NAT+MPD packets lost in space

Code:
[ pptp client     ] ------ [ vpn mpd5        ] ---- [ nat gateway      ] ---- [ WAN router ]
I do not understand why the request to our white network addresses from our gray network addresses through the NAT "hang in the air," or God knows where.
All the rest, ie absolutely any requests for any services on any hosts, but not our resort as a result back to the client successfully.

Gray network addresses is assigned on MPD as a second pool by the radius.

In particular, this is what happens for the DNS services

When the client 172.17.253.41 executes:
dig bmw.com @ 8.8.8.8
DNS query is successful

tcpdump on the NAT shows:
Code:
00:15:17:a3:b1:bd (oui Unknown) > 00:0c:29:91:6b:5f (oui Unknown), ethertype IPv4 (0x0800), length 67: 172.17.253.41.59508 > google-public-
dns-a.google.com.domain: 875+ A? bmw.com. (25)
00:0c:29:91:6b:5f (oui Unknown) > 00:15:17:a3:b1:bd (oui Unknown), ethertype IPv4 (0x0800), length 83: google-public-dns-a.google.com.domain > 
172.17.253.41.59508: 875 1/0/0 A origin.bmw.com (41)
00:15:17:a3:b1:bd (oui Unknown) > 00:0c:29:91:6b:5f (oui Unknown), ethertype IPv4 (0x0800), length 62: 172.17.253.41.53240 > google-public-
dns-a.google.com.domain: 60589+ A? 94. (20)
00:15:17:a3:b1:bd (oui Unknown) > 00:0c:29:91:6b:5f (oui Unknown), ethertype IPv4 (0x0800), length 62: 172.17.253.41.53240 > google-public-
dns-a.google.com.domain: 31808+ AAAA? 94. (20)
00:0c:29:91:6b:5f (oui Unknown) > 00:15:17:a3:b1:bd (oui Unknown), ethertype IPv4 (0x0800), length 137: google-public-dns-a.google.com.domain 
> 172.17.253.41.53240: 60589 NXDomain 0/1/0 (95)
00:0c:29:91:6b:5f (oui Unknown) > 00:15:17:a3:b1:bd (oui Unknown), ethertype IPv4 (0x0800), length 137: google-public-dns-a.google.com.domain 
> 172.17.253.41.53240: 31808 NXDomain 0/1/0 (95)

on the MPD:
Code:
00:15:17:a3:b1:bd (oui Unknown) > 00:0c:29:91:6b:5f (oui Unknown), ethertype IPv4 (0x0800), length 67: 172.17.253.41.59508 > google-public-
dns-a.google.com.domain: 875+ A? bmw.com. (25)
00:0c:29:91:6b:5f (oui Unknown) > 00:15:17:a3:b1:bd (oui Unknown), ethertype IPv4 (0x0800), length 83: google-public-dns-a.google.com.domain > 
172.17.253.41.59508: 875 1/0/0 A origin.bmw.com (41)
00:15:17:a3:b1:bd (oui Unknown) > 00:0c:29:91:6b:5f (oui Unknown), ethertype IPv4 (0x0800), length 62: 172.17.253.41.53240 > google-public-
dns-a.google.com.domain: 60589+ A? 94. (20)
00:15:17:a3:b1:bd (oui Unknown) > 00:0c:29:91:6b:5f (oui Unknown), ethertype IPv4 (0x0800), length 62: 172.17.253.41.53240 > google-public-
dns-a.google.com.domain: 31808+ AAAA? 94. (20)
00:0c:29:91:6b:5f (oui Unknown) > 00:15:17:a3:b1:bd (oui Unknown), ethertype IPv4 (0x0800), length 137: google-public-dns-a.google.com.domain 
> 172.17.253.41.53240: 60589 NXDomain 0/1/0 (95)
00:0c:29:91:6b:5f (oui Unknown) > 00:15:17:a3:b1:bd (oui Unknown), ethertype IPv4 (0x0800), length 137: google-public-dns-a.google.com.domain 
> 172.17.253.41.53240: 31808 NXDomain 0/1/0 (95)


When the client 172.17.253.41 executes:
dig bmw.com @ 94.232.184.42
DNS query fails


tcpdump on the NAT shows:
Code:
00:15:17:a3:b1:bd (oui Unknown) > 00:0c:29:91:6b:5f (oui Unknown), ethertype IPv4 (0x0800), length 67: 172.17.253.41.52234 > 
94.232.184.42.domain: 27503+ A? bmw.com. (25)
00:0c:29:91:6b:5f (oui Unknown) > 00:15:17:a3:b1:bd (oui Unknown), ethertype IPv4 (0x0800), length 486: 94.232.184.42.domain > 
172.17.253.41.52234: 27503 1/13/12 A origin.bmw.com (444)
00:15:17:a3:b1:bd (oui Unknown) > 00:0c:29:91:6b:5f (oui Unknown), ethertype IPv4 (0x0800), length 67: 172.17.253.41.52234 > 
94.232.184.42.domain: 27503+ A? bmw.com. (25)
00:0c:29:91:6b:5f (oui Unknown) > 00:15:17:a3:b1:bd (oui Unknown), ethertype IPv4 (0x0800), length 486: 94.232.184.42.domain > 
172.17.253.41.52234: 27503 1/13/12 A origin.bmw.com (444)

on the MPD:
Code:
00:15:17:a3:b1:bd (oui Unknown) > 00:0c:29:91:6b:5f (oui Unknown), ethertype IPv4 (0x0800), length 67: 172.17.253.41.52234 > 
94.232.184.42.domain: 27503+ A? bmw.com. (25)
00:15:17:a3:b1:bd (oui Unknown) > 00:0c:29:91:6b:5f (oui Unknown), ethertype IPv4 (0x0800), length 67: 172.17.253.41.52234 > 
94.232.184.42.domain: 27503+ A? bmw.com. (25)

All requests to any server of our white network, ie eg http also hangs in the air.
 
I have tried to reconfigure Gateway-NAT on freebsd wtih ipfw natd, ipfw nat, pf and on linux with iptables, In all cases i have this bug.
It's seems to be bug in virtual system because machine was virtualised on it and also , with testing machine on another brand virtual system there was no problem. Thanx for your attention.

PS: Also may be some different routing policy between NAT-Gateway and MPD.
PS2: Sure, routing policy on switches with acls based on source ip address. Not routing on these two hosts.
 
SOLVED. Finally, the reason is an ACL on switches between. Any virtual platform is not guilty.
 
Back
Top