|
Ticket ID: SIXXS #847425 Ticket Status: Resolved PoP: simbx01 - Amis (Maribor)
Cant get tru NAT with ayiya
![[hu]](/s/countries/hu.gif) Shadow Hawkins on Wednesday, 12 November 2008 21:25:31
I have read and followed the "Reporting Problems" section on the Contact page and am providing the following details for this report based on the list of items stated there:
Tunnel Information for T17947:
POP Id : simbx01
IPv6 Local : 2001:15c0:65ff:1ca::2/64
IPv6 Remote : 2001:15c0:65ff:1ca::1/64
Tunnel Type : ayiya
Adminstate : enabled
Userstate : enabled
I previously registered the tunnel with fix IPv4 but because it didn't worked and i got an advice on freenode#ipv6, i changed to ayiya, but no luck and points lost, my fault.
i cannot ping6 the Remote endpoint, aiccu test fails also at that.
route -6 -n:
Kernel IPv6 routing table
Destination Next Hop Flags Metric Ref Use Iface
::1/128 :: U 0 23 3 lo
2001:15c0:65ff:1ca::2/128 :: U 0 101 1 lo
2001:15c0:65ff:1ca::/64 :: U 256 42 0 sixxs
fe80::5062:7941/128 :: U 0 0 1 lo
fe80::218:f3ff:fe0a:3cef/128 :: U 0 0 1 lo
fe80::218:f3ff:fe0a:3cef/128 :: U 0 0 1 lo
fe80::2ff:4fff:fe1a:117a/128 :: U 0 0 1 lo
fe80::/64 :: U 256 0 0 eth0
fe80::/64 :: U 256 0 0 br0
fe80::/64 :: U 256 0 0 vbox0
fe80::/64 :: U 256 0 0 sixxs
ff00::/8 :: U 256 0 0 eth0
ff00::/8 :: U 256 0 0 br0
ff00::/8 :: U 256 0 0 vbox0
ff00::/8 :: U 256 0 0 sixxs
::/0 2001:15c0:65ff:1ca::1 UG 1024 11 0 sixxs
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 br0
0.0.0.0 192.168.3.1 0.0.0.0 UG 100 0 0 br0
Relevant iptables on my NAT box:
iptables -t nat -A PREROUTING -i $WANIF -p 41 -s 212.18.63.73 -j DNAT --to 192.168.3.70
iptables -A FORWARD -i $WANIF -p 41 -d 192.168.3.70 -j ACCEPT
iptables -t nat -A POSTROUTING -o $WANIF -j SNAT --to 80.98.121.65
Packets tcpdumped om my box show echo requests but no incoming packets, on the nat box i dont see my outbound ipv6 traffic. On the nat box i see incoming ipv6 traffic directed to my box.
Since i want to test client side, i dont want to install aiccu on my nat box.
Any help is appreciated because i'm a newbie.
Cant get tru NAT with ayiya
Shadow Hawkins on Wednesday, 12 November 2008 21:27:45
Extra information: i use br0 on this box instead of eth0 because i use VirtualBox on my PC, both NAT and PC are ubuntu linux.
Cant get tru NAT with ayiya
And how does this environment really hook up and how does it affect the networking?
Cant get tru NAT with ayiya
Shadow Hawkins on Thursday, 13 November 2008 08:48:57
Thank you for the ideas, this was indeed a looser-user problem, i already had the right udp port forwarded to my box, but those lines were missing from my report.
Now i disabled proto 41 forwarding, left only the upd forward and played with killink aiccu, which suddenly stopped working (test didnt run), and somewhere it begun working.
Ticket can be closed.
Now on to testing.
Thanks
Greg
Cant get tru NAT with ayiya
You don't even have to forward the UDP port, it just has to be masqueraded (NATted) properly. When the packet gets send from your host behind the NAT, state will be created in your NAT box so that the source-ip/source-port/dest-ip/dest-port combination gets forwarded to your host; as the PoP returns it to the correct source port it will nicely go to your host.
State change: user
The state of this ticket has been changed to user
Cant get tru NAT with ayiya
Relevant iptables on my NAT box: iptables -t nat -A PREROUTING -i $WANIF -p 41 -s 212.18.63.73 -j DNAT --to 192.168.3.70 iptables -A FORWARD -i $WANIF -p 41 -d 192.168.3.70 -j ACCEPT
AYIYA is not protocol 41, it is UDP based port 5072, also see the Firewall FAQ.
iptables -t nat -A POSTROUTING -o $WANIF -j SNAT --to 80.98.121.65
This is a normal NAT entry, that is the only one you would possibly need.
Now you have to verify the rest of your firewall rules if it actually allows through port 5072 to your internal host.
For the rest, read the rest of the "Reporting Problems" section and provide the requested information.
State change: resolved
The state of this ticket has been changed to resolved
|
![[ch]](/s/countries/ch.gif)
on Wednesday, 12 November 2008 23:55:57
Posting is only allowed when you are