Hello, I have a rather complicated need to use a gre tunnel and I am having difficulty getting it working. The tunnel is between my home server and Oracle VM. Below is a picture of the topology with config.

Pings between the home server and Oracle VM over the gre tunnel do not seem to be going through as evidenced by tcpdump. I do notice however that the firewall has the correct state table showing that address translation. I am certain that both machines’ firewalls are not dropping packets because iptables is not showing anything dropped. I am at a loss here so I welcome any ideas.

    • Parodper@foros.fediverso.gal
      link
      fedilink
      arrow-up
      2
      ·
      edit-2
      1 år siden

      I believe OP has made some mistakes when pasting the text


      [Diagram]
      Oracle VM: Linux
      External IP: 192.0.2.1
      Internal IP: 172.16.0.2
       |
       | GRE Tunnel
       v
      Home Server: Linux
      Internal IP: 172.16.0.2
       |
       |
       v
      Firewall: FreeBSD
      Internal IP: 172.16.0.1
      External IP: 192.0.2.2
      
      [Text]
      Home Linux Server GRE config:
      $ sudo ip tunnel add gre0 mode gre remote 172.16.0.2 local 192.0.2.1 ttl 255
      $ sudo ip link set gre0 up
      $ sudo ip addr add 10.100.10.1/24 dev gre0
      
      
      Home Linux Server GRE config:
      $ sudo ip tunnel add gre0 mode gre remote 192.0.2.2 local 192.0.2.1 ttl 255
      $ sudo ip link set gre0 up
      $ sudo ip addr add 10.100.10.1/24 dev gre0
      
      Firewall:
      nat on igb1 inet from ! (igb1) to any -> (igb1:0)
      nat on igb0 inet proto gre from 172.16.0.2 to any -> (igb1:0)
      rdr pass on igb1 inet proto gre from 141.148.84.178 to (igb1) -> 172.16.0.2
      
      • tla@sopuli.xyz
        link
        fedilink
        arrow-up
        1
        ·
        1 år siden

        gre implies you want to run dynamic routing over the tunnel but no routing is configured? If you don’t need dynamic routing (why would you on a P2P tunnel?) but do want privacy then use IPsec or SSH instead?