GreenVine's questions

I'm setting up TPROXY on my VyOS router to forward certain traffic to a local transparent proxy. It works pretty well, until I discovered that all of my DNAT port forwarding rules are no longer working (connection timeout when connecting from external network).

Environment

• Router: 10.0.0.1/24 (Proxy is running on 1234 port and adding SO_MARK with 0xff)
• Internal Host: 10.0.0.2/24 (Port 80 should be exposed to the public)

TPROXY Rules

ip rule add fwmark 1 table 100
ip route add local 0.0.0.0/0 dev lo table 100

nft add table myproxy
nft add chain myproxy prerouting { type filter hook prerouting priority 0 \; }
nft add rule myproxy prerouting ip daddr { 127.0.0.1/32, 224.0.0.0/4, 255.255.255.255/32 } return
nft add rule myproxy prerouting meta l4proto tcp ip daddr 10.0.0.0/24 return
nft add rule myproxy prerouting mark 0xff return
nft add rule myproxy prerouting meta l4proto { tcp, udp } mark set 1 tproxy to 127.0.0.1:1234 accept

nft add chain myproxy output { type route hook output priority 0 \; }
nft add rule myproxy output ip daddr { 127.0.0.1/32, 224.0.0.0/4, 255.255.255.255/32 } return
nft add rule myproxy output meta l4proto tcp ip daddr 10.0.0.0/24 return
nft add rule myproxy output mark 0xff return
nft add rule myproxy output meta l4proto { tcp, udp } mark set 1 accept

nft add table filter
nft add chain filter divert { type filter hook prerouting priority -150 \; }
nft add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept

DNAT Rules

$ nft list table nat

table ip nat {
    chain PREROUTING {
        type nat hook prerouting priority dstnat; policy accept;
        iifname "pppoe0" tcp dport { 8080 } counter packets 7 bytes 400 dnat to 10.0.0.2:80
    }
}

Symptoms

Connecting RouterPublicIP:8080 is timing out. Ideally it should forward traffic to 10.0.0.2:80.

I guess inbound DNAT traffic is erroneously forwarded to the proxy (instead of the actual host 10.0.0.2), however I couldn't figure out the correct nft rules.

Thanks in advance!

I'm trying to set up a Ubuntu-based gateway between clients and the core router, the ideal traffic flow should be:

ClientGroup 1 (10.0.0.0/24) -> Ubuntu gateway (10.0.0.2) -> Core router (10.0.0.1) -> Internet

ClientGroup 2 (10.0.1.0/24) -> Ubuntu gateway (10.0.1.2) -> Core router (10.0.1.1) -> Internet

ClientGroup 3 (10.0.2.0/24) -> Ubuntu gateway (10.0.2.2) -> Core router (10.0.2.1) -> Internet

Clients use Ubuntu instance as their gateway.

The following netplan configuration routes internal traffic properly, however for Internet traffic, it defaults to eth0.1 (10.0.1.1) because of gateway4.

network:
    version: 2
    ethernets:
        eth0:
            addresses: [10.0.0.2/24]
            routes:
                - to: 10.0.0.0/24
                  via: 10.0.0.1
                  table: 101
            routing-policy:
                - from: 10.0.0.0/24
                  table: 101
            dhcp4: false

    vlans:
        eth0.1:
            id: 1
            link: eth0
            addresses: [10.0.1.2/24]
            gateway4: 10.0.1.1
            routes:
                - to: 10.0.1.0/24
                  via: 10.0.1.1
                  table: 102
            routing-policy:
                - from: 10.0.1.0/24
                  table: 102
            dhcp4: false


        eth0.2:
            id: 2
            link: eth0
            addresses: [10.0.2.2/24]
            routes:
                - to: 10.0.2.0/24
                  via: 10.0.2.1
                  table: 103
            routing-policy:
                - from: 10.0.2.0/24
                  table: 103
            dhcp4: false

Any ideas on how to route all traffic to its corresponding next-hop on the core router? Namely, all traffic (0.0.0.0/0) from 10.0.0.0/24 should be routed to 10.0.0.1 whereas 10.0.2.0/24 should be routed to 10.0.2.1.

I'm happy to use plain ip route rules as well.

Thanks in advance!

Edit 13/05/20:

I have added a default route to each routes, the routing is working as expected but traceroute output seems weird:

routes:
  - to: 0.0.0.0/0
    via: 10.0.0.1
    table: 101

1st test:

traceroute to 1.1.1.1 (1.1.1.1), 64 hops max, 52 byte packets
 1  10.0.0.2 (10.0.0.2)  0.896 ms * *
 2  10.0.0.1 (10.0.0.1)  1.361 ms  1.126 ms  0.879 ms

2nd test:

traceroute to 1.1.1.1 (1.1.1.1), 64 hops max, 52 byte packets
 1  * * *
 2  10.0.0.1 (10.0.0.1)  1.353 ms  1.062 ms  0.825 ms