Linux VRF Aware SSH – Configuration Guide

azurelinux-networkingssh

I am trying to create a management vrf for a linux device (it is in Azure) which is on eth0, while using eth1 and eth2 as packet forwarding interfaces. So far using the Cumulus guides I am using this config:

sudo ip link add mgmt-vrf type vrf table 10
ip link set dev mgmt-vrf up
ip route add table 10 unreachable default metric 4278198272
sudo ip link set dev eth0 master mgmt-vrf
sudo ip route add table 10 0.0.0.0/0 dev eth0 via 10.40.255.1

I believe this should work, and I get sensible output:

ip -br link show vrf mgmt-vrf
eth0             UP             00:22:48:00:d4:8b <BROADCAST,MULTICAST,UP,LOWER_UP>

ip vrf show
Name              Table
-----------------------
mgmt-vrf            10

when I run a tcpdump, it's fairly obvious that SSH isn't responding:

sudo tcpdump -i eth0 !(port 80 or 53) -nn
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
11:17:56.843175 IP 10.26.0.112.55756 > 10.40.255.4.22: Flags [S], seq 782432837, win 64960, options [nop,wscale 8,nop,nop,sackOK], length 0
11:17:58.011786 ARP, Request who-has 10.40.255.1 tell 10.40.255.4, length 28
11:17:58.012169 ARP, Reply 10.40.255.1 is-at 12:34:56:78:9a:bc, length 28
11:17:59.956102 IP 10.26.0.112.55756 > 10.40.255.4.22: Flags [S], seq 782432837, win 64960, options [nop,wscale 8,nop,nop,sackOK], length 0
11:18:05.845234 IP 10.26.0.112.55756 > 10.40.255.4.22: Flags [S], seq 782432837, win 64960, options [nop,wscale 8,nop,nop,sackOK], length 0

As I understand it, VRF isn't a network namespace, so I can't run SSH under the namespace. also I've run the following:

sudo sysctl -w net.ipv4.tcp_l3mdev_accept=1
sudo sysctl -w net.ipv4.udp_l3mdev_accept=1

But still no joy. Thanks for help

EDIT

ip -4 r ls table 10
unreachable default
10.26.0.0/21 via 10.40.255.1 dev eth0
broadcast 10.40.255.0 dev eth0 proto kernel scope link src 10.40.255.4
10.40.255.0/24 dev eth0 proto kernel scope link src 10.40.255.4
local 10.40.255.4 dev eth0 proto kernel scope host src 10.40.255.4
broadcast 10.40.255.255 dev eth0 proto kernel scope link src 10.40.255.4

ip route get 10.40.255.4 from 10.26.0.112 iif eth0
local 10.40.255.4 from 10.26.0.112 dev mgmt-vrf table 10
    cache <local> iif eth0

ip route get 10.26.0.112 from 10.40.255.4
10.26.0.112 from 10.40.255.4 via 10.40.0.1 dev eth1 uid 1000
    cache

ip route get 10.26.0.1 from 10.40.255.4 vrf mgmt-vrf
10.26.0.1 from 10.40.255.4 via 10.40.255.1 dev eth0 table 10 uid 1000
    cache

In addition the tcpdump is no longer resolving the host IP address and I am unable to ping the local interface, almost as if the services are no longer available in this VRF and the sysctl mdev commands had no effect. Hope this helps

Best Answer

thanks for the help I managed to crack the issue

I have IPtables configured to accept INPUT on the eth0 mgmt-vrf interface as per:

sudo iptables -L -v
136M ACCEPT     all  --  eth0   any     anywhere             anywhere

this does reference the slave device, but on here: https://www.kernel.org/doc/Documentation/networking/vrf.txt

I found that you also need to reference the master device, so added the rule

sudo iptables -A INPUT -i mgmt-vrf -j ACCEPT

This fixed the issue for me

Thanks for all your help - helped nudge me in the right direction

Related Topic