Routing issue with bridged connection

Question

I had a problem setting up a wired to wireless bridge on my Raspberry Pi box - but that is now fixed - Wired to wireless bridge in Linux - but the consequence seems to be that the squid proxy server that was running on the box now fails - eg many things time out as a TCP_MISS. (See below: this seems to be an issue about packets being routed outside my network - connections inside my network work fine)

How can I set the squid server up to work again?

The eth0 has no ip4 address, the wlan0 has no ip4 address, br0 does. But they all have ip6 addresses - though I am not using ip6.

I can use ssh to login both into and out of the RasPi, and Squid requests are reaching it...

Update: Clearly I have some routing problem. Just pinged an external address from the RasPi box and five pings took 80244ms! No packets dropped though. My routing table looks perfectly normal...

pi@raspberrypi ~ $ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.62.1    0.0.0.0         UG    0      0        0 br0
192.168.62.0    0.0.0.0         255.255.255.0   U     0      0        0 br0

Further update: I have no problem with routing packets inside my network but there is plainly a big issue with packets from this machine going externally.

Answer 1

You are really going for the advanced setup here. I'm guessing if you ping your gateway, 192.168.62.1 you get something under 20ms? And pinging 8.8.8.8 (google) gives you 80 sec.

Run a traceroute 8.8.8.8

Your first hop should be quick to 192.168.62.1, second should be to your ISPs Gateway. Traceroute takes longer to complete than a normal ping so don't let that worry you.

If your first 2 hops are different, there could be a network loop, or even a QoS issue.

As for squid, are you running a forward or reverse proxy? Reverse proxy handles requests coming onto a server / network and redirecting them, etc. Forward proxy probably caches external facing requests and logs them, etc.

There is probably no reason why you can't run a proxy on a bridge, but I don't think it's ever done in practice, because a bridge is intended to blindly pass traffic, while a proxy does the opposite.

IPv6 is something you don't want or need at this point. Depending on your ISP and router setup it can provide basically direct (unNATed) access to devices on your network. I don't think it's causing your problem, but if you turn it off it eliminates it as an issue and security risk.

On your debian box, echo net.ipv6.conf.all.disable_ipv6=1 > /etc/sysctl.d/disableipv6.conf

I do see a small issue with your routing table. You may have conflicting metrics. Normally, I think your gateway metric should be 0 which it is, but your LAN metric is also 0, I think it should be 1 or more.

I would try changing it. ip route del 192.168.62.0/24 dev br0 proto kernel scope link src 192.168.62.[your ip] metric 0 then ip route add 192.168.62.0/24 dev br0 proto kernel scope link src 192.168.62.[your ip] metric 2

Then try the pings and traceroutes again.