Hello,
I have a problem with Mikrotik router and losing all TCP packets ove OpenVPN connection, but OVPN server is NOT Mikrotik. I try to explain my situation.
Internet -----> RB1200 ----> cisco switch -----> Ubuntu 12.04 LTS server as KVM host
KVM server has configured bridge:
bridge name bridge id STP enabled interfaces
br1 8000.00e04c814d2e no eth1 (interface connected to switch)
tap0 (virtual machine)
tap1 (virtual machine)
OpenVPN server is installed on KVM host with virtual interface tun0 and in sysctl.conf is enabled ipv4 port forward.
And the problem:
from OVPN client connected from internet to OVPN server on KVM host:
- can PING any device on lan
- can make TCP connection to almost all device in lan
- can not make TCP connection to one virtual server on tap0
- can make TCP connection to virtual server on tap1
I tested this in 3 networks with KVM hosts and many virtual machines and if I setup as main router Mikrotik RB is the problem show up. Once I can not make TCP connection to NAS (as a normal network device, not virtual machine. Always same is how a packet flow:
OVPN client → internet → Mikrotik RB → switch → NIC → br1 → tun0 (OVPN server) → br1 → tap0 → eth0 (virtual NIC in virtual machine)
And other update. I try to debug bridge and check network transfer in virtual host and get this:
TEST SSH from VPN client to working virtual guests
IN=tun0 OUT=br1 SRC=10.8.3.6 DST=192.168.3.8 LEN=56 TOS=0x00 PREC=0x00 TTL=63 ID=16872 DF PROTO=TCP SPT=55065 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0
IN=br1 OUT=tun0 PHYSIN=tap5 SRC=192.168.3.8 DST=10.8.3.6 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=22 DPT=55065 WINDOW=0 RES=0x00 ACK RST URGP=0
TEST SSH from VPN client to problem virtual guests
IN=tun0 OUT=br1 SRC=10.8.3.6 DST=192.168.3.251 LEN=56 TOS=0x00 PREC=0x00 TTL=63 ID=32723 DF PROTO=TCP SPT=56350 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0
IN=br1 OUT=br1 PHYSIN=tap0 PHYSOUT=eth1 SRC=192.168.3.251 DST=10.8.3.6 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=22 DPT=56350 WINDOW=0 RES=0x00 ACK RST URGP=0
TEST PING from VPN client to working virtual guest
IN=tun0 OUT=br1 SRC=10.8.3.6 DST=192.168.3.8 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=2025 SEQ=3
IN=br1 OUT=tun0 PHYSIN=tap5 SRC=192.168.3.8 DST=10.8.3.6 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=39056 PROTO=ICMP TYPE=0 CODE=0 ID=2025 SEQ=3
TEST PING from VPN client to problem virtual guest
IN=tun0 OUT=br1 SRC=10.8.3.6 DST=192.168.3.251 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=2017 SEQ=3
IN=br1 OUT=br1 PHYSIN=tap0 PHYSOUT=eth1 SRC=192.168.3.251 DST=10.8.3.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=39097 PROTO=ICMP TYPE=0 CODE=0 ID=2017 SEQ=3
IN=br1 OUT=tun0 PHYSIN=eth1 SRC=192.168.3.251 DST=10.8.3.6 LEN=84 TOS=0x00 PREC=0x00 TTL=62 ID=39097 PROTO=ICMP TYPE=0 CODE=0 ID=2017 SEQ=3
I don’t understand. Please help.