0

I have IPIP tunnel as shown in tcpdump output bellow: IP 192.168.240.112 > 192.168.250.112.

Inside this tunnel, there is a traffic in another IPIP tunnel IP 10.233.86.94.35938 > 10.233.100.199.3306

$ sudo tcpdump -i oet1 -n
09:53:57.455262 IP 192.168.240.112 > 192.168.250.112: IP 10.233.86.94.35938 > 10.233.100.199.3306: Flags [P.], seq 802:865, ack 3295, win 501, options [nop,nop,TS val 3263474194 ecr 1936879148], length 63

My incomplete iptables rule:

iptables -t nat -A POSTROUTING -o oet1 -s 192.168.240.112 -d here_I_will_put_IP_that_I_need_that_is_fine -j SNAT --to 192.168.250.112

I want to somehow select packets of source IP 10.233.86.94 to destination IP 10.233.100.199 and add to iptables rule. So SNAT is done only when 10.233.86.94 calls 10.233.100.199.

Any way to mark IPs that are inside nested (encapsulated) tunnel or are they not reachable to iptables?

Thanks

laimison
  • 579
  • 2
  • 9
  • 17
  • It would help if you gave a little ascii schematic describing your network layout and explained why there is ipip inside ipip. And why the tag wireguard? If you're not using wireguard anywhere, you should not put this tag. – A.B May 25 '23 at 16:34
  • 1
    Btw, I believe this feature is available with nftables 1.0.7 and kernel 6.2 (both very recent) with the @ih inner header feature. No idea for iptables. – A.B May 25 '23 at 16:36
  • Will keep in mind about nftables and kernel 6.2, while I can't have it. In terms of setup, I mentioned Wireguard, because it is quite simple Wireguard tunnel (192.168.240 to 192.168.250) and Wireguard client uses standard IPIP tunnel (10.233.86 to 10.233.100). So there is nested tunnel. – laimison May 26 '23 at 19:35
  • Your question says 192.168.240-192.168.250.112 is IPIP. It is not. It's WireGuard (which is over UDP, not using IPIP). Doesn't change much but the question is inaccurate, so if it's inaccurate about this what else?... really need a schematic – A.B May 26 '23 at 20:44

0 Answers0