I am trying to connect multiple Amazon VPCs (across regions) together using OpenSWAN and Amazon VGW's. The router instance can ping to hosts in both VPCs, and traffic is attempting to cross the router, but is getting dropped.
EDIT: I see the counter XfrmInNoPols incrementing when the pings are not being forwarded.
In this scenario there are two VPCs being connected, and a instance that happens to be in a 3rd VPC is performing the routing and acting as a hub. I am attempting to essentially reimplement the Transit VPC function (https://aws.amazon.com/blogs/aws/aws-solution-transit-vpc/), without the Cisco CSR and automated lambda configuration.
My issue is that the hub is able to reach both East and West, but packets from either end arrive on hub but reach no further.
Topology:
West (172.19.0.0/16) - (hub) - East (172.18.0.0/16). Hub is connecting to both ends via VGW's, so cleartext packets for east/west never leave Hub. As per normal VGW behavior, two tunnels exist between each end and HUB.
The basis for this configuration is https://github.com/patrickbcullen/Openswan-VPC, modified to support a 2nd set of tunnels. One oddity about this script is it set ups a 'network namespace' (http://man7.org/linux/man-pages/man8/ip-netns.8.html) to handle all the ipsec and routing.
The hub can ping nodes in east and west via the IPSEC tunnels. The VGW's agree that ipsec and BGP is up, the the East/West subnets see the propagated routes. The hub has routes to both East and West. Iptables is fully open. rp_filter is set to 0 and forwarding / ip_forward is set to 1 in sysctl.
I set up a ping generator in West that is attempting to ping East. The packets reach the openswan network namespace in hub:
16:38:49.311665 IP 35.163.220.45 > 169.254.255.3: ESP(spi=0x0a790d98,seq=0x4f5), length 132 16:38:49.311665 IP 172.19.58.64 > 172.18.57.207: ICMP echo request, id 411, seq 1113, length 64 I have NFLOG / ulogd2 setup in iptables. It shows:
RAW-PREROUTING IN=eth0 OUT= MAC=d6:fd:61:4b:73:42:6a:3a:bb:e2:33:75:08:00 SRC=172.19.58.64 DST=172.18.57.207 LEN=84 TOS=00 PREC=0x00 TTL=254 ID=49803 DF PROTO=ICMP TYPE=8 CODE=0 ID=411 SEQ=1155 MARK=0 NAT-PREROUTING IN=eth0 OUT= MAC=d6:fd:61:4b:73:42:6a:3a:bb:e2:33:75:08:00 SRC=172.19.58.64 DST=172.18.57.207 LEN=84 TOS=00 PREC=0x00 TTL=254 ID=49803 DF PROTO=ICMP TYPE=8 CODE=0 ID=411 SEQ=1155 MARK=0 However the packet never reaches the FORWARD iptables chain:
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) Pinging from East to West fails similarly.
The hub can ping both the source and destination:
# ping -c 1 172.18.57.207 64 bytes from 172.18.57.207: icmp_seq=1 ttl=254 time=1.74 ms # ping -c 1 172.19.58.64 64 bytes from 172.19.58.64: icmp_seq=1 ttl=254 time=94.3 ms Any suggestions on what might be blocking packets from transiting hub?
The host is a AWS EC2 AMI, latest version:
Linux version 4.4.30-32.54.amzn1.x86_64 (mockbuild@gobi-build-60008) (gcc version 4.8.3 20140911 (Red Hat 4.8.3-9) (GCC) ) #1 SMP Thu Nov 10 15:52:05 UTC 2016ux Linux Openswan U2.6.37/K4.4.30-32.54.amzn1.x86_64 (netkey) My iptables rules (all ACCEPT, only NFLOGs):
# Generated by iptables-save v1.4.18 on Fri Nov 18 16:40:41 2016 *mangle :PREROUTING ACCEPT [3648:404080] :INPUT ACCEPT [2490:306808] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1802:171212] :POSTROUTING ACCEPT [1802:171212] -A INPUT -j NFLOG --nflog-prefix MAN-INPUT --nflog-group 5 -A OUTPUT -j NFLOG --nflog-prefix MAN-OUTPUT --nflog-group 5 -A POSTROUTING -j NFLOG --nflog-prefix MAN-POSTROUTING --nflog-group 5 COMMIT # Completed on Fri Nov 18 16:40:41 2016 # Generated by iptables-save v1.4.18 on Fri Nov 18 16:40:41 2016 *filter :INPUT ACCEPT [2490:306808] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1802:171212] -A INPUT -j NFLOG --nflog-prefix FLT-INPUT --nflog-group 5 -A OUTPUT -j NFLOG --nflog-prefix FLT-OUTPUT --nflog-group 5 COMMIT # Completed on Fri Nov 18 16:40:41 2016 # Generated by iptables-save v1.4.18 on Fri Nov 18 16:40:41 2016 *raw :PREROUTING ACCEPT [3648:404080] :OUTPUT ACCEPT [1802:171212] -A PREROUTING -j NFLOG --nflog-prefix RAW-PREROUTING --nflog-group 5 -A OUTPUT -j NFLOG --nflog-prefix RAW-OUTPUT --nflog-group 5 COMMIT # Completed on Fri Nov 18 16:40:41 2016 # Generated by iptables-save v1.4.18 on Fri Nov 18 16:40:41 2016 *nat :PREROUTING ACCEPT [1158:97272] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] -A PREROUTING -j NFLOG --nflog-prefix NAT-PREROUTING --nflog-group 5 -A POSTROUTING -j NFLOG --nflog-prefix NAT-POSTROUTING --nflog-group 5 COMMIT IPSec config:
# /etc/ipsec.conf - Openswan IPsec configuration file # # Manual: ipsec.conf.5 # # Please place your own config files in /etc/ipsec.d/ ending in .conf version 2.0 # conforms to second version of ipsec.conf specification # basic configuration config setup protostack=netkey nat_traversal=no virtual_private= oe=off conn awstunnel1 authby=secret auto=start left=169.254.255.2 leftid=169.254.255.2 right=35.163.197.247 rightid=35.163.197.247 type=tunnel ikelifetime=8h keylife=1h phase2alg=aes128-sha1;modp1024 ike=aes128-sha1 auth=esp keyingtries=%forever aggrmode=no keyexchange=ike ikev2=never leftsubnet=169.254.12.53/30 rightsubnet=0.0.0.0/0 dpddelay=10 dpdtimeout=30 dpdaction=restart_by_peer conn awstunnel2 authby=secret auto=start left=169.254.255.3 leftid=169.254.255.3 right=35.163.220.45 rightid=35.163.220.45 type=tunnel ikelifetime=8h keylife=1h phase2alg=aes128-sha1;modp1024 ike=aes128-sha1 auth=esp keyingtries=%forever aggrmode=no keyexchange=ike ikev2=never leftsubnet=169.254.12.221/30 rightsubnet=0.0.0.0/0 dpddelay=10 dpdtimeout=30 dpdaction=restart_by_peer conn awstunnel3 authby=secret auto=start left=169.254.255.4 leftid=169.254.255.4 right=52.45.134.147 rightid=52.45.134.147 type=tunnel ikelifetime=8h keylife=1h phase2alg=aes128-sha1;modp1024 ike=aes128-sha1 auth=esp keyingtries=%forever aggrmode=no keyexchange=ike ikev2=never leftsubnet=169.254.47.13/30 rightsubnet=0.0.0.0/0 dpddelay=10 dpdtimeout=30 dpdaction=restart_by_peer conn awstunnel4 authby=secret auto=start left=169.254.255.5 leftid=169.254.255.5 right=52.45.232.151 rightid=52.45.232.151 type=tunnel ikelifetime=8h keylife=1h phase2alg=aes128-sha1;modp1024 ike=aes128-sha1 auth=esp keyingtries=%forever aggrmode=no keyexchange=ike ikev2=never leftsubnet=169.254.47.1/30 rightsubnet=0.0.0.0/0 dpddelay=10 dpdtimeout=30 dpdaction=restart_by_peer (I'm omitting the secrets)
BGP configuration:
# cat /etc/quagga/bgpd.conf hostname ip-172-28-10-214 password xx enable password xx ! log file /var/log/quagga/bgpd.log debug bgp events debug bgp zebra debug bgp updates debug bgp filters debug bgp fsm ! router bgp 65001 bgp router-id 52.55.78.109 network 169.254.12.54/30 neighbor 169.254.12.53 remote-as 7224 neighbor 169.254.12.53 soft-reconfiguration inbound neighbor 169.254.12.53 route-map rm_peer_1_out out network 169.254.12.222/30 neighbor 169.254.12.221 remote-as 7224 neighbor 169.254.12.221 soft-reconfiguration inbound neighbor 169.254.12.221 route-map rm_peer_1_out out network 169.254.47.14/30 neighbor 169.254.47.13 remote-as 7224 neighbor 169.254.47.13 soft-reconfiguration inbound neighbor 169.254.47.13 route-map rm_peer_1_out out network 169.254.47.2/30 neighbor 169.254.47.1 remote-as 7224 neighbor 169.254.47.1 soft-reconfiguration inbound neighbor 169.254.47.1 route-map rm_peer_1_out out line vty ! ip prefix-list localprefix seq 5 permit 172.18.0.0/16 ip prefix-list remoteprefix seq 5 permit any ! Suppress the AWS AS route-map rm_peer_1_out permit 5 match ip address prefix-list localprefix set as-path exclude 7224 ! Suppress the AWS AS, synthetically extend the AS PATH ! For any vpc that isn't in the same region route-map rm_peer_1_out permit 6 match ip address prefix-list remoteprefix set as-path prepend 65001 set as-path exclude 7224 ! Suppress advertisement for non-VPC addresses access-list vpcprefixes permit 172.0.0.0/8 ! Route table:
default via 169.254.255.1 dev eth0 169.254.12.52/30 dev eth0 proto kernel scope link src 169.254.12.54 169.254.12.220/30 dev eth0 proto kernel scope link src 169.254.12.222 169.254.47.0/30 dev eth0 proto kernel scope link src 169.254.47.2 169.254.47.12/30 dev eth0 proto kernel scope link src 169.254.47.14 169.254.255.0/28 dev eth0 proto kernel scope link src 169.254.255.2 172.18.0.0/16 via 169.254.47.13 dev eth0 proto zebra metric 100 172.19.0.0/16 via 169.254.12.221 dev eth0 proto zebra metric 100 sysctl:
net.ipv4.conf.all.forwarding = 1 net.ipv4.conf.default.forwarding = 1 net.ipv4.conf.eth0.forwarding = 1 net.ipv4.conf.lo.forwarding = 1 net.ipv4.conf.veth1.forwarding = 1 net.ipv4.ip_forward = 1 ipsec auto --status:
000 using kernel interface: netkey 000 interface lo/lo ::1 000 interface lo/lo 127.0.0.1 000 interface eth0/eth0 169.254.255.2 000 interface eth0/eth0 169.254.12.54 000 interface eth0/eth0 169.254.12.222 000 interface eth0/eth0 169.254.47.14 000 interface eth0/eth0 169.254.47.2 000 interface eth0/eth0 169.254.255.3 000 interface eth0/eth0 169.254.255.4 000 interface eth0/eth0 169.254.255.5 000 %myid = (none) 000 debug none 000 000 virtual_private (%priv): 000 - allowed 0 subnets: 000 - disallowed 0 subnets: 000 WARNING: Either virtual_private= is not specified, or there is a syntax 000 error in that line. 'left/rightsubnet=vhost:%priv' will not work! 000 WARNING: Disallowed subnets in virtual_private= is empty. If you have 000 private address space in internal use, it should be excluded! 000 [SNIP algorithms] 000 000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,8,64} trans={0,8,3072} attrs={0,8,2048} 000 000 "awstunnel1": 169.254.12.52/30===169.254.255.2<169.254.255.2>[+S=C]...35.163.197.247<35.163.197.247>[+S=C]===0.0.0.0/0; erouted; eroute owner: #8 000 "awstunnel1": myip=unset; hisip=unset; 000 "awstunnel1": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "awstunnel1": policy: PSK+ENCRYPT+TUNNEL+PFS+UP+SAREFTRACK+lKOD+rKOD; prio: 30,0; interface: eth0; 000 "awstunnel1": dpd: action:restart_by_peer; delay:10; timeout:30; 000 "awstunnel1": newest ISAKMP SA: #1; newest IPsec SA: #8; 000 "awstunnel1": IKE algorithms wanted: AES_CBC(7)_128-SHA1(2)_000-MODP1536(5), AES_CBC(7)_128-SHA1(2)_000-MODP1024(2); flags=-strict 000 "awstunnel1": IKE algorithms found: AES_CBC(7)_128-SHA1(2)_160-MODP1536(5), AES_CBC(7)_128-SHA1(2)_160-MODP1024(2) 000 "awstunnel1": IKE algorithm newest: AES_CBC_128-SHA1-MODP1024 000 "awstunnel1": ESP algorithms wanted: AES(12)_128-SHA1(2)_000; pfsgroup=MODP1024(2); flags=-strict 000 "awstunnel1": ESP algorithms loaded: AES(12)_128-SHA1(2)_160 000 "awstunnel1": ESP algorithm newest: AES_128-HMAC_SHA1; pfsgroup=MODP1024 000 "awstunnel2": 169.254.12.220/30===169.254.255.3<169.254.255.3>[+S=C]...35.163.220.45<35.163.220.45>[+S=C]===0.0.0.0/0; erouted; eroute owner: #7 000 "awstunnel2": myip=unset; hisip=unset; 000 "awstunnel2": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "awstunnel2": policy: PSK+ENCRYPT+TUNNEL+PFS+UP+SAREFTRACK+lKOD+rKOD; prio: 30,0; interface: eth0; 000 "awstunnel2": dpd: action:restart_by_peer; delay:10; timeout:30; 000 "awstunnel2": newest ISAKMP SA: #2; newest IPsec SA: #7; 000 "awstunnel2": IKE algorithms wanted: AES_CBC(7)_128-SHA1(2)_000-MODP1536(5), AES_CBC(7)_128-SHA1(2)_000-MODP1024(2); flags=-strict 000 "awstunnel2": IKE algorithms found: AES_CBC(7)_128-SHA1(2)_160-MODP1536(5), AES_CBC(7)_128-SHA1(2)_160-MODP1024(2) 000 "awstunnel2": IKE algorithm newest: AES_CBC_128-SHA1-MODP1024 000 "awstunnel2": ESP algorithms wanted: AES(12)_128-SHA1(2)_000; pfsgroup=MODP1024(2); flags=-strict 000 "awstunnel2": ESP algorithms loaded: AES(12)_128-SHA1(2)_160 000 "awstunnel2": ESP algorithm newest: AES_128-HMAC_SHA1; pfsgroup=MODP1024 000 "awstunnel3": 169.254.47.12/30===169.254.255.4<169.254.255.4>[+S=C]...52.45.134.147<52.45.134.147>[+S=C]===0.0.0.0/0; erouted; eroute owner: #5 000 "awstunnel3": myip=unset; hisip=unset; 000 "awstunnel3": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "awstunnel3": policy: PSK+ENCRYPT+TUNNEL+PFS+UP+SAREFTRACK+lKOD+rKOD; prio: 30,0; interface: eth0; 000 "awstunnel3": dpd: action:restart_by_peer; delay:10; timeout:30; 000 "awstunnel3": newest ISAKMP SA: #3; newest IPsec SA: #5; 000 "awstunnel3": IKE algorithms wanted: AES_CBC(7)_128-SHA1(2)_000-MODP1536(5), AES_CBC(7)_128-SHA1(2)_000-MODP1024(2); flags=-strict 000 "awstunnel3": IKE algorithms found: AES_CBC(7)_128-SHA1(2)_160-MODP1536(5), AES_CBC(7)_128-SHA1(2)_160-MODP1024(2) 000 "awstunnel3": IKE algorithm newest: AES_CBC_128-SHA1-MODP1024 000 "awstunnel3": ESP algorithms wanted: AES(12)_128-SHA1(2)_000; pfsgroup=MODP1024(2); flags=-strict 000 "awstunnel3": ESP algorithms loaded: AES(12)_128-SHA1(2)_160 000 "awstunnel3": ESP algorithm newest: AES_128-HMAC_SHA1; pfsgroup=MODP1024 000 "awstunnel4": 169.254.47.0/30===169.254.255.5<169.254.255.5>[+S=C]...52.45.232.151<52.45.232.151>[+S=C]===0.0.0.0/0; erouted; eroute owner: #6 000 "awstunnel4": myip=unset; hisip=unset; 000 "awstunnel4": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0 000 "awstunnel4": policy: PSK+ENCRYPT+TUNNEL+PFS+UP+SAREFTRACK+lKOD+rKOD; prio: 30,0; interface: eth0; 000 "awstunnel4": dpd: action:restart_by_peer; delay:10; timeout:30; 000 "awstunnel4": newest ISAKMP SA: #4; newest IPsec SA: #6; 000 "awstunnel4": IKE algorithms wanted: AES_CBC(7)_128-SHA1(2)_000-MODP1536(5), AES_CBC(7)_128-SHA1(2)_000-MODP1024(2); flags=-strict 000 "awstunnel4": IKE algorithms found: AES_CBC(7)_128-SHA1(2)_160-MODP1536(5), AES_CBC(7)_128-SHA1(2)_160-MODP1024(2) 000 "awstunnel4": IKE algorithm newest: AES_CBC_128-SHA1-MODP1024 000 "awstunnel4": ESP algorithms wanted: AES(12)_128-SHA1(2)_000; pfsgroup=MODP1024(2); flags=-strict 000 "awstunnel4": ESP algorithms loaded: AES(12)_128-SHA1(2)_160 000 "awstunnel4": ESP algorithm newest: AES_128-HMAC_SHA1; pfsgroup=MODP1024 000 000 #8: "awstunnel1":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 881s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate 000 #8: "awstunnel1" [email protected] [email protected] [email protected] [email protected] ref=0 refhim=4294901761 000 #1: "awstunnel1":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 26389s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate 000 #7: "awstunnel2":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 1114s; newest IPSEC; eroute owner; isakmp#2; idle; import:admin initiate 000 #7: "awstunnel2" [email protected] [email protected] [email protected] [email protected] ref=0 refhim=4294901761 000 #2: "awstunnel2":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 26003s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate 000 #5: "awstunnel3":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 1083s; newest IPSEC; eroute owner; isakmp#3; idle; import:admin initiate 000 #5: "awstunnel3" [email protected] [email protected] [email protected] [email protected] ref=0 refhim=4294901761 000 #3: "awstunnel3":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 26042s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate 000 #6: "awstunnel4":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 864s; newest IPSEC; eroute owner; isakmp#4; idle; import:admin initiate 000 #6: "awstunnel4" [email protected] [email protected] [email protected] [email protected] ref=0 refhim=4294901761 000 #4: "awstunnel4":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 26073s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate 000 BGP state:
# vtysh -c 'show ip bgp summary' BGP router identifier 52.55.78.109, local AS number 65001 RIB entries 11, using 1056 bytes of memory Peers 4, using 18 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 169.254.12.53 4 7224 185 188 0 0 0 00:30:21 1 169.254.12.221 4 7224 185 187 0 0 0 00:30:23 1 169.254.47.1 4 7224 185 188 0 0 0 00:30:22 1 169.254.47.13 4 7224 185 187 0 0 0 00:30:22 1 # vtysh -c 'show ip bgp' BGP table version is 0, local router ID is 52.55.78.109 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, R Removed Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 169.254.12.52/30 0.0.0.0 0 32768 i *> 169.254.12.220/30 0.0.0.0 0 32768 i *> 169.254.47.0/30 0.0.0.0 0 32768 i *> 169.254.47.12/30 0.0.0.0 0 32768 i *> 172.18.0.0 169.254.47.13 100 0 7224 i * 169.254.47.1 200 0 7224 i * 172.19.0.0 169.254.12.53 200 0 7224 i *> 169.254.12.221 100 0 7224 i ip xfrm state (keys snipped) inside the namespace:
# ip xfrm state src 35.163.197.247 dst 169.254.255.2 proto esp spi 0x7db002d9 reqid 16385 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) x 96 enc cbc(aes) x anti-replay context: seq 0xfc, oseq 0x0, bitmap 0xffffffff src 169.254.255.2 dst 35.163.197.247 proto esp spi 0x5759bbc6 reqid 16385 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) x 96 enc cbc(aes) x anti-replay context: seq 0x0, oseq 0x180, bitmap 0x00000000 src 35.163.220.45 dst 169.254.255.3 proto esp spi 0x0a790d98 reqid 16389 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) x 96 enc cbc(aes) x anti-replay context: seq 0x8c0, oseq 0x0, bitmap 0xffffffff src 169.254.255.3 dst 35.163.220.45 proto esp spi 0xc817fa78 reqid 16389 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) x 96 enc cbc(aes) x anti-replay context: seq 0x0, oseq 0x14b, bitmap 0x00000000 src 52.45.232.151 dst 169.254.255.5 proto esp spi 0x80005db1 reqid 16397 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) x 96 enc cbc(aes) x anti-replay context: seq 0xe9, oseq 0x0, bitmap 0xffffffff src 169.254.255.5 dst 52.45.232.151 proto esp spi 0x7f07c4fa reqid 16397 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) x 96 enc cbc(aes) x anti-replay context: seq 0x0, oseq 0x180, bitmap 0x00000000 src 52.45.134.147 dst 169.254.255.4 proto esp spi 0x70f458c4 reqid 16393 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) x 96 enc cbc(aes) x anti-replay context: seq 0xfc, oseq 0x0, bitmap 0xffffffff src 169.254.255.4 dst 52.45.134.147 proto esp spi 0x98c8c16a reqid 16393 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) x 96 enc cbc(aes) x anti-replay context: seq 0x0, oseq 0x17f, bitmap 0x00000000 ip xfrm policy inside the namespace:
# ip xfrm policy src 169.254.12.52/30 dst 0.0.0.0/0 dir out priority 2176 ptype main tmpl src 169.254.255.2 dst 35.163.197.247 proto esp reqid 16385 mode tunnel src 0.0.0.0/0 dst 169.254.12.52/30 dir fwd priority 2176 ptype main tmpl src 35.163.197.247 dst 169.254.255.2 proto esp reqid 16385 mode tunnel src 0.0.0.0/0 dst 169.254.12.52/30 dir in priority 2176 ptype main tmpl src 35.163.197.247 dst 169.254.255.2 proto esp reqid 16385 mode tunnel src 169.254.12.220/30 dst 0.0.0.0/0 dir out priority 2176 ptype main tmpl src 169.254.255.3 dst 35.163.220.45 proto esp reqid 16389 mode tunnel src 0.0.0.0/0 dst 169.254.12.220/30 dir fwd priority 2176 ptype main tmpl src 35.163.220.45 dst 169.254.255.3 proto esp reqid 16389 mode tunnel src 0.0.0.0/0 dst 169.254.12.220/30 dir in priority 2176 ptype main tmpl src 35.163.220.45 dst 169.254.255.3 proto esp reqid 16389 mode tunnel src 169.254.47.0/30 dst 0.0.0.0/0 dir out priority 2176 ptype main tmpl src 169.254.255.5 dst 52.45.232.151 proto esp reqid 16397 mode tunnel src 0.0.0.0/0 dst 169.254.47.0/30 dir fwd priority 2176 ptype main tmpl src 52.45.232.151 dst 169.254.255.5 proto esp reqid 16397 mode tunnel src 0.0.0.0/0 dst 169.254.47.0/30 dir in priority 2176 ptype main tmpl src 52.45.232.151 dst 169.254.255.5 proto esp reqid 16397 mode tunnel src 169.254.47.12/30 dst 0.0.0.0/0 dir out priority 2176 ptype main tmpl src 169.254.255.4 dst 52.45.134.147 proto esp reqid 16393 mode tunnel src 0.0.0.0/0 dst 169.254.47.12/30 dir fwd priority 2176 ptype main tmpl src 52.45.134.147 dst 169.254.255.4 proto esp reqid 16393 mode tunnel src 0.0.0.0/0 dst 169.254.47.12/30 dir in priority 2176 ptype main tmpl src 52.45.134.147 dst 169.254.255.4 proto esp reqid 16393 mode tunnel src ::/0 dst ::/0 socket out priority 0 ptype main src ::/0 dst ::/0 socket in priority 0 ptype main src 0.0.0.0/0 dst 0.0.0.0/0 socket out priority 0 ptype main [repeats snipped] ip rule list inside the namespace:
# ip rule list 0: from all lookup local 32766: from all lookup main 32767: from all lookup default ip addr list inside the namespace:
# ip addr list 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 6: eth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether d6:fd:61:4b:73:42 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 169.254.255.2/28 scope global eth0 valid_lft forever preferred_lft forever inet 169.254.12.54/30 scope global eth0 valid_lft forever preferred_lft forever inet 169.254.12.222/30 scope global eth0 valid_lft forever preferred_lft forever inet 169.254.47.14/30 scope global eth0 valid_lft forever preferred_lft forever inet 169.254.47.2/30 scope global eth0 valid_lft forever preferred_lft forever inet 169.254.255.3/28 scope global secondary eth0 valid_lft forever preferred_lft forever inet 169.254.255.4/28 scope global secondary eth0 valid_lft forever preferred_lft forever inet 169.254.255.5/28 scope global secondary eth0 valid_lft forever preferred_lft forever inet6 fe80::d4fd:61ff:fe4b:7342/64 scope link valid_lft forever preferred_lft forever 8: veth1@if7: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 8e:9a:f6:27:83:fe brd ff:ff:ff:ff:ff:ff link-netnsid 0 ifconfig inside the namespace:
# ifconfig -a eth0 Link encap:Ethernet HWaddr D6:FD:61:4B:73:42 inet addr:169.254.255.2 Bcast:0.0.0.0 Mask:255.255.255.240 inet6 addr: fe80::d4fd:61ff:fe4b:7342/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3803 errors:0 dropped:0 overruns:0 frame:0 TX packets:2076 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:570566 (557.1 KiB) TX bytes:270108 (263.7 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) veth1 Link encap:Ethernet HWaddr 8E:9A:F6:27:83:FE BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) Pfkey:
# cat /proc/net/pfkey sk RefCnt Rmem Wmem User Inode Kernel config:
CONFIG_XFRM=y CONFIG_XFRM_ALGO=m CONFIG_XFRM_USER=m CONFIG_XFRM_SUB_POLICY=y CONFIG_XFRM_MIGRATE=y CONFIG_XFRM_STATISTICS=y CONFIG_XFRM_IPCOMP=m CONFIG_IP_ADVANCED_ROUTER=y CONFIG_INET_XFRM_TUNNEL=m CONFIG_INET_XFRM_MODE_TRANSPORT=m CONFIG_INET_XFRM_MODE_TUNNEL=m CONFIG_INET_XFRM_MODE_BEET=m CONFIG_INET6_XFRM_TUNNEL=m CONFIG_INET6_XFRM_MODE_TRANSPORT=m CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET6_XFRM_MODE_BEET=m CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m CONFIG_SECURITY_NETWORK_XFRM=y 
