Uploaded image for project: 'vpp'
  1. vpp
  2. VPP-1349

NAT: Access from outside interface network is not worked with 'nat44 forwarding' feature.

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Medium Medium
    • 18.07
    • 18.07
    • S-NAT

      ssh command not worked. (It worked about 1 month ago on vpp-18.04)

      ping command not worked too.

      Scheme PC-VPP-PC:

      • PC (192.168.1.100) <outside> (TenGigabitEthernet3/0/0)VPP(GigabitEthernet5/0/1) <inside> PC (192.168.0.100) 

       

      DBGvpp# set interface ip address GigabitEthernet5/0/1 192.168.0.1/24
      DBGvpp# set interface ip address TenGigabitEthernet3/0/0 192.168.1.1/24
      DBGvpp# set interface state GigabitEthernet5/0/1 up
      DBGvpp# set interface state TenGigabitEthernet3/0/0 up
      DBGvpp# nat44 add interface address TenGigabitEthernet3/0/0
      DBGvpp# set interface nat44 in GigabitEthernet5/0/1 out TenGigabitEthernet3/0/0 output-feature
      DBGvpp#
      DBGvpp#
      DBGvpp# nat44 forwarding enable
      DBGvpp#
      DBGvpp# trace add dpdk-input 10
      DBGvpp#

      192.168.1.100# ssh 192.168.1.1 <<< DON'T WORK**

      DBGvpp# show trace
      ------------------- Start of thread 0 vpp_main -------------------
      Packet 1

      00:08:51:972548: dpdk-input
      TenGigabitEthernet3/0/0 rx queue 0
      buffer 0xe9bd: current data 14, length 60, free-list 0, clone-count 0, totlen-nifb 0, trace 0x0
      ext-hdr-valid
      l4-cksum-computed l4-cksum-correct l2-hdr-offset 0
      PKT MBUF: port 0, nb_segs 1, pkt_len 74
      buf_len 2176, data_len 74, ol_flags 0x180, data_off 128, phys_addr 0x6e5a6fc0
      packet_type 0x111 l2_len 0 l3_len 0 outer_l2_len 0 outer_l3_len 0
      rss 0x0 fdir.hi 0x0 fdir.lo 0x0
      Packet Offload Flags
      PKT_RX_IP_CKSUM_GOOD (0x0080) IP cksum of RX pkt. is valid
      PKT_RX_L4_CKSUM_GOOD (0x0100) L4 cksum of RX pkt. is valid
      Packet Types
      RTE_PTYPE_L2_ETHER (0x0001) Ethernet packet
      RTE_PTYPE_L3_IPV4 (0x0010) IPv4 packet without extension headers
      RTE_PTYPE_L4_TCP (0x0100) TCP packet
      IP4: 00:a0:c9:00:00:00 -> ac:1f:6b:8d:01:66
      TCP: 192.168.1.100 -> 192.168.1.1
      tos 0x00, ttl 64, length 60, checksum 0x5887
      fragment id 0x5e7f, flags DONT_FRAGMENT
      TCP: 47820 -> 22
      seq. 0x4919a8fe ack 0x00000000
      flags 0x02 SYN, tcp header: 40 bytes
      window 29200, checksum 0xa4cc
      00:08:51:972567: ip4-input-no-checksum
      TCP: 192.168.1.100 -> 192.168.1.1
      tos 0x00, ttl 64, length 60, checksum 0x5887
      fragment id 0x5e7f, flags DONT_FRAGMENT
      TCP: 47820 -> 22
      seq. 0x4919a8fe ack 0x00000000
      flags 0x02 SYN, tcp header: 40 bytes
      window 29200, checksum 0xa4cc
      00:08:51:972583: nat44-out2in
      NAT44_OUT2IN: sw_if_index 1, next index 1, session index 0
      00:08:51:972592: ip4-lookup
      fib 0 dpo-idx 0 flow hash: 0x00000000
      TCP: 192.168.1.100 -> 124.0.0.0
      tos 0x00, ttl 64, length 60, checksum 0x9e30
      fragment id 0x5e7f, flags DONT_FRAGMENT
      TCP: 47820 -> 0
      seq. 0x4919a8fe ack 0x00000000
      flags 0x02 SYN, tcp header: 40 bytes
      window 29200, checksum 0xea8b
      00:08:51:972599: ip4-drop
      TCP: 192.168.1.100 -> 124.0.0.0
      tos 0x00, ttl 64, length 60, checksum 0x9e30
      fragment id 0x5e7f, flags DONT_FRAGMENT
      TCP: 47820 -> 0
      seq. 0x4919a8fe ack 0x00000000
      flags 0x02 SYN, tcp header: 40 bytes
      window 29200, checksum 0xea8b
      00:08:51:972602: error-drop
      dpdk-input: no error

      DBGvpp# clear trace

      192.168.1.100# ping 192.168.1.1 <<< DON'T WORK

       DBGvpp# trace add dpdk-input 10
      DBGvpp# show trace
      ------------------- Start of thread 0 vpp_main -------------------
      Packet 1

      00:35:59:152312: dpdk-input
      TenGigabitEthernet3/0/0 rx queue 0
      buffer 0xe810: current data 14, length 84, free-list 0, clone-count 0, totlen-nifb 0, trace 0x0
      ext-hdr-valid
      l4-cksum-computed l4-cksum-correct l2-hdr-offset 0
      PKT MBUF: port 0, nb_segs 1, pkt_len 98
      buf_len 2176, data_len 98, ol_flags 0x180, data_off 128, phys_addr 0x6e5a0480
      packet_type 0x11 l2_len 0 l3_len 0 outer_l2_len 0 outer_l3_len 0
      rss 0x0 fdir.hi 0x0 fdir.lo 0x0
      Packet Offload Flags
      PKT_RX_IP_CKSUM_GOOD (0x0080) IP cksum of RX pkt. is valid
      PKT_RX_L4_CKSUM_GOOD (0x0100) L4 cksum of RX pkt. is valid
      Packet Types
      RTE_PTYPE_L2_ETHER (0x0001) Ethernet packet
      RTE_PTYPE_L3_IPV4 (0x0010) IPv4 packet without extension headers
      IP4: 00:a0:c9:00:00:00 -> ac:1f:6b:8d:01:66
      ICMP: 192.168.1.100 -> 192.168.1.1
      tos 0x00, ttl 64, length 84, checksum 0xe5a7
      fragment id 0xd14b, flags DONT_FRAGMENT
      ICMP echo_request checksum 0xd3b8
      00:35:59:152332: ip4-input-no-checksum
      ICMP: 192.168.1.100 -> 192.168.1.1
      tos 0x00, ttl 64, length 84, checksum 0xe5a7
      fragment id 0xd14b, flags DONT_FRAGMENT
      ICMP echo_request checksum 0xd3b8
      00:35:59:152349: nat44-out2in
      NAT44_OUT2IN: sw_if_index 1, next index 1, session index -1
      00:35:59:152357: ip4-lookup
      fib 0 dpo-idx 6 flow hash: 0x00000000
      ICMP: 192.168.1.100 -> 192.168.1.1
      tos 0x00, ttl 64, length 84, checksum 0xe5a7
      fragment id 0xd14b, flags DONT_FRAGMENT
      ICMP echo_request checksum 0xd3b8
      00:35:59:152364: ip4-local
      ICMP: 192.168.1.100 -> 192.168.1.1
      tos 0x00, ttl 64, length 84, checksum 0xe5a7
      fragment id 0xd14b, flags DONT_FRAGMENT
      ICMP echo_request checksum 0xd3b8
      00:35:59:152368: ip4-icmp-input
      ICMP: 192.168.1.100 -> 192.168.1.1
      tos 0x00, ttl 64, length 84, checksum 0xe5a7
      fragment id 0xd14b, flags DONT_FRAGMENT
      ICMP echo_request checksum 0xd3b8
      00:35:59:152378: ip4-icmp-echo-request
      ICMP: 192.168.1.100 -> 192.168.1.1
      tos 0x00, ttl 64, length 84, checksum 0xe5a7
      fragment id 0xd14b, flags DONT_FRAGMENT
      ICMP echo_request checksum 0xd3b8
      00:35:59:152382: ip4-load-balance
      fib 0 dpo-idx 17 flow hash: 0x00000000
      ICMP: 192.168.1.1 -> 192.168.1.100
      tos 0x00, ttl 64, length 84, checksum 0x54ce
      fragment id 0x6225, flags DONT_FRAGMENT
      ICMP echo_reply checksum 0xdbb8
      00:35:59:152385: ip4-rewrite
      tx_sw_if_index 1 dpo-idx 2 : ipv4 via 192.168.1.100 TenGigabitEthernet3/0/0: mtu:9000 00a0c9000000ac1f6b8d01660800 flow hash: 0x00000000
      00000000: 00a0c9000000ac1f6b8d016608004500005462254000400154cec0a80101c0a8
      00000020: 01640000dbb80a18000256d4515b00000000ae2a0500000000001011
      00:35:59:152389: nat44-in2out-output
      NAT44_IN2OUT_FAST_PATH: sw_if_index 0, next index 3, session -1
      00:35:59:152395: nat44-in2out-output-slowpath
      NAT44_IN2OUT_SLOW_PATH: sw_if_index 0, next index 0, session 1
      00:35:59:152403: TenGigabitEthernet3/0/0-output
      TenGigabitEthernet3/0/0
      IP4: ac:1f:6b:8d:01:66 -> 00:a0:c9:00:00:00
      ICMP: 192.168.1.1 -> 192.168.1.100
      tos 0x00, ttl 64, length 84, checksum 0x54ce
      fragment id 0x6225, flags DONT_FRAGMENT
      ICMP echo_reply checksum 0xa653
      00:35:59:152409: TenGigabitEthernet3/0/0-tx
      TenGigabitEthernet3/0/0 tx queue 0
      buffer 0xe810: current data 0, length 98, free-list 0, clone-count 0, totlen-nifb 0, trace 0x0
      ext-hdr-valid
      l4-cksum-computed l4-cksum-correct l2-hdr-offset 0
      PKT MBUF: port 0, nb_segs 1, pkt_len 98
      buf_len 2176, data_len 98, ol_flags 0x180, data_off 128, phys_addr 0x6e5a0480
      packet_type 0x11 l2_len 0 l3_len 0 outer_l2_len 0 outer_l3_len 0
      rss 0x0 fdir.hi 0x0 fdir.lo 0x0
      Packet Offload Flags
      PKT_RX_IP_CKSUM_GOOD (0x0080) IP cksum of RX pkt. is valid
      PKT_RX_L4_CKSUM_GOOD (0x0100) L4 cksum of RX pkt. is valid
      Packet Types
      RTE_PTYPE_L2_ETHER (0x0001) Ethernet packet
      RTE_PTYPE_L3_IPV4 (0x0010) IPv4 packet without extension headers
      IP4: ac:1f:6b:8d:01:66 -> 00:a0:c9:00:00:00
      ICMP: 192.168.1.1 -> 192.168.1.100
      tos 0x00, ttl 64, length 84, checksum 0x54ce
      fragment id 0x6225, flags DONT_FRAGMENT
      ICMP echo_reply checksum 0xa653

      DBGvpp# show nat44 sessions details
      NAT44 sessions:
      -------- thread 0 vpp_main --------
      124.0.0.0: 0 dynamic translations, 1 static translations
      i2o 124.0.0.0 proto tcp port 0 fib 0
      o2i 192.168.1.1 proto tcp port 22 fib 0
      index 0
      last heard 595.77
      total pkts 12, total bytes 720
      static translation

      192.168.1.1: 1 dynamic translations, 0 static translations
      i2o 192.168.1.1 proto icmp port 2584 fib 0
      o2i 192.168.1.1 proto icmp port 16253 fib 0
      index 1
      last heard 2309.45
      total pkts 152, total bytes 14896
      dynamic translation

       

            matfabia Matus Fabian
            vdmitry Dmitry Vakhrushev
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: