Ygtjki

Im going to France and my passport expires June 19th

Why didn't Miles's spider sense work before?

I would say: "You are another teacher", but she is a woman and I am a man

Ambiguity in the definition of entropy

How much of data wrangling is a data scientist's job?

Would Slavery Reparations be considered Bills of Attainder and hence Illegal?

Why didn't Boeing produce its own regional jet?

Alternative to sending password over mail?

Can my sorcerer use a spellbook only to collect spells and scribe scrolls, not cast?

Why would the Red Woman birth a shadow if she worshipped the Lord of the Light?

What killed these X2 caps?

Plagiarism or not?

Why doesn't using multiple commands with a || or && conditional work?

Why no variance term in Bayesian logistic regression?

Do UK voters know if their MP will be the Speaker of the House?

Should I cover my bicycle overnight while bikepacking?

iPad being using in wall mount battery swollen

Size of subfigure fitting its content (tikzpicture)

Personal Teleportation: From Rags to Riches

Intersection Puzzle

CAST throwing error when run in stored procedure but not when run as raw query

How can I deal with my CEO asking me to hire someone with a higher salary than me, a co-founder?

Why is it a bad idea to hire a hitman to eliminate most corrupt politicians?

What method can I use to design a dungeon difficult enough that the PCs can't make it through without killing them?

Can't forward traffic from eth to TUN/TAP

ISC DHCP Server - A Client's Uplink Is Not WorkingHow to forward IP traffic between wlan0 and eth0 without killing network performance on the forwarding machineRouting only VM traffic through VPNopenvpn: iptables not forwardingPacket flow in a virtual bridge with two interfaces, centos 7Iptables with libnetfilter NATing problemWhat is kernel ip forwarding? related questionHow To Make All Traffic To Go Through One Interface In LinuxHow to route traffic from a specific user through a VPN on LinuxHow to forward traffic for specific IP over an tun0 interface

0

I'm trying to forward traffic from a physical interface enp5s0 to a virtual one tun0. The goal is to make tun0 receive essentially all packets from enp5s0.

First, I enable forwarding with a command

sudo sysctl -w net.ipv4.ip_forward=1

Then I create tun0 by running

sudo ip tuntap add dev tun0 mod tun

I assign it IP-address and turn the device on:

sudo ifconfig tun0 10.1.8.5 netmask 255.255.255.0 promisc up

I want to make all packets go from enp5s0 to tun0, so I have to use iptables. I need to make a rule that allows forwarding from enp5s0 to tun0, so the command is

sudo iptables -A FORWARD --in-interface tun0 --out-interface enp5s0 -j ACCEPT

Then I enable NAT by running

sudo iptables -t nat -A POSTROUTING --out-interface enp5s0 -j MASQUERADE

tcpdump shows no traffic on tun0.

Also, I tried almost the same thing, but using TAP device. I created a bridge with brctl, added tap0 and enp5s0, but no packets were received by tap0 and everything was ok with enp5s0. Nothing like default gw 10.1.8.5 works in TUN case. Where is a mistake?

iptables vpn tunneling forwarding

share|improve this question

asked May 9 '18 at 13:10

Nikita ZeulinNikita Zeulin

1

bumped to the homepage by Community♦ 2 days ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What exactly are you trying to achieve?
  
  – ysdx
  May 11 '18 at 14:34
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I'm trying to capture all enp5s0 traffic on tun0. Every packet received by enp5s0 should be forwarded to tun0`
  
  – Nikita Zeulin
  May 12 '18 at 13:31
  

  
  
  
  

add a comment | 

0

I'm trying to forward traffic from a physical interface enp5s0 to a virtual one tun0. The goal is to make tun0 receive essentially all packets from enp5s0.

First, I enable forwarding with a command

sudo sysctl -w net.ipv4.ip_forward=1

Then I create tun0 by running

sudo ip tuntap add dev tun0 mod tun

I assign it IP-address and turn the device on:

sudo ifconfig tun0 10.1.8.5 netmask 255.255.255.0 promisc up

I want to make all packets go from enp5s0 to tun0, so I have to use iptables. I need to make a rule that allows forwarding from enp5s0 to tun0, so the command is

sudo iptables -A FORWARD --in-interface tun0 --out-interface enp5s0 -j ACCEPT

Then I enable NAT by running

sudo iptables -t nat -A POSTROUTING --out-interface enp5s0 -j MASQUERADE

tcpdump shows no traffic on tun0.

Also, I tried almost the same thing, but using TAP device. I created a bridge with brctl, added tap0 and enp5s0, but no packets were received by tap0 and everything was ok with enp5s0. Nothing like default gw 10.1.8.5 works in TUN case. Where is a mistake?

iptables vpn tunneling forwarding

share|improve this question

asked May 9 '18 at 13:10

Nikita ZeulinNikita Zeulin

1

bumped to the homepage by Community♦ 2 days ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  What exactly are you trying to achieve?
  
  – ysdx
  May 11 '18 at 14:34
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I'm trying to capture all enp5s0 traffic on tun0. Every packet received by enp5s0 should be forwarded to tun0`
  
  – Nikita Zeulin
  May 12 '18 at 13:31
  

  
  
  
  

add a comment | 

I'm trying to forward traffic from a physical interface enp5s0 to a virtual one tun0. The goal is to make tun0 receive essentially all packets from enp5s0.

First, I enable forwarding with a command

sudo sysctl -w net.ipv4.ip_forward=1

Then I create tun0 by running

sudo ip tuntap add dev tun0 mod tun

I assign it IP-address and turn the device on:

sudo ifconfig tun0 10.1.8.5 netmask 255.255.255.0 promisc up

I want to make all packets go from enp5s0 to tun0, so I have to use iptables. I need to make a rule that allows forwarding from enp5s0 to tun0, so the command is

sudo iptables -A FORWARD --in-interface tun0 --out-interface enp5s0 -j ACCEPT

Then I enable NAT by running

sudo iptables -t nat -A POSTROUTING --out-interface enp5s0 -j MASQUERADE

tcpdump shows no traffic on tun0.

Also, I tried almost the same thing, but using TAP device. I created a bridge with brctl, added tap0 and enp5s0, but no packets were received by tap0 and everything was ok with enp5s0. Nothing like default gw 10.1.8.5 works in TUN case. Where is a mistake?

iptables vpn tunneling forwarding

share|improve this question

asked May 9 '18 at 13:10

Nikita ZeulinNikita Zeulin

1

sudo sysctl -w net.ipv4.ip_forward=1

sudo ip tuntap add dev tun0 mod tun

sudo ifconfig tun0 10.1.8.5 netmask 255.255.255.0 promisc up

sudo iptables -A FORWARD --in-interface tun0 --out-interface enp5s0 -j ACCEPT

sudo iptables -t nat -A POSTROUTING --out-interface enp5s0 -j MASQUERADE

share|improve this question

asked May 9 '18 at 13:10

Nikita ZeulinNikita Zeulin

1

share|improve this question

asked May 9 '18 at 13:10

Nikita ZeulinNikita Zeulin

1

asked May 9 '18 at 13:10

Nikita ZeulinNikita Zeulin

1

asked May 9 '18 at 13:10

Nikita ZeulinNikita Zeulin

1

1 Answer
1

active

oldest

votes

0

Your in and out interfaces are reversed in the iptables command.

They should be:

sudo iptables -A FORWARD --in-interface enp5s0 --out-interface tun0 -j ACCEPT

and:

sudo iptables -t nat -A POSTROUTING --out-interface tun0 -j MASQUERADE

share|improve this answer

answered May 9 '18 at 13:26

BrendanMcLBrendanMcL

214

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I've tried yours and tcpdump -i tun0 is still empty
  
  – Nikita Zeulin
  May 9 '18 at 13:55
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  What are you trying to achieve? I have used these commands to set up a vpn over a tun device (which is why I know about the in/out order), however you would normally have something on the other side of the tun0 interface - either the other end of the vpn or a local application that opens the device. Just having the tun0 device with an ip address doesn't mean that traffic will flow - its like having an ethernet port with the cable unplugged. This might be useful: naturalborncoder.com/virtualization/2014/10/17/…
  
  – BrendanMcL
  May 9 '18 at 22:45
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for a link. The goal is to capture all enp5s0 traffic on tun0. I have a program that reads packets from tun0, spoofs them and send them back on wire. I've tried ping and traceroute to test the connection, and the thing is that there are some records on packet going though PREROUTE chain and that's all, packets are not being forwarded even if I make a rule and enable forwarding.
  
  – Nikita Zeulin
  May 11 '18 at 12:39
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f442760%2fcant-forward-traffic-from-eth-to-tun-tap%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

Your in and out interfaces are reversed in the iptables command.

They should be:

sudo iptables -A FORWARD --in-interface enp5s0 --out-interface tun0 -j ACCEPT

and:

sudo iptables -t nat -A POSTROUTING --out-interface tun0 -j MASQUERADE

share|improve this answer

answered May 9 '18 at 13:26

BrendanMcLBrendanMcL

214

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I've tried yours and tcpdump -i tun0 is still empty
  
  – Nikita Zeulin
  May 9 '18 at 13:55
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  What are you trying to achieve? I have used these commands to set up a vpn over a tun device (which is why I know about the in/out order), however you would normally have something on the other side of the tun0 interface - either the other end of the vpn or a local application that opens the device. Just having the tun0 device with an ip address doesn't mean that traffic will flow - its like having an ethernet port with the cable unplugged. This might be useful: naturalborncoder.com/virtualization/2014/10/17/…
  
  – BrendanMcL
  May 9 '18 at 22:45
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for a link. The goal is to capture all enp5s0 traffic on tun0. I have a program that reads packets from tun0, spoofs them and send them back on wire. I've tried ping and traceroute to test the connection, and the thing is that there are some records on packet going though PREROUTE chain and that's all, packets are not being forwarded even if I make a rule and enable forwarding.
  
  – Nikita Zeulin
  May 11 '18 at 12:39
  

  
  
  
  

add a comment | 

0

Your in and out interfaces are reversed in the iptables command.

They should be:

sudo iptables -A FORWARD --in-interface enp5s0 --out-interface tun0 -j ACCEPT

and:

sudo iptables -t nat -A POSTROUTING --out-interface tun0 -j MASQUERADE

share|improve this answer

answered May 9 '18 at 13:26

BrendanMcLBrendanMcL

214

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I've tried yours and tcpdump -i tun0 is still empty
  
  – Nikita Zeulin
  May 9 '18 at 13:55
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  What are you trying to achieve? I have used these commands to set up a vpn over a tun device (which is why I know about the in/out order), however you would normally have something on the other side of the tun0 interface - either the other end of the vpn or a local application that opens the device. Just having the tun0 device with an ip address doesn't mean that traffic will flow - its like having an ethernet port with the cable unplugged. This might be useful: naturalborncoder.com/virtualization/2014/10/17/…
  
  – BrendanMcL
  May 9 '18 at 22:45
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for a link. The goal is to capture all enp5s0 traffic on tun0. I have a program that reads packets from tun0, spoofs them and send them back on wire. I've tried ping and traceroute to test the connection, and the thing is that there are some records on packet going though PREROUTE chain and that's all, packets are not being forwarded even if I make a rule and enable forwarding.
  
  – Nikita Zeulin
  May 11 '18 at 12:39
  

  
  
  
  

add a comment | 

Your in and out interfaces are reversed in the iptables command.

They should be:

sudo iptables -A FORWARD --in-interface enp5s0 --out-interface tun0 -j ACCEPT

and:

sudo iptables -t nat -A POSTROUTING --out-interface tun0 -j MASQUERADE

share|improve this answer

answered May 9 '18 at 13:26

BrendanMcLBrendanMcL

214

sudo iptables -A FORWARD --in-interface enp5s0 --out-interface tun0 -j ACCEPT

sudo iptables -t nat -A POSTROUTING --out-interface tun0 -j MASQUERADE

share|improve this answer

answered May 9 '18 at 13:26

BrendanMcLBrendanMcL

214

answered May 9 '18 at 13:26

BrendanMcLBrendanMcL

214

answered May 9 '18 at 13:26

BrendanMcLBrendanMcL

214