http://bugzilla.suse.com/show_bug.cgi?id=916771 Chenzi Cao changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chcao@suse.com Assignee|bnc-team-screening@forge.pr |meissner@suse.com |ovo.novell.com | --- Comment #1 from Chenzi Cao --- Hi Marcus, would you please kindly help to have a look at here? I'm not quite sure whether it is right to assign it to you, please feel free to reassign whenever necessary, thank you! -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=916771 Thomas Wagner changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(wagner-thomas@gmx | |.at) | --- Comment #3 from Thomas Wagner --- (In reply to Marcus Meissner from comment #2)

what kind of network device does sshuttle create? Apparently, sshuttle does not create a network device. It just manipulates some NAT rules with iptables. Here is the log output of sshuttle's iptables (instead of X.X.X.X the IP of my ssh server appears):

...

iptables -t nat -N sshuttle-12300 iptables -t nat -F sshuttle-12300 iptables -t nat -I OUTPUT 1 -j sshuttle-12300 iptables -t nat -I PREROUTING 1 -j sshuttle-12300 iptables -t nat -A sshuttle-12300 -j RETURN --dest 127.0.0.0/8 -p tcp iptables -t nat -A sshuttle-12300 -j REDIRECT --dest 0.0.0.0/0 -p tcp --to-ports 12300 -m ttl ! --ttl 42 iptables -t nat -A sshuttle-12300 -j REDIRECT --dest X.X.X.X/32 -p udp --dport 53 --to-ports 12300 -m ttl ! --ttl 42

how does the network setup look afterwards? Sorry, I don't really understand that question. The network setup is simple. One client machine (tested with wlan and ethernet connection of my laptop and a KVM machine) and a ssh server (tested via NAT and on the local network).

-- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=916771 http://bugzilla.suse.com/show_bug.cgi?id=916771#c5 Carl Thompson changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |x-suse@carlthompson.net --- Comment #5 from Carl Thompson --- The problem is the FW_LO_NOTRACK option turned on by default in the openSUSE firewall. From the description: "Install NOTRACK target for interface lo in the raw table. Doing so speeds up packet processing on the loopback interface. This breaks certain firewall setups that need to e.g. redirect outgoing packets via custom rules on the local machine." This option breaks sshuttle. To fix it, edit the /etc/sysconfig/SuSEfirewall2 file and change the line with FW_LO_NOTRACK to FW_LO_NOTRACK="no" Save the file, restart the firewall or reboot and sshuttle will work from then on. Personally, I believe this feature of the firewall should NOT be turned on by default. The default should always be the correct / expected behavior and circumventing correct behavior for a performance boost should be opt-in, not opt-out. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=916771 http://bugzilla.suse.com/show_bug.cgi?id=916771#c8 Matthias Gerstner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED --- Comment #8 from Matthias Gerstner --- New firewall maintainer here. I'm working on the backlog bugs. I understand the original issue has been solved via configuration of FW_LO_NOTRACK="no". I agree that this kind of optimization should not be the default. I will consider this for future updates of SuSEfirewall2. Keeping this ticket open to keep track of that. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=916771 http://bugzilla.suse.com/show_bug.cgi?id=916771#c10 Matthias Gerstner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #10 from Matthias Gerstner --- I've changed the default for this to "no" for openSUSE:Factory and SLE-12-SP3. Submissions have been accepted by now, so I'm closing the ticket. -- You are receiving this mail because: You are on the CC list for the bug.