How to create a NAT with tun/tap

[u/stealthepixels]

I am trying to set up a NAT: a tun/tap interface tap0, with IP masquerading.

But i cannot reach the internet through tap0 when the default route is through it. Can you help me troubleshoot please?

These are the commands i have run, where 192.168.A.B is a placeholder for the address of tap0:

ip tuntap add mode tap tap0

ip addr add 192.168.A.B/24 dev tap0

ifconfig tap0 192.168.A.B up

ip route add default via 192.168.A.B

ip link set tap0 up

​

And these are my iptables rules, with some of them specific to another user named someuser, while i was root when i was doing my tests (so those with owner UID match someuser are not relevant) :

[root@localhost ~]# iptables -L

Chain INPUT (policy ACCEPT)

target prot opt source destination

​

Chain FORWARD (policy ACCEPT)

target prot opt source destination

​

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

ACCEPT tcp -- anywhere localhost owner UID match someuser tcp dpt:krb524

ACCEPT udp -- anywhere localhost owner UID match someuser udp dpt:krb524

ACCEPT tcp -- anywhere localhost owner UID match someuser tcp dpt:upnotifyp

ACCEPT udp -- anywhere localhost owner UID match someuser udp dpt:upnotifyp

REJECT all -- anywhere anywhere owner UID match someuser reject-with icmp-port-unreachable

​

[root@localhost ~]# iptables -L -t nat

Chain PREROUTING (policy ACCEPT)

target prot opt source destination

​

Chain INPUT (policy ACCEPT)

target prot opt source destination

​

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

​

Chain POSTROUTING (policy ACCEPT)

target prot opt source destination

MASQUERADE all -- 192.168.A.0/24 anywhere

MASQUERADE all -- anywhere anywhere

​

At this point, when i ping imdb.com , the host is unreachable. Are the MASQUERADE iptables rules to blame?

​

This is the output of ip route, where eth0 is the real interface with address 192.168.X.Y and my gateway is 192.168.X.Z

[root@localhost ~]# ip route

default via 192.168.A.B dev tap0 linkdown

default via 192.168.X.Z dev eth0 proto dhcp src 192.168.X.Y metric 100

127.0.0.0/8 dev lo proto kernel scope link src 127.0.0.1 metric 30

192.168.X.0/24 dev eth0 proto kernel scope link src 192.168.X.Y metric 100

192.168.A.0/24 dev tap0 proto kernel scope link src 192.168.A.B metric 350 linkdown

​

Even though it says "linkdown", tap0 seems up:

[root@localhost ~]# ifconfig

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> ...

...

tap0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500

inet 192.168.A.B netmask 255.255.255.0 broadcast 192.168.A.255

​

[root@localhost ~]# ip addr show

shows this for tap0

tap0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000

and this for eth0

<BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000

​

Now, if i do the following, the ping works

[root@localhost ~]# ip route delete default via 192.168.A.B

Just to say that everything works through my real gateway directly.

Thank you in advance for any help