From: Florian Westphal <fw@strlen.de>
To: folkert <folkert@vanheusden.com>
Cc: Florian Westphal <fw@strlen.de>, netdev@vger.kernel.org
Subject: Re: masquerading AFTER first packet
Date: Thu, 2 Sep 2021 22:07:36 +0200 [thread overview]
Message-ID: <20210902200736.GB23554@breakpoint.cc> (raw)
In-Reply-To: <20210902174845.GE3350910@belle.intranet.vanheusden.com>
folkert <folkert@vanheusden.com> wrote:
> > You might want to try and disable udp releated offload settings to see
> > if that helps.
>
> If offloading is the problem, wouldn't the first packet fail as well?
No, not necessarily, I recall a bug with fraglist udp where only first
packet in the batch had headers changed.
[..]
> udp 17 119 src=185.243.112.54 dst=37.34.63.177 sport=52775 dport=161 packets=4 bytes=267 src=192.168.4.2 dst=185.243.112.54 sport=161 dport=52775 packets=1 bytes=80 [ASSURED] mark=0 use=1
> udp 17 119 src=185.243.112.54 dst=37.34.63.177 sport=52775 dport=161 packets=5 bytes=334 src=192.168.4.2 dst=185.243.112.54 sport=161 dport=52775 packets=1 bytes=80 [ASSURED] mark=0 use=1
> udp 17 119 src=185.243.112.54 dst=37.34.63.177 sport=52775 dport=161 packets=6 bytes=401 src=192.168.4.2 dst=185.243.112.54 sport=161 dport=52775 packets=1 bytes=80 [ASSURED] mark=0 use=1
> udp 17 119 src=185.243.112.54 dst=37.34.63.177 sport=52775 dport=161 packets=7 bytes=468 src=192.168.4.2 dst=185.243.112.54 sport=161 dport=52775 packets=1 bytes=80 [ASSURED] mark=0 use=1
> udp 17 118 src=185.243.112.54 dst=37.34.63.177 sport=52775 dport=161 packets=7 bytes=468 src=192.168.4.2 dst=185.243.112.54 sport=161 dport=52775 packets=1 bytes=80 [ASSURED] mark=0 use=1
> ...
>
> So yes, increating packet/byte counters.
[..]
> [Thu Sep 2 19:40:54 2021] nf_ct_proto_17: bad checksum IN= OUT= SRC=192.168.4.2 DST=185.243.112.54 LEN=82 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=161 DPT=56523 LEN=61
So reverse direction packets are deemed invalid and are thus not reverse-translated.
This is a bug, but not sure where. What driver/nic is feeding these
packets to stack?
sysctl net.netfilter.nf_conntrack_checksum=0
should make things "work".
next prev parent reply other threads:[~2021-09-02 20:07 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-01 20:42 masquerading AFTER first packet folkert
2021-09-02 16:26 ` Florian Westphal
2021-09-02 17:48 ` folkert
2021-09-02 20:07 ` Florian Westphal [this message]
2021-09-02 20:54 ` folkert
2021-09-05 8:39 ` folkert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210902200736.GB23554@breakpoint.cc \
--to=fw@strlen.de \
--cc=folkert@vanheusden.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).