Try   HackMD

IPA - VPN Passthrough and Tunneling

VPN Passthrough

L2TP / IPSEC

  • In modern computers, the L2TP tunnel usually works with IPSEC to establish a secure tunnel. And if the computer is behind a NAT, the IPSEC will use UDP port 500 and 4500 to traverse the firewall.
    So the IPA can accelerate these packets as normal UDP packets.
 # cat /tmp/test | grep 219.100.37.201
 udp      17 26 src=10.122.43.223 dst=219.100.37.201 sport=4500 dport=4500 [UNREPLIED] src=219.100.37.201 dst=10.122.43.223 sport=4500 dport=4500 mark=0 secctx=system_u:object_r:unlabeled_t:s15:c0.c1023 use=1
 udp      17 25 src=10.122.43.223 dst=219.100.37.201 sport=500 dport=500 [UNREPLIED] src=219.100.37.201 dst=10.122.43.223 sport=500 dport=500 mark=0 secctx=system_u:object_r:unlabeled_t:s15:c0.c1023 use=1

GRE L2/L3

  • There is an option in IPACM_cfg.xml to configure the GRE setting.
  • When it is enabled, it will add a static rule for GRE packets in ip4_nat.
  • It currently can not support multiple APNs, because it is a static rule and can not choose the outgoing APN.
 # cat /etc/data/ipa/IPACM_cfg.xml

 <GREFlag>
  <GREEnabled>1</GREEnabled>
  <GREServer>11.0.1.100</GREServer>
 </GREFlag>
# cat /sys/kernel/debug/ipa/ip4_nat && dmesg -c

 (SRAM based table) ipaNatTable_Expansion Table:
 Entry_Index=64
         Private_IP=11.0.1.200  Target_IP=11.0.1.100
         Next_Index=0  Public_Port=0
         Private_Port=0  Target_Port=0
         IP_CKSM_delta=0xce94  Enable=true  Redirect=Fwd_to_route
         Time_stamp=0x0 Proto=47
         Prev_Index=38  Indx_tbl_entry=46
         TCP_UDP_cksum_delta=0x0
         PDN_Index=0
         ucp=Disabled address=Local uc_activation_index=0

VPN Tunnel - EoGRE

  • The new platform SDX62 supports for creating a layer 2 GRE (EoGRE) tunnel on ODU, so the layer 2 header of IAD packets can be encapsulated and sent to another site in the core network.
  • It is necessary to configure the remote EoGRE server address when enabling it by the ioctl IPA_IOC_ADD_EoGRE_MAPPING.
  • After testing, it was found that only the downlink traffic can go through the IPA, and the uplink traffic is still handled by the Linux kernel.
 # cat /sys/kernel/debug/ipa/ip4_rt && dmesg -c

 [ 2511.252621] Hashable table resides on system (ddr) memory
 [ 2511.252645] Non-Hashable table resides on system (ddr) memory
 [ 2511.252653] tbl_idx:13 tbl_name:COMRTBLLANv4 tbl_ref:1
 [ 2511.252670] rule_idx:0 dst:109 ep:26 S:0
 [ 2511.252674] proc_ctx[32B]:90 attrib_mask:0000000c
 [ 2511.252678] rule_id:6 max_prio:0 prio:1
 [ 2511.252681] enable_stats:0 counter_id:0
 [ 2511.252684] hashable:1 retain_hdr:1
 [ 2511.252687] close_aggr_irq_mod: 0
 [ 2511.252698] src_addr:11.0.1.100 src_addr_mask:255.255.255.255 dst_addr:11.0.1.200 dst_addr_mask:255.255.255.255
 # cat /sys/kernel/debug/ipa/hdr && dmesg -c

 [ 2628.559158] Table on local memory:
 [ 2628.559206] Used offsets: 1 * 8 bytes, 1 * 24 bytes,
 [ 2628.559215] Free offsets: 6 * 16 bytes,
 [ 2628.559254] name:IPACM_EoGRE_v4 len=24 ref=3 partial=0 type=IPA_HDR_L2_802_1Q ofst=26 45000000000040003f2f00000b0001c80b00016400006558
 [ 2628.559275] name:ipa_lan_hdr len=2 ref=2 partial=0 type=IPA_HDR_L2_NONE ofst=0 0000
 [ 2628.559283] Table on system (ddr) memory:
 [ 2628.559297] Used offsets: 7 * 8 bytes, 2 * 16 bytes,
 [ 2628.559301] Free offsets:
 [ 2628.559329] name:eth0_ipv6 len=14 ref=1 partial=1 type=IPA_HDR_L2_ETHERNET_II ofst=14 000000000000bacc96f4415a86dd
 [ 2628.559358] name:eth0_ipv4 len=14 ref=1 partial=1 type=IPA_HDR_L2_ETHERNET_II ofst=18 000000000000bacc96f4415a0800
 [ 2628.559381] name:dmux_hdr_v4_6 len=8 ref=1 partial=0 type=IPA_HDR_L2_NONE ofst=12 4006000004800000
 [ 2628.559402] name:dmux_hdr_v4_5 len=8 ref=1 partial=0 type=IPA_HDR_L2_NONE ofst=10 4005000004800000
 [ 2628.559424] name:dmux_hdr_v4_4 len=8 ref=1 partial=0 type=IPA_HDR_L2_NONE ofst=8 4004000004800000
 [ 2628.559445] name:dmux_hdr_v4_3 len=8 ref=1 partial=0 type=IPA_HDR_L2_NONE ofst=6 4003000004800000
 [ 2628.559467] name:dmux_hdr_v4_2 len=8 ref=1 partial=0 type=IPA_HDR_L2_NONE ofst=4 4002000004800000
 [ 2628.559489] name:dmux_hdr_v4_1 len=8 ref=2 partial=0 type=IPA_HDR_L2_NONE ofst=2 4001000004800000
 [ 2628.559510] name:ipa_qmap_hdr len=8 ref=5 partial=0 type=IPA_HDR_L2_NONE ofst=0 4000000004800000