sebastien dontneedtoknowthat's questions

I need to create VXLAN connections between two computers A (on Debian with IP 192.168.30.1) and B (on archlinux with IP 192.168.30.3) For that, I did:

• On A:

  sudo ip link add vxlan1 type vxlan id 1 nolearning remote 192.168.30.3 dstport 33333 dev ens4
  sudo ip link set vxlan1 up
  sudo ip addr add 10.0.0.106/24 dev vxlan1

• On B:

  sudo ip link add vxlan2 type vxlan id 1 nolearning remote 111.111.111.111 dstport 33333 dev ens3
  sudo ip link set vxlan2 up
  sudo ip addr add 10.0.0.107/24 dev vxlan2

Moreover, on PC B I create a DNAT rule:

  sudo iptables -w -t nat -A OUTPUT -s 192.168.30.3 -d 111.111.111.111 -p udp --dport 33333 -j DNAT --to-destination 192.168.30.1:33333

Then I did:

• On PC A: ping 10.0.0.107. This works as expected with ping replies.
• On PC B: ping 10.0.0.106. This works as expected with ping replies.
• On PC A: nc -u -lp 12345. On PC B: nc -u 10.0.0.106 12345. I expected to read data on the netcat application on PC A when sending data with the netcat command from PC B. However I read nothing.

My problem is then at the last point. Why my netcat listener does not receive anything. By using wireshark on PC A I get:

[

Some extra information

• PC A runs with 'Linux debian 4.19.0-16-amd64 #1 SMP Debian 4.19.181-1 (2021-03-19) x86_64 GNU/Linux' (this is the result of uname -a command)

• PC A IP on ens4 is 192.168.30.1/24

• PC B runs with 'Linux archlinux 5.13.9-arch1-1 #1 SMP PREEMPT Sun, 08 Aug 2021 11:25:35 +0000 x86_64 GNU/Linux' (this is the result of uname -a command)

• PC B IP on ens3 is 192.168.30.3/24

• the two machines are Qemu VMs started with GNS3

• nat and filter tables of netfilter on PC A is empty:

seb@debian:~$ sudo iptables -t nat -L ; sudo iptables -t filter -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination    

• On PC B I only have the DNAT rule and a rule to drop ICMP packet of type 'port unreachable' (This is a rule I added for another purpose):

[seb@archlinux vxlan]$ sudo iptables -t nat -L -n ; sudo iptables -t filter -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DNAT       udp  --  192.168.30.3         111.111.111.111      udp dpt:33333 to:192.168.30.1:33333

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 3

I observed that netfilter changes the source port when a connection is established in the conntrack module. I need to prevent this behavior.

Here is what I have done to reproduce my problem:

1. I create a netfilter rule that will perform DNAT from port 2002 to 2003

sudo iptables -w -t nat -A OUTPUT -s 192.168.30.3 -d 192.168.30.1 -p udp --sport 2001 --dport 2002 -j DNAT --to-destination :2003

2. I then create a conntrack entry to simulate a connection from 192.168.30.1:2001 (My computer) to 192.168.30.1:2003

sudo /sbin/conntrack -I -s 192.168.30.1 -d 192.168.30.3 -p udp --sport 2003 --dport 2001 --timeout 100000

3. Eventually, I perform a connection to 192.168.30.1:2002 from my computer with source port 2001:

sudo nc -u -p 2001 192.168.30.1 2002

Due to the netfilter DNAT rule, I expected an output packet with destination port 2003 and source port 2001. However, on wireshark I observed the source port changed to a random number. I guess this is because my computer considers that there is an existing connection on port 2001 (due to the conntrack entry) and then prevents the source port to be 2001 (right?). But I don't want this behavior? How can I force the use of the port number 2001?

I observed a weird behaviour on linux:

First, I clean all routes and iptables rules:

ip route flush table main
ip route flush table default
ip route flush table local
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X
ip6tables -P INPUT ACCEPT
ip6tables -P FORWARD ACCEPT
ip6tables -P OUTPUT ACCEPT
ip6tables -t nat -F
ip6tables -t mangle -F
ip6tables -F
ip6tables -X

Then I add a local route:

ip route add local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1 table local

Then, on a terminal I open a port with nc -lp 12345 and on another terminal I connect to it with nc 127.0.0.1 12345 and I can send and receive data between the netcat server and client. So for now, all is good.

Now, from it and after killing the previous netcat server and client, if I run:

iptables -t nat -A POSTROUTING -j MASQUERADE

and I restart the netcat server, then the client fail to connect. Do you know why?

I notice that adding ip route add local 192.168.0.10 dev wlan0 proto kernel scope host src 192.168.0.10 table local make the netcat connection works again. However, I don't understand why the wlan0 interface (that has 192.168.0.10 as IP) can influence the loopback interface?

For information, I am using ArchLinux