== all logged in ## Konfiguration, VPP auf A und B [A] $ configure [A] $ set interfaces ethernet eth1 address 10.0.0.1/24 [A] $ set interfaces ethernet eth2 address 10.1.0.1/24 [A] $ set vpp settings interface eth1 [A] $ set vpp settings interface eth2 [A] $ set vpp settings poll-sleep-usec 10 [A] $ commit [ vpp ] [B] $ configure [B] $ set interfaces ethernet eth1 address 10.0.0.2/24 [B] $ set interfaces ethernet eth1 mac 00:00:5e:00:aa:02 [B] $ set vpp settings interface eth1 [B] $ set vpp settings poll-sleep-usec 10 [B] $ set protocols static route 10.1.0.0/24 next-hop 10.0.0.1 [B] $ commit [ vpp ] [C] $ configure [C] $ set interfaces ethernet eth1 address 10.1.0.2/24 [C] $ set interfaces ethernet eth1 mac 00:00:5e:00:aa:03 [C] $ set protocols static route 10.0.0.0/24 next-hop 10.1.0.1 [C] $ commit ## Weiterleitung durch VPP auf A: B nach C [B] $ run ping 10.1.0.2 count 5 interval 0.2 | grep transmitted 5 packets transmitted, 4 received, 20% packet loss, time 808ms [A] $ sudo vppctl show int eth1 | grep -E "rx packets|tx packets" eth1 1 up 1500/0/0/0 rx packets 18 tx packets 16 [A] $ sudo vppctl show int eth2 | grep -E "rx packets|tx packets" eth2 2 up 1500/0/0/0 rx packets 13 tx packets 15 [A] $ sudo cat /proc/net/dev | grep -E "eth1|eth2" | cut -c1-30 eth1: 0 0 0 eth2: 42 1 0 [A] $ sudo sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1 ## Firewall: nur TCP von eth1, ICMP muss in VPP fallen [A] $ set firewall global-options state-policy established action accept [A] $ set firewall ipv4 forward filter default-action drop [A] $ set firewall ipv4 forward filter rule 10 action accept [A] $ set firewall ipv4 forward filter rule 10 inbound-interface name eth1 [A] $ set firewall ipv4 forward filter rule 10 protocol tcp [A] $ commit [B] $ run ping 10.1.0.2 count 5 interval 0.2 | grep transmitted 5 packets transmitted, 0 received, 100% packet loss, time 826ms [B] $ run ping 10.0.0.1 count 3 interval 0.2 | grep transmitted 3 packets transmitted, 3 received, 0% packet loss, time 401ms [A] $ set firewall ipv4 forward filter rule 20 action accept [A] $ set firewall ipv4 forward filter rule 20 inbound-interface name eth1 [A] $ set firewall ipv4 forward filter rule 20 protocol icmp [A] $ commit [B] $ run ping 10.1.0.2 count 5 interval 0.2 | grep transmitted 5 packets transmitted, 5 received, 0% packet loss, time 804ms ## VPP-Neustart mit Firewall: ACLs muessen wieder da sein [A] $ set vpp settings resource-allocation cpu-cores 2 [A] $ set vpp settings interface eth1 soft-rss type 4-tuple [A] $ commit [ vpp ] [A] $ sudo vppctl show threads | cut -c1-60 ID Name LWP CPU [3 0 vpp_main 3785 2 other (0) 112477 1 vpp_wk_0 3787 3 other (0) 66177684 [A] $ sudo vppctl show soft-rss eth1 eth1: status: enabled ipv4-type: 4-tuple ipv6-type: 4-tuple match-offset: 12 reta size: 1 reta: 1 match4: [0] mask ffffff00000000003fff00ff00000000 match 08004500000000000000000600000000 key-offset 14 key-length 12 [1] mask ffffff00000000003fff00ff00000000 match 08004500000000000000001100000000 key-offset 14 key-length 12 [2] mask ffffff00000000003fff000000000000 match 08004500000000000000000000000000 key-offset 14 key-length 8 match6: [0] mask fffff00000000000ff00000000000000 match 86dd6000000000000600000000000000 key-offset 10 key-length 36 [1] mask fffff00000000000ff00000000000000 match 86dd6000000000001100000000000000 key-offset 10 key-length 36 [2] mask fffff000000000000000000000000000 match 86dd6000000000000000000000000000 key-offset 10 key-length 32 [A] $ sudo vppctl show acl-plugin acl | grep -E "tag" acl-index 0 count 9 tag {fw-in-eth1} acl-index 1 count 7 tag {fw-in-eth2} acl-index 2 count 2 tag {fw-out} [B] $ run ping 10.1.0.2 count 5 interval 0.2 | grep transmitted 5 packets transmitted, 3 received, 40% packet loss, time 812ms [B] $ run ping 10.1.0.2 count 20 interval 0.1 | grep transmitted 20 packets transmitted, 20 received, 0% packet loss, time 1913ms [A] $ sudo vppctl show errors | head -14 Count Node Reason Severity 2 acl-plugin-out-ip6-fa new sessions added error 2 acl-plugin-out-ip6-fa checked packets error 1 acl-plugin-out-ip4-fa new sessions added error 46 acl-plugin-out-ip4-fa existing session packets error 47 acl-plugin-out-ip4-fa checked packets error 3 acl-plugin-out-ip6-fa new sessions added error 8 acl-plugin-out-ip6-fa existing session packets error 11 acl-plugin-out-ip6-fa checked packets error 1 acl-plugin-in-ip4-fa new sessions added error 48 acl-plugin-in-ip4-fa existing session packets error 49 acl-plugin-in-ip4-fa checked packets error 2 arp-reply ARP replies sent info 2 arp-reply ARP request IP4 source address lear info ## WireGuard in VPP zwischen A und B [A] $ set interfaces vpp wireguard vppwg0 address 10.255.0.1/30 [A] $ set interfaces vpp wireguard vppwg0 source-address 10.0.0.1 [A] $ set interfaces vpp wireguard vppwg0 port 51820 [A] $ set interfaces vpp wireguard vppwg0 peer b allowed-ips 10.255.0.2/32 [A] $ set interfaces vpp wireguard vppwg0 peer b address 10.0.0.2 [A] $ set interfaces vpp wireguard vppwg0 peer b port 51820 [A] $ commit [B] $ set interfaces vpp wireguard vppwg0 address 10.255.0.2/30 [B] $ set interfaces vpp wireguard vppwg0 source-address 10.0.0.2 [B] $ set interfaces vpp wireguard vppwg0 port 51820 [B] $ set interfaces vpp wireguard vppwg0 peer a allowed-ips 10.255.0.1/32 [B] $ set interfaces vpp wireguard vppwg0 peer a address 10.0.0.1 [B] $ set interfaces vpp wireguard vppwg0 peer a port 51820 [B] $ commit [A] $ run ping 10.255.0.2 count 5 interval 0.3 | grep transmitted 5 packets transmitted, 5 received, 0% packet loss, time 1204ms [A] $ run ping 10.255.0.2 count 5 interval 0.3 | grep -E "transmitted|time=" | tail -2 64 bytes from 10.255.0.2: icmp_seq=5 ttl=64 time=1.41 ms 5 packets transmitted, 5 received, 0% packet loss, time 1207ms [B] $ run ping 10.255.0.1 count 5 interval 0.3 | grep transmitted 5 packets transmitted, 5 received, 0% packet loss, time 1205ms [A] $ sudo vppctl show wireguard peer | grep -E "endpoint|adj" | cut -c1-110 [0] endpoint:[10.0.0.1:51820->10.0.0.2:51820] wg0 keep-alive:0 flags: 2, api-clients count: 0 adj: 12 [A] $ sudo vppctl show int wg0 | grep -E "packets" wg0 5 up 1420/0/0/0 rx packets 16 tx packets 15 [A] $ sudo vppctl show errors | grep -iE "wg|wire" | head -5 [A] $ sudo vppctl show crypto engines Name Prio Description openssl 50 OpenSSL [A] $ sudo vppctl show acl-plugin acl | grep tag acl-index 0 count 9 tag {fw-in-eth1} acl-index 1 count 7 tag {fw-in-eth2} acl-index 2 count 2 tag {fw-out}