http://tv.slashdot.org/ _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
