Problem with: OSPF thru netgraph & Gif Tunnels

[Julian Elischer]

Chris Bose wrote:
> Hi All,
> 
> 
> 
> I’m trying to setup a network between two locations over a WAN and I’m 
> running into a wall when I try to get OSPF to talk over my WAN tunnel.  I’ve 
> realized that I’m not smart enough and need your help.
> 
> 
> 
> The problem is as follows:
> 
> My network consists of the following:
> 
> Site A connects together with a few quagga routers on freebsd 4.8
> 
> Site A:
> 
> Router 1: FXP0 (10.1.1.1/24)
> 
> Router 1: FXP0 (10.1.2.1/24)
> 
> Router 1: FXP0 (10.1.3.1/24)
> 
> Router 1: GIF0 (10.1.4.1 -> 10.2.4.1)
> 
> 
> 
> Site B connects to site A by using the GIF interface over the public network

"public network" == Internet right?

> 
> 
> 
> SiteB:
> 
> Router 2: FXP0 (10.2.1.1/24)
> 
> Router 2: FXP0 (10.2.2.1/24)
> 
> Router 2: FXP0 (10.2.3.1/24)
> 
> Router 2: GIF0 (10.2.4.1 -> 10.1.4.1)
> 
> 
> 
> 
> 
> I run OSPFv2 (quagga) at Site A and at Site B.  There is no problem 
> connecting site A & B together via OSPF over the GIF0 tunnel.  Essential OSPF
>  multicasts its route advertisements thru the GIF tunnel to the other side. 
> This works fine because the OSPF router and the GIF tunnel are both on the 
> same freebsd computer

With such a simple network, why not use static routing?

> 
> 
> 
> Now here is what I’m trying to do to setup site C.
> 
> 
> 
> At site C  I need to separate this into two computers.  One computer will 
> terminate the GIF tunnel and the other computer runs the OSPF router.

why do you "need" to do this?

> 
> 
> 
> So the setup between A and B looks like this:
> 
> 
> 
> SiteA:Computer 1           SiteB:Computer 2
> 
> (OSPF + GIF0) ============== (GIF0 + OSPF)
> 
> 
> 
> And setup between Site B and C looks like this:
> 
> 
> 
> 
> 
> SiteB:Computer 2          SiteC:Computer 3  SiteC:computer 4
> 
> (OSPF + GIF1) ============== (GIF1)  ---------(OSPF)
> 
> 
> 
> === denotes GIF tunnel
> 
> --- denotes normal Ethernet connection
> 
> Computer 3 has two ethernet interfaces
> 
> 
> 
> 
> 
> The problem that I have is I can’t get Computer 4 to communicate to computer 
> 2 thru the GIF.  The computers can ping each other, but the OSPF multicast 
> packets don’t go thru.

do the packets get as far as computer 3?

I'm not an expert in multicast, but what in teh setup makes you think that
the multicast packets SHOULD be sent through the tunnel?

> 
> I have tried IPFW fwd commands on computer 3

I'm not sure that forwarding works for non-tcp traffic. Certainly that is
true for local forwarding.

> 
> 
>> Ifpw fwd computer 2 ip from computer 4 to any
> 
> 
> But that didn’t work
> 
> I’ve tried Ethernet bridging… but bridging doesn’t work on a Gif interface.
> 
> I’ve tried to replace the gif tunnel with Netgraph UDP tunnel, but I can’t 
> use that in the bridge either.

Interesting..

You should be able to make it work by using an ng_eiface instead of an ng_iface
node for the tunnel, so that you are tunnelling ethernet packets instead of ip
packets, then on the far end you can feed them straight into the bridge node.

though you don't really understand where bridging comes into it in the first 
place. You have different subnets so you should be routing and not bridging.

I use UDP netgraph tunnels all the time.
sometimes encrypted by using IPSEC on the UDP packets
connecting an iface node to a ksocket(udp) node.

I also sometimes use mpd to encapsulate ppp instead of plain ip,
and use it's udp transport method to do the work (When I want to
bond several links into one tunnel using multilink ppp)

I have NEVER however had experience with multicast and tunnels.

> 
> 
> 
> I used the sample in /src/examples/netgraph/bridge.

but you are not using a bridge.. are you?

> 
> 
> 
> I have not tried L2TPv3…
> 
> 
> 
> 
> 
> So my question is how to get the above configuration working.  I think this 
> should be really simple to do, it’s a typical configuration as far as I can 
> tell.  Please show your ingenuity with your reply.  I really appreciate it.
> 
> 
> 
> I tried to make the example generic without any configuration files because 
> there is nothing specific about my configuration.  Please post your own 
> configuration for the above if applicable.  You can assume that I have a 
> virgin computer and I can configure it any which way I want.  If you need me 
> to give you any configuration please let me know.  If you want me to post a 
> better network diagram please let me know as well.
> 
> 
> 
> Many thanks,
> 
> Chris.
> 
> 
> 
> 
> __________________________________________________ Do You Yahoo!? Tired of 
> spam?  Yahoo! Mail has the best spam protection around http://mail.yahoo.com 
> _______________________________________________ freebsd-hackers at freebsd.org 
> mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To 
> unsubscribe, send any mail to "freebsd-hackers-unsubscribe at freebsd.org"