On 05/21/2018 06:12 AM, David Ventura wrote: > I have been setting up VLANs and they mostly work as normal interfaces, > but there's 1 case which I have not been able to work out: > > Linux container on VLAN 20 trying to connect to its host (untagged VLAN). > > If I try to connect directly to the host interface on VLAN20, the packet > never reaches the router (which is normal, as they share a virtual bridge) > > tcpdump on the router during `curl bigserver.labs:8006` on the lxc (this > name resolves to the untagged interface, which is also OK) > > ----- > 15:08:22.697330 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312730089 ecr > 0,nop,wscale 7], length 0 > 15:08:22.697602 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312730089 ecr > 0,nop,wscale 7], length 0 > 15:08:23.706483 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312731098 ecr > 0,nop,wscale 7], length 0 > 15:08:23.706695 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312731098 ecr > 0,nop,wscale 7], length 0 > 15:08:25.722477 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312733114 ecr > 0,nop,wscale 7], length 0 > 15:08:25.722679 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312733114 ecr > 0,nop,wscale 7], length 0 > ----- > > > The `curl` command simply times out as if packets were being dropped, > but I see nothing on the firewall logs on the router. > > My relevant entry on the `rules` file is > > ACCEPT srv:192.168.20.138 loc:192.168.2.10 tcp 8006 > > > What am I doing wrong? To be honest I do not understand what's going on > in the tcpdump, but at least I see a packet going LXC -> host (and > nothing coming back) >
Please forward the output of 'shorewall dump' (as an attachment) collected as described at http://www.shorewall.net/support.htm#Guidelines. Thanks, -Tom -- Tom Eastep \ Q: What do you get when you cross a mobster with Shoreline, \ an international standard? Washington, USA \ A: Someone who makes you an offer you can't http://shorewall.org \ understand \_______________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
