Hi Michael,
testing your setup I stumbled over a checksum calculation issue,
see "[PATCH] netfilter: fix IPv6 NTP checksum calculation".
But since you see the echo reply packet, you most likely not
hitting this issue.
On my system I needed to enable IPv6 neighbor proxy:
sysctl -w net.ipv6.conf.all.proxy_ndp=1
ip -6 neigh add proxy 2001:xxxx:xxxx:xxxx:a27d::5 dev eth0
Note: you have to add one "ip -6 neigh add proxy" entry for
each NATed IPv6 address. There is no way to add ranges.
Blame the IPv6 neighbor discovery multicast groups for that...
Also note that NTP will NOT modify the payload as normal NAT does.
ICMPv6 error handling, e.g. Packet Too Big, might fail therefore.
Cheers
Ulrich
On 12/30/12 11:37, Michael Ludvig wrote:
On 22/12/12 04:00, Ulrich Weber wrote:
NAT table is only called once for each connection.
Since you use stateless NAT better use the mangle table.
Hi Ulrich
thanks for the suggestion. I made the change and now all the pings are
translated, however I struggle with the ping replies reaching my VM.
What I now have:
ip6tables -t mangle -I POSTROUTING -s fd00::/64 \! -o vboxnet0 \
-j SNPT --src-pfx fd00::/64 --dst-pfx 2001:e20:2000:40f::/64
ip6tables -t mangle -I PREROUTING -i wlan0 -d 2001:e20:2000:40f::/64 \
-j DNPT --src-pfx 2001:e20:2000:40f::/64 --dst-pfx fd00::/64
And also these sysctl settings:
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.all.accept_ra = 2
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.default.accept_ra = 2
Now the ping goes to google and back...
23:18:01.915631 IP6 2001:e20:2000:40f:b5d0:27ff:feec:3987 >
2404:6800:4006:804::1012: ICMP6, echo request, seq 1, length 64
23:18:01.954867 IP6 2404:6800:4006:804::1012 >
2001:e20:2000:40f:b5d0:27ff:feec:3987: ICMP6, echo reply, seq 1, length 64
... but my laptop (the gateway) rejects it:
23:18:04.961643 IP6 2001:e20:2000:401:a11:ff:fe04:50cd >
2404:6800:4006:804::1012: ICMP6, destination unreachable, unreachable
address fd00::b00:27ff:feec:3987, length 112
This is from the external wlan0 (wifi) interface. Nothing with regards
to the reply appears on the internal vboxnet0 interface.
What am I doing wrong?
Thanks!
Michael
Cheers
Ulrich
On 12/19/12 13:07, Michael Ludvig wrote:
Hi guys
I did some experimenting with the new NAT support for IPv6 and was quite
impressed how smoothly MASQUERADE and SNAT work.
However I didn't have any success with IPv6 SNPT. As I understand it
SNPT is meant for 1:1 address translation and should simply replace src
prefix with dst prefix.
For testing I use fd00::/64 address range in my VirtualBox network with
SLAAC addresses.
ip6tables -t nat -I POSTROUTING -s fd00::/64 \
-j SNPT --src-pfx fd00::/64 --dst-pfx 2001:e20:2000:xx::/64
The strange thing is that only the first ping6 packet to google is
translated, the subsequent ones on the external interface are still in
fd00::/64:
Seq 1 - translated:
00:49:25.699206 IP6 2001:e20:2000:xx:b5d0:27ff:feec:3987 > \
2404:6800:4006:804::1017: ICMP6, echo request, seq 1, length 64
Seq 2&3 - untranslated source:
00:49:26.699498 IP6 fd00::a00:27ff:feec:3987 > \
2404:6800:4006:804::1017: ICMP6, echo request, seq 2, length 64
00:49:27.699436 IP6 fd00::a00:27ff:feec:3987 > \
2404:6800:4006:804::1017: ICMP6, echo request, seq 3, length 64
Once I remove the SNPT rule and replace it with a simple -j MASQUERADE
it begins to work. Forwarding is obviously enabled and no other firewall
rules are in place (neither in 'nat' table nor elsewhere). My kernel is
3.7.0-rc8, iptables from the current git checkout.
What am I doing wrong?
Thanks!
Michael
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Ulrich Weber | ulrich.weber@xxxxxxxxxx | Senior Software Engineer
Astaro - a Sophos company | Amalienbadstr 41 | 76227 Karlsruhe | Germany
Phone +49-721-25516-0 | Fax –200 | www.astaro.com
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
