1

I'm trying to set up a testbench for a transparent device (called TD from now on). The goal is to make sure it forwards and logs correctly. I need to use just 1 machine + the TD in the test bench. Yes, two machines would be easier, but I've been asked to look into using just one. Something like this:

+–––––––––––––––––––––––––+
|          Linux          |
+––––––––––––+––––––––––––+
|    eth1    |    eth2    |
|  10.0.0.1  |  11.0.0.1  |
+–––––––+–-––+–––-+–––––––+
        |         |               
        |         |         
     +––+-–––––––-+––+       
     |  Transparent  |     
     |    Device     |     
     +–––––––––––––––+

I'm not sure it's even possible, but the goal is this: on the Linux box I can send any ip traffic to 11.0.0.1 and have it routed out eth1, logged on the TD, and recieved on eth2. Same goes for the other direction. I want my test script to just use the normal linux IP stack by opening sockets on 10.0.0.1 and 11.0.0.1, sending test data down one and seeing if it was recieved by the other.

I've looked at these already, with no success:

  • https://stackoverflow.com/a/8539870/375735
    • I can get it half working. If I remove 10.0.0.2 from the local routing table, re-add it as a unicastbut, and add the arp entry I can then ping 10.0.0.2 and see the echo requests go where I want them. No replies though. When I try to do the other half (no local entries in the local table), ping fails with "connect: invalid argument".
  • https://serverfault.com/a/586347/216716
    • The linux box doesn't have network namespaces.
  • https://serverfault.com/a/128680
    • Still playing with this, but no success yet. The setup is a little different, of course, since the TD is not a router.
Community
  • 1
Ben Barbour
  • 111
  • 1
  • I think that as per your second link, you need to set up source and policy based routing, ie have 2 namespaces. You can then use IPTables mangle to direct the traffic appropriately. – davidgo Apr 16 '14 at 20:08
  • The linux machine I'm using is old and doesn't actually have network namespaces, so that was a no go. I did manage to get http://serverfault.com/a/309442 working - although the "fake" ips are a bit annoying. It would be great to have a solution that didn't require them. – Ben Barbour Apr 16 '14 at 21:35

0 Answers0