pppoe with NAT not working

pppoe with NAT not working

[Sébastien Bernard]

Hi,
I got a real big headache.

My DSL provider a few ago upgraded my line and for this changed the BAS my
box used to connect with.

I had to reconfigure the ppp configuration.
Before, I was using :
pty "/usr/sbin/pppoe -I eth0 -T 80 -m 1452"
It ceased working.

The new configuration is using the rp-pppoe.so plugin as :
plugin /usr/lib/pppd/2.4.3/rp-pppoe.so

Since this modification, I'm not able to do any NAT or MASQUERADE with my
gateway.
My network architecture is :

Private lan (192.168.x.x) => GW (public fixed address) => DSl Modem =>
Internet

When any machine on the private LAN try make a connection to an outside
address, the connection made is ok.

The three-way handshake is OK with the packets correctly NATED.

When the outside peer tries to send data to the internal peer, the Gateway
sends a reset back to it without breaking the connection inside of course.

It looks like the netfilters didn't accept the incoming packets with
payload as part of the nated connection.

I had a look to the ip_conntrak connection and the faulty connection is
correctly tracked, with an entry.

I don't really understand what is happenning.

The configuration is nothing special and could resumed as :
iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to-source <public address>

This was working before and I didn't touch anything to the configuration
but the public address that changed when I moved to a speedier DSL line.

If anyone could propose an explaination ...

  Seb

Re: pppoe with NAT not working

[Sébastien Bernard]

Sébastien Bernard a écrit :

>Hi,
>I got a real big headache.
>
>My DSL provider a few ago upgraded my line and for this changed the BAS my
>box used to connect with.
>
>I had to reconfigure the ppp configuration.
>Before, I was using :
>pty "/usr/sbin/pppoe -I eth0 -T 80 -m 1452"
>It ceased working.
>
>The new configuration is using the rp-pppoe.so plugin as :
>plugin /usr/lib/pppd/2.4.3/rp-pppoe.so
>
>Since this modification, I'm not able to do any NAT or MASQUERADE with my
>gateway.
>My network architecture is :
>
>Private lan (192.168.x.x) => GW (public fixed address) => DSl Modem =>
>Internet
>
>When any machine on the private LAN try make a connection to an outside
>address, the connection made is ok.
>
>The three-way handshake is OK with the packets correctly NATED.
>
>When the outside peer tries to send data to the internal peer, the Gateway
>sends a reset back to it without breaking the connection inside of course.
>
>It looks like the netfilters didn't accept the incoming packets with
>payload as part of the nated connection.
>
>I had a look to the ip_conntrak connection and the faulty connection is
>correctly tracked, with an entry.
>
>I don't really understand what is happenning.
>
>The configuration is nothing special and could resumed as :
>iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to-source <public address>
>
>This was working before and I didn't touch anything to the configuration
>but the public address that changed when I moved to a speedier DSL line.
>
>If anyone could propose an explaination ...
>
>  Seb
>  
>
I figured out the problem.

NAT is not working with the rp-pppoe.so plugin.
I moved back to the

pty "/usr/sbin/pppoe -I eth0 -T 80 -m 1452"

Which worked now (go figure...).
And NAT is working again.

Any reason for this ?

Re: pppoe with NAT not working

[Sven Schuster]

[-- Attachment #1: Type: text/plain, Size: 810 bytes --]


Hi Sébastien,

On Fri, Oct 21, 2005 at 07:13:11PM +0200, Sébastien Bernard told us:
> I figured out the problem.
> 
> NAT is not working with the rp-pppoe.so plugin.
> I moved back to the
> 
> pty "/usr/sbin/pppoe -I eth0 -T 80 -m 1452"
> 
> Which worked now (go figure...).
> And NAT is working again.
> 
> Any reason for this ?

sorry, I don't know the reason, but the only thing I can say here is
"works for me" and has been working for the last 2 1/2 years, at first
on redhat 9, now I currently have fedora core 4 on my home internet
machine with two other machines on my internal network...


Sven

-- 
Linux zion.homelinux.com 2.6.14-rc4-mm1_11 #11 Tue Oct 18 13:24:39 CEST 2005 i686 athlon i386 GNU/Linux
 20:43:32 up 2 days, 20:28,  1 user,  load average: 0.05, 0.03, 0.00

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: pppoe with NAT not working

[Patrick McHardy]

Sébastien Bernard wrote:

> I figured out the problem.
> 
> NAT is not working with the rp-pppoe.so plugin.
> I moved back to the
> 
> pty "/usr/sbin/pppoe -I eth0 -T 80 -m 1452"
> 
> Which worked now (go figure...).
> And NAT is working again.
> 
> Any reason for this ?

We had a report about NAT failing to work in a similar situation
with HW checksums, but I couldn't find the reason. You could try:

- check if you have HW checksums enabled on the eth-device using
   ethtool
- enable conntrack logging by loading ipt_LOG and executing
   "echo 255 >/proc/sys/net/ipv4/netfilter/ip_conntrack_log_invalid".
- if this shows something about invalid checksums, disable HW
   checksumming on the eth-device and try again