srsran / srsRAN_Project

Open source O-RAN 5G CU/DU solution from Software Radio Systems (SRS) https://docs.srsran.com/projects/project
https://www.srsran.com
GNU Affero General Public License v3.0
491 stars 166 forks source link

UEs Connected but can't reach the core #613

Closed mas-oliveira closed 1 month ago

mas-oliveira commented 5 months ago

Issue Description

Hello, I connected 3 UEs to the gNB, now I was trying to ping the core through the UEs but I can't.

Setup Details

I have the O-RAN SC RIC and the 5G Core running on one machine and the UEs + gNB are running on another machine.

The PRACH detector will not meet the performance requirements with the configuration {Format 0, ZCZ 0, SCS 1.25kHz, Rx ports 1}. Lower PHY in executor blocking mode.

--== srsRAN gNB (commit 1483bda30) ==--

Connecting to AMF on 10.53.1.2:38412 Available radio types: zmq. Connecting to NearRT-RIC on 10.0.2.10:36421 Cell pci=1, bw=20 MHz, 1T1R, dl_arfcn=368500 (n3), dl_freq=1842.5 MHz, dl_ssb_arfcn=368410, ul_freq=1747.5 MHz

==== gNodeB started === Type to view trace

The gNB can connect to the core and the RIC correctly. And all the UEs can connect to the gNB:

Opening 1 channels in RF device=zmq with args=tx_port=tcp://127.0.0.1:2101,rx_port=tcp://127.0.0.1:2100,base_srate=23.04e6 Supported RF device list: zmq file CHx base_srate=23.04e6 Current sample rate is 1.92 MHz with a base rate of 23.04 MHz (x12 decimation) CH0 rx_port=tcp://127.0.0.1:2100 CH0 tx_port=tcp://127.0.0.1:2101 Current sample rate is 23.04 MHz with a base rate of 23.04 MHz (x1 decimation) Current sample rate is 23.04 MHz with a base rate of 23.04 MHz (x1 decimation) Waiting PHY to initialize ... done! Attaching UE... Random Access Transmission: prach_occasion=0, preamble_index=55, ra-rnti=0x39, tti=174 Random Access Complete. c-rnti=0x4602, ta=0 RRC Connected PDU Session Establishment successful. IP: 10.45.1.2 RRC NR reconfiguration successful.

These are the routes of the UEs

sudo ip netns exec ue1 ip route show default via 10.45.1.1 dev tun_srsue 10.45.1.0/24 dev tun_srsue proto kernel scope link src 10.45.1.2

And these are the interfaces available on the machine with the gNB + UEs

marco@darlene-G5-KC:~/srsRAN_Project/build/apps/gnb$ ifconfig br-b84c28fd1d11: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 inet 10.0.2.1 netmask 255.255.255.0 broadcast 10.0.2.255 ether 02:42:d0:92:33:65 txqueuelen 0 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

docker0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255 ether 02:42:bb:11:00:0a txqueuelen 0 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

enp8s0f1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 10.42.0.130 netmask 255.255.255.0 broadcast 10.42.0.255 inet6 fe80::6721:e0e2:8fc7:ae4c prefixlen 64 scopeid 0x20 ether 80:fa:5b:96:c5:1d txqueuelen 1000 (Ethernet) RX packets 1473 bytes 280509 (280.5 KB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 6332 bytes 539234 (539.2 KB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

enx3a65b2cbdb60: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 ether 3a:65:b2:cb:db:60 txqueuelen 1000 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10 loop txqueuelen 1000 (Local Loopback) RX packets 29082748 bytes 357893898753 (357.8 GB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 29082748 bytes 357893898753 (357.8 GB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

wlp7s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 10.43.78.214 netmask 255.255.240.0 broadcast 10.43.79.255 inet6 fe80::3654:27a4:b4e9:554f prefixlen 64 scopeid 0x20 ether 08:f8:bc:67:05:74 txqueuelen 1000 (Ethernet) RX packets 15188 bytes 16668777 (16.6 MB) RX errors 0 dropped 361 overruns 0 frame 0 TX packets 10411 bytes 2069441 (2.0 MB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

Shouldn't be here a dev tun_srsue interface?

EDIT I added the ogstun interface on the machine with gNB + UEs: ogstun: flags=4241<UP,POINTOPOINT,NOARP,MULTICAST> mtu 1500 unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 500 (UNSPEC) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

And I have the following route table on UE1: $ sudo ip netns exec ue1 route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.45.1.1 0.0.0.0 UG 0 0 0 tun_srsue 10.45.1.0 0.0.0.0 255.255.255.0 U 0 0 0 tun_srsue

But I still can't reach the core $ sudo ip netns exec ue1 ping 10.45.1.1 PING 10.45.1.1 (10.45.1.1) 56(84) bytes of data. ^C --- 10.45.1.1 ping statistics --- 3 packets transmitted, 0 received, 100% packet loss, time 2043ms

Should I add a rule where the packet that hit the ogstun interface should be forward to the interface where is connected the computer with the core and the RIC?

Expected Behavior

While performing the sudo ip netns exec ue1 ping 10.45.1.1 command the UE was able to reach the core network.

Actual Behaviour

marco@darlene-G5-KC:~/Downloads$ sudo ip netns exec ue1 ping 10.45.1.1 PING 10.45.1.1 (10.45.1.1) 56(84) bytes of data. ^C --- 10.45.1.1 ping statistics --- 4 packets transmitted, 0 received, 100% packet loss, time 3072ms

mas-oliveira commented 4 months ago

Hello @pgawlowicz,

Sorry but I still having some problems. I don't know what's happening. I uploaded the docker-compose to new version.

5gc:
    container_name: open5gs_5gc
    build:
      context: open5gs
      target: open5gs
      args:
        OS_VERSION: "22.04"
        OPEN5GS_VERSION: "v2.7.0"
    env_file:
      - ${OPEN_5GS_ENV_FILE:-open5gs/open5gs.env}
    privileged: true
    ports:
      - "9999:9999/tcp"
      # Uncomment port to use the 5gc from outside the docker network
      - "15356:15356"
      - "54558:54558" ### socket ping info
      - "54559:54559" ### socket udp iperf info
      # Uncomment port to use the 5gc from outside the docker network
      - "38412:38412/sctp"
      - "2152:2152/udp"

The gNB and UEs still can connect to the core. When I try to ping 10.45.1.1 from UE1 I still can't reach the IP. Using TCP dump inside the docker 5GC image it's possible to observe that there's some error happening related with the port 2152:

root@9158e7c6600a:/open5gs# tcpdump -i any icmp
tcpdump: data link type LINUX_SLL2
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
15:44:54.461047 ogstun In  IP 10.45.1.2 > 10.45.1.1: ICMP echo request, id 15851, seq 1, length 64
15:44:54.461069 ogstun Out IP 10.45.1.1 > 10.45.1.2: ICMP echo reply, id 15851, seq 1, length 64
15:44:54.461123 eth0  In  IP marco-NUC7i7BNH > 9158e7c6600a: ICMP 10.42.0.130 udp port 2152 unreachable, length 136
15:44:55.500701 ogstun In  IP 10.45.1.2 > 10.45.1.1: ICMP echo request, id 15851, seq 2, length 64
15:44:55.500718 ogstun Out IP 10.45.1.1 > 10.45.1.2: ICMP echo reply, id 15851, seq 2, length 64
15:44:55.500773 eth0  In  IP marco-NUC7i7BNH > 9158e7c6600a: ICMP 10.42.0.130 udp port 2152 unreachable, length 136

About the interfaces on the docker 5GC image I think that the ogstun is ok and configured with all subnets.

23: ogstun: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 500
    link/none 
    inet 10.45.0.1/24 scope global ogstun
       valid_lft forever preferred_lft forever
    inet 10.45.1.1/24 scope global ogstun
       valid_lft forever preferred_lft forever
.................
root@9158e7c6600a:/open5gs# ip ro
default via 10.53.1.1 dev eth0 
10.45.0.0/24 dev ogstun proto kernel scope link src 10.45.0.1 
10.45.1.0/24 dev ogstun proto kernel scope link src 10.45.1.1 

This is the result of the ip ro command on the core computer:

marco@marco-NUC7i7BNH:~/srsRAN_Project/docker$ ip ro
default via 10.3.10.1 dev wlp58s0 proto dhcp metric 600 
10.0.2.0/24 dev br-0ae98bbb2186 proto kernel scope link src 10.0.2.1 linkdown 
10.3.10.0/24 dev wlp58s0 proto kernel scope link src 10.3.10.76 metric 600 
10.42.0.0/24 dev eno1 proto kernel scope link src 10.42.0.1 metric 100 
10.45.0.0/16 via 10.53.1.2 dev br-26141c6f72a5 
10.53.1.0/24 dev br-26141c6f72a5 proto kernel scope link src 10.53.1.1 
169.254.0.0/16 dev wlp58s0 scope link metric 1000 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
172.19.1.0/24 dev br-60b9fad393f0 proto kernel scope link src 172.19.1.1 

I have the ip forwarding enable in both machines. And we can also check that the icmp packets are arriving the core. I guess that the error could be related with any route related with the core, but I can't check which one could be wrong.

About the port 2152 it's not being used on any computer: Core computer

marco@marco-NUC7i7BNH:~/srsRAN_Project/docker$ lsof -i -n | grep 2152
marco@marco-NUC7i7BNH:~/srsRAN_Project/docker$ 

gNB + UEs computer

marco@darlene-G5-KC:~/srsRAN_4G/build/srsue/src/ue_zmq_confs$ lsof -i -n | grep 2152
marco@darlene-G5-KC:~/srsRAN_4G/build/srsue/src/ue_zmq_confs$

Thanks

pgawlowicz commented 4 months ago

what about this part in open5gs config?

      - addr: ${OPEN5GS_IP}
        advertise: 10.42.0.1
mas-oliveira commented 4 months ago

Yes, I have this:

upf:
  pfcp:
    server:
      - address: 127.0.0.7
  gtpu:
    server:
      - address: ${OPEN5GS_IP}
        advertise: 10.42.0.1
  session:
    - subnet: ${UE_GATEWAY_IP}

On ~/srsRAN_Project/docker/open5gs/open5gs-5gc.yml

I always get this message on the core docker image:

09:48:29.967831 eth0  In  IP marco-NUC7i7BNH > 337bdbe71647: ICMP 10.42.0.130 udp port 2152 unreachable, length 136

When I verify if I have anything running on port 2152 (on core image):

root@337bdbe71647:/open5gs# lsof -i -n | grep 2152
open5gs-u 1059 root   13u  IPv4  71389      0t0  UDP 10.53.1.2:2152 
open5gs-s 1061 root   25u  IPv4  73483      0t0  UDP 127.0.0.4:2152 

I also noticed that from the gNB computer I'm able to ping the core network (10.53.1.2). But, from the core (docker image) I can't ping the gNB computer (10.42.0.130)

root@337bdbe71647:/open5gs# ping 10.42.0.130
PING 10.42.0.130 (10.42.0.130) 56(84) bytes of data.
From 10.53.1.1 icmp_seq=1 Destination Port Unreachable
From 10.53.1.1 icmp_seq=2 Destination Port Unreachable
From 10.53.1.1 icmp_seq=3 Destination Port Unreachable

While doing this I can capture on the core computer using the tcpdump a weird error:


13:02:39.413461 veth99a414f P   IP 10.53.1.2 > 10.42.0.130: ICMP echo request, id 21, seq 2, length 64
13:02:39.413461 br-26141c6f72a5 In  IP 10.53.1.2 > 10.42.0.130: ICMP echo request, id 21, seq 2, length 64
13:02:39.413491 br-26141c6f72a5 Out IP marco-NUC7i7BNH > 10.53.1.2: ICMP 10.42.0.130 protocol 1 port 37438 unreachable, length 92
13:02:39.413493 veth99a414f Out IP marco-NUC7i7BNH > 10.53.1.2: ICMP 10.42.0.130 protocol 1 port 37438 unreachable, length 92

Where the marco-NUC7i7BNH is the computer running the core. And this value of port is always varying. Could this be related to some instalation error? I think this is weird because I can ping the core (10.53.1.2) using the core docker image, the core computer and the gNB computer. Or could it be related to the core computer routes:

default via 10.3.10.1 dev wlp58s0 proto dhcp metric 600 
10.0.2.0/24 dev br-0ae98bbb2186 proto kernel scope link src 10.0.2.1 linkdown 
10.3.10.0/24 dev wlp58s0 proto kernel scope link src 10.3.10.76 metric 600 
10.42.0.0/24 dev eno1 scope link 
10.45.0.0/16 via 10.53.1.2 dev br-26141c6f72a5 
10.53.1.0/24 dev br-26141c6f72a5 proto kernel scope link src 10.53.1.1 
169.254.0.0/16 dev wlp58s0 scope link metric 1000 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
172.19.1.0/24 dev br-60b9fad393f0 proto kernel scope link src 172.19.1.1 

Is this route: 10.45.0.0/16 via 10.53.1.2 dev br-26141c6f72a5 ok? Where br-26141c6f72a5 is on ip addr as:

7: br-26141c6f72a5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:fc:f1:59:7a brd ff:ff:ff:ff:ff:ff
    inet 10.53.1.1/24 brd 10.53.1.255 scope global br-26141c6f72a5
       valid_lft forever preferred_lft forever
    inet6 fe80::42:fcff:fef1:597a/64 scope link 
       valid_lft forever preferred_lft forever

These are the gNB computer routes:

marco@darlene-G5-KC:~/srsRAN_Project/build/apps/gnb$ ip ro

default via 10.42.0.1 dev enp8s0f1 proto dhcp metric 100 

default via 10.3.10.1 dev wlp7s0 proto dhcp metric 600 

10.0.2.0/24 dev br-b84c28fd1d11 proto kernel scope link src 10.0.2.1 linkdown 

10.3.10.0/24 dev wlp7s0 proto kernel scope link src 10.3.10.114 metric 600 

10.42.0.0/24 dev enp8s0f1 proto kernel scope link src 10.42.0.130 metric 100 

10.53.1.0/24 via 10.42.0.1 dev enp8s0f1 

169.254.0.0/16 dev enp8s0f1 scope link metric 1000 

172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 

172.19.1.0/24 dev br-6f53d2994d61 proto kernel scope link src 172.19.1.1 linkdown 

And I added this route on docker image:

10.42.0.0/24 via 10.53.1.1 dev eth0 

I'm using the last version of srsRAN_Project on both computers

Inside the docker image I can ping the IP of the same computer (core) 10.42.0.1, so the problem probably isn't related with the docker container isolation

mas-oliveira commented 4 months ago

Could this all be possible because I'm running everything on test branch in order to have access to oran-sc-ric later?

mas-oliveira commented 4 months ago

I can also ping 8.8.8.8 via ue1 but on the core machine (outside the docker image) it's possible to notice that the core machine can't return the info back to the UE

13:03:24.727094 br-389d2b04fd0b Out IP dns.google > 10.45.1.2: ICMP echo reply, id 63324, seq 12, length 64
13:03:24.727103 veth8863286 Out IP dns.google > 10.45.1.2: ICMP echo reply, id 63324, seq 12, length 64
13:03:24.727380 br-389d2b04fd0b Out IP marco-NUC7i7BNH > 10.53.1.2: ICMP 10.42.0.130 udp port 2152 unreachable, length 136
13:03:24.727386 veth8863286 Out IP marco-NUC7i7BNH > 10.53.1.2: ICMP 10.42.0.130 udp port 2152 unreachable, length 136

I have this routes on the core machine:

marco@marco-NUC7i7BNH:~/srsRAN_Project/docker$ ip ro
default via 10.3.10.1 dev wlp58s0 proto dhcp src 10.3.10.76 metric 600 
10.0.2.0/24 dev br-c8de9cec24d4 proto kernel scope link src 10.0.2.1 linkdown 
10.3.10.0/24 dev wlp58s0 proto kernel scope link src 10.3.10.76 metric 600 
10.42.0.0/24 dev eno1 proto kernel scope link src 10.42.0.1 metric 100 
10.45.0.0/16 via 10.53.1.2 dev br-389d2b04fd0b 
10.53.1.0/24 dev br-389d2b04fd0b proto kernel scope link src 10.53.1.1 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
172.19.1.0/24 dev br-70626228306b proto kernel scope link src 172.19.1.1 linkdown 

This one 10.45.0.0/16 via 10.53.1.2 dev br-389d2b04fd0b shouldn't be responsible for returning back the traffic to the UE?

mas-oliveira commented 4 months ago

Hello Piotr,

I was trying again to get this working.

I still with the same issue that from the container I can't ping 10.42.0.130 (gNB host IP)

Which is weird, it looks that everything is ok with the iptables and routes.

Host core (10.42.0.1)

marco@marco-NUC7i7BNH:~/srsRAN_Project/docker$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:2152
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:2152
ACCEPT     udp  --  anywhere             anywhere             udp dpt:2152
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
ACCEPT     icmp --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DOCKER-USER  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (4 references)
target     prot opt source               destination         
ACCEPT     sctp --  anywhere             10.53.1.2            sctp dpt:38412
ACCEPT     tcp  --  anywhere             10.53.1.2            tcp dpt:9999
ACCEPT     udp  --  anywhere             10.53.1.2            udp dpt:2152

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (4 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

marco@marco-NUC7i7BNH:~/srsRAN_Project/docker$ sudo lsof -i :2152
COMMAND     PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
docker-pr 38590 root    4u  IPv4 139095      0t0  UDP *:2152 
docker-pr 38596 root    4u  IPv6 139761      0t0  UDP *:2152 

marco@marco-NUC7i7BNH:~/srsRAN_Project/docker$ sudo ip ro
default via 10.3.10.1 dev wlp58s0 proto dhcp src 10.3.10.76 metric 600 
10.0.2.0/24 dev br-c8de9cec24d4 proto kernel scope link src 10.0.2.1 linkdown 
10.3.10.0/24 dev wlp58s0 proto kernel scope link src 10.3.10.76 metric 600 
10.42.0.0/24 dev eno1 proto kernel scope link src 10.42.0.1 metric 100 
10.45.0.0/16 via 10.53.1.2 dev br-389d2b04fd0b 
10.53.1.0/24 dev br-389d2b04fd0b proto kernel scope link src 10.53.1.1 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
172.19.1.0/24 dev br-70626228306b proto kernel scope link src 172.19.1.1 linkdown 

Inside docker image

root@0ac2b84f6e2d:/open5gs# iptables -L
# Warning: iptables-legacy tables present, use iptables-legacy to see them
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
root@0ac2b84f6e2d:/open5gs# lsof -i :2152
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
open5gs-u 750 root   13u  IPv4 147905      0t0  UDP 0ac2b84f6e2d:2152 
open5gs-s 752 root   26u  IPv4 145326      0t0  UDP localhost:2152 
root@0ac2b84f6e2d:/open5gs# ip ro
default via 10.53.1.1 dev eth0 
10.42.1.0/24 dev eth0 proto kernel scope link src 10.53.1.2 
10.45.0.0/24 dev ogstun proto kernel scope link src 10.45.0.1 
10.45.1.0/24 dev ogstun proto kernel scope link src 10.45.1.1 
10.45.2.0/24 dev ogstun proto kernel scope link src 10.45.2.1 
....................................................

On the gNB host (10.42.0.130)

marco@darlene-G5-KC:~/srsRAN_4G/build/srsue/src$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:2152
ACCEPT     udp  --  anywhere             anywhere             udp dpt:2152

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DOCKER-USER  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (5 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             10.53.1.2            tcp dpt:54559
ACCEPT     tcp  --  anywhere             10.53.1.2            tcp dpt:54558
ACCEPT     tcp  --  anywhere             10.53.1.2            tcp dpt:15356
ACCEPT     tcp  --  anywhere             10.53.1.2            tcp dpt:9999

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (5 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            
marco@darlene-G5-KC:~/srsRAN_4G/build/srsue/src$ sudo lsof -i :2152
COMMAND    PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
gnb     157126 root    8u  IPv4 2508212      0t0  UDP darlene-G5-KC:2152 
marco@darlene-G5-KC:~/srsRAN_4G/build/srsue/src$ sudo ip ro
default via 10.42.0.1 dev enp8s0f1 proto dhcp metric 100 
default via 10.3.10.1 dev wlp7s0 proto dhcp metric 600 
10.0.2.0/24 dev br-e802822fc2dc proto kernel scope link src 10.0.2.1 linkdown 
10.3.10.0/24 dev wlp7s0 proto kernel scope link src 10.3.10.114 metric 600 
10.42.0.0/24 dev enp8s0f1 proto kernel scope link src 10.42.0.130 metric 100 
10.53.1.0/24 via 10.42.0.1 dev enp8s0f1 
169.254.0.0/16 dev wlp7s0 scope link metric 1000 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
172.18.0.0/16 dev br-f3058b867134 proto kernel scope link src 172.18.0.1 linkdown 
172.19.1.0/24 dev br-3c63ad3d4d54 proto kernel scope link src 172.19.1.1 linkdown 

This is the packet capture when I try to ping the gNB host from the docker image executing the command:

root@0ac2b84f6e2d:/open5gs# ping 10.42.0.130
PING 10.42.0.130 (10.42.0.130) 56(84) bytes of data.
From 10.53.1.1 icmp_seq=1 Destination Port Unreachable
From 10.53.1.1 icmp_seq=2 Destination Port Unreachable

It looks like for any reason I can't access the 2152 port from the outside... image

pgawlowicz commented 1 month ago

Hi @mas-oliveira, Did you get the setup running?

mas-oliveira commented 1 month ago

Hello Piotr, yes I did.