Whoops! You'll find the dump attached. I'll re-state my issue because I feel I was not clear enough on my previous post:
192.168.20.138 (container) -> 192.168.20.10 (host) works OK via the linux virtual bridge, never reaches the router. 192.168.20.138 (container) -> 192.168.2.10 (host, different interface) is 'dropped' (no rejection, just timeout) The rules and tcpdump above are on the "failing" case. David On 21 May 2018 at 17:00, Tom Eastep <teas...@shorewall.net> wrote: > On 05/21/2018 06:12 AM, David Ventura wrote: > > I have been setting up VLANs and they mostly work as normal interfaces, > > but there's 1 case which I have not been able to work out: > > > > Linux container on VLAN 20 trying to connect to its host (untagged VLAN). > > > > If I try to connect directly to the host interface on VLAN20, the packet > > never reaches the router (which is normal, as they share a virtual > bridge) > > > > tcpdump on the router during `curl bigserver.labs:8006` on the lxc (this > > name resolves to the untagged interface, which is also OK) > > > > ----- > > 15:08:22.697330 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312730089 ecr > > 0,nop,wscale 7], length 0 > > 15:08:22.697602 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312730089 ecr > > 0,nop,wscale 7], length 0 > > 15:08:23.706483 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312731098 ecr > > 0,nop,wscale 7], length 0 > > 15:08:23.706695 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312731098 ecr > > 0,nop,wscale 7], length 0 > > 15:08:25.722477 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312733114 ecr > > 0,nop,wscale 7], length 0 > > 15:08:25.722679 IP rproxy1.labs.55438 > bigserver.8006: Flags [S], seq > > 20900995, win 29200, options [mss 1460,sackOK,TS val 1312733114 ecr > > 0,nop,wscale 7], length 0 > > ----- > > > > > > The `curl` command simply times out as if packets were being dropped, > > but I see nothing on the firewall logs on the router. > > > > My relevant entry on the `rules` file is > > > > ACCEPT srv:192.168.20.138 loc:192.168.2.10 tcp 8006 > > > > > > What am I doing wrong? To be honest I do not understand what's going on > > in the tcpdump, but at least I see a packet going LXC -> host (and > > nothing coming back) > > > > Please forward the output of 'shorewall dump' (as an attachment) > collected as described at http://www.shorewall.net/support.htm#Guidelines. > > Thanks, > -Tom > -- > Tom Eastep \ Q: What do you get when you cross a mobster with > Shoreline, \ an international standard? > Washington, USA \ A: Someone who makes you an offer you can't > http://shorewall.org \ understand > \_______________________________________________ > > > ------------------------------------------------------------ > ------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Shorewall-users mailing list > Shorewall-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/shorewall-users > > -- *Stack* is the new term for "I have no idea what I'm actually using".
shorewall_dump.txt.gz
Description: application/gzip
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
