Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

babel: firewall: connectivity issues with mesh-on-wan without vxlan #2375

Closed
T-X opened this issue Jan 18, 2022 · 5 comments
Closed

babel: firewall: connectivity issues with mesh-on-wan without vxlan #2375

T-X opened this issue Jan 18, 2022 · 5 comments
Labels
0. type: bug This is a bug 3. topic: babel Topic: Babel Layer 3 Routing 3. topic: firewall

Comments

@T-X
Copy link
Contributor

T-X commented Jan 18, 2022

Bug report

Setup Description

  • Local, virtual test setup on a laptop with 2 nodes and 2 clients:
client0 <-> [node0] <= mesh-on-wan => [node1] <-> client1
  • node0, node1: x86 KVM Gluon nodes (current master, on 7427ba2)
  • client0, client1: hosts in separate network namespaces
  • mesh-on-WAN, no VXLAN

Issue

Nodes and clients can't ping each other on their "node_prefix6" and "node_client_prefix6" addresses when using mesh-on-wan without VXLAN. Nodes don't recognize each other in BABEL.

Babeld's status dump only shows a node's own routes and own client routes, but not from other nodes. tcpdump shows BABEL's hello messages, but no "I-heard-you" responses.

Calling ip6tables -I INPUT -p udp --dport 6696 -j ACCEPT and ip6tables -I INPUT -p udp --dport 5523 -j ACCEPT makes BABEL IHU messages appear and allows BABEL's routing table to fill up correctly. And allows the two nodes to ping each other and allows a node to ping both clients. While pinging between clients still is rejected by the direct node ("Destination unreachable: Port unreachable"). Enabling VXLAN makes things work as well, including pinging between the two clients.

Additional Information

Gluon Version:

Site Configuration:

Concerns: #2353
@T-X
Copy link
Contributor Author

T-X commented Jan 18, 2022 •
edited
Loading

What actually surprises me a bit is that mesh-on-wan with VXLAN works. When doing a $ iptables -S | grep 6696 in my KVM setup with no wifi interface I get no results. So I'm wondering if it works by accident, if VXLAN by accident is less strict than mesh-on-wan without VXLAN (zone "wired_mesh" rejects INPUT and FORWARD, but I don't see a zone for "wired_mesh_vxlan").

There are rules "mesh_babel" and "mesh_l3roamd" for zone "mesh" (which I believe is wireless only?). But I don't see such babel/l3roamd rules for zone "wired_mesh".

@T-X T-X changed the title babel: firewall issues with mesh-on-wan without vxlan babel: firewall: connectivity issues with mesh-on-wan without vxlan Jan 18, 2022
@T-X T-X added 0. type: bug This is a bug 3. topic: babel Topic: Babel Layer 3 Routing 3. topic: firewall labels Jan 18, 2022
@neocturne
Copy link
Member

With Babel, there is no way to distinguish mesh and non-mesh traffic on the same interface by the packet type, so this simply cannot work - after all, mesh traffic must never leak into the WAN network for security reasons!

Non-VXLAN wired meshing is deprecated for batadv, and was never intended to be possible with Babel at all. It is a bug in our site checkers that it is possible to build a Babel-based firmware with vxlan = false.

@neocturne
Copy link
Member

neocturne commented Jan 18, 2022 •
edited
Loading

Note that the reason for the behavior you're seeing is that all mesh traffic through WAN will be filtered by the regular WAN zone with Babel (blocking most of it), while batadv uses a non-IP Ethertype which bypasses the firewall entirely.

@neocturne neocturne mentioned this issue Jan 18, 2022
Merged
@mkg20001
Copy link
Member

mkg20001 commented Jan 19, 2022 •
edited
Loading

If babel doesn't explicitly needs it's own VLAN another idea might be to use a macvlan then if vxlan is off

@neocturne
Copy link
Member

neocturne commented Feb 23, 2022 •
edited
Loading

#2376 is merged now, so I'm closing this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
0. type: bug This is a bug 3. topic: babel Topic: Babel Layer 3 Routing 3. topic: firewall
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@T-X @neocturne @mkg20001