search

libremesh / lime-packages

LibreMesh packages configuring OpenWrt for wireless mesh networking
https://libremesh.org/
GNU Affero General Public License v3.0
277 stars 96 forks source link

All routers answering to anygw IP when connected via LAN-LAN #1008

Open ilario opened 1 year ago

ilario commented 1 year ago

I first reported this issue here (first spotted by @pedro-nonfree) https://github.com/libremesh/lime-packages/issues/1007#issuecomment-1503684283 but @pony1k correctly identified that the issues are idependent.

What happens is that when one use the anygw IP (e.g. connecting to thisnode.info) gets answers from both routers, if they are connected in this way:

Laptop-ethernet portlan1-router1-lan2lan1-router2

This was observed using DSA-supported routers (PlasmaCloud PA1200 with both ports configured as LAN; Xiaomi MiRouter 4A gigabit edition) using OpenWrt 22.03 branch.

Seems that this should be avoided by these rules: https://github.com/libremesh/lime-packages/blob/8aa007e456d3cc98fd45997689624dbbeade3c7b/packages/lime-proto-anygw/files/etc/init.d/lime-anygw-ebtables#L9-L10

G10h4ck commented 1 year ago

In case of non-DSA hardware switches, those rules does not even see the packets because they are switched directly by the switching chip without pushing them to the CPU and then to the kernel.

In case of DSA hardware switch it probably depends on the implementation, reading a bunch of kernel and driver code should help deciphering this.

G10h4ck commented 1 year ago

anyway one should not use AnyGW IP for SSH or similar things, having the lime-app responding on that IP is already an usability compromise

LaneaLucy commented 1 year ago

Shouldn't there be ground routing set, if you connect 2 lime systems over cable, which by default uses different vlans, which again solves the problem, that the CPU don't see the packets?

G10h4ck commented 1 year ago

Shouldn't there be ground routing set, if you connect 2 lime systems over cable, which by default uses different vlans, which again solves the problem, that the CPU don't see the packets?

That is a possibility but it doesn't happen automatically