GRE tunnel ExtraIP.com

[JesperV]

Hello,

I am trying to setup a GRE tunnel with ExtraIP.com. They provide a few documents about different firewalls, but not fortigate.

I've setup a tunnel with the following config:

config system gre-tunnel
edit "ExtraIP"
set interface "VLAN100" //VLAN 100 is my WAN connection from my provider
set remote-gw (REMOTE GW OF EXTRAIP)
set local-gw (MY PUBLIC IP)
next
end

config system interface
    edit "ExtraIP"
        set type tunnel
        set interface "ExtraIP"
        set allowaccess ping
        set alias "ExtraIP GRE"
        set ip (SECOND IP OF /29)/32
    next
end

When I check the diag sniffer with this command

diag sniffer packet wan1 "host (ExtraIP Gateway)" 4

I get only packets comming in, there are no packets going out

0.593645 VLAN100 in (ExtraIP GW) -> (My Public IP): gre: length 50 proto-800
1.929499 VLAN100 in (ExtraIP GW) -> (My Public IP): gre: length 70 proto-800

And when I assign port 443 via VIP and firewall policy to a linux server with nginx, I get ERR_CONNECTION_TIMED_OUT

Can anyone help me troubleshoot, I've been busy for over 2 hours without any luck

[AEK]

Hi Jesper

Did you configure the required routes and firewall policies?

You can take example from this tech tip.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-and-verifying-a-GRE-tunnel-bet...

[JesperV]

Hi AEK,

I do have a route with destination the ExtraIP Gateway, that is routed through vlan100 (WAN).

I don't want my servers talking to the outside world with the extra ip's, I only want some HTTPS servers being port-forwarded. The servers can talk with my ISP public ip to the outside world, so I have no 0.0.0.0 route to the extraip tunnel.

What I do have working is that on my local pc, I am able to go to the first available IP in my subnet and my webserver is reachable. but to the outside world it is not available.

I have the following firewall rules:

LAN to ExtraIP

ExtraIP to LAN

Do I need to add these as well, or does this not matter:

ExtraIP to VLAN100

VLAN100 to ExtraIP

[AEK]

What do you get when you run these commands?

get router info routing-table all    # check if you see the GRE route
diag sys gre list
diag netlink interface list | grep -A1 "ExtraIP"

[JesperV]

get router info routing-table all:
S 185.216.160.***/32 [10/0] via 62.45.(ISP GATEWAY), VLAN100 <--- ExtraIP Gateway
S 185.216.161.***/29 [10/0] is directly connected, ExtraIP <---- My subnet

diag sys gre list:

IPv4:
vd=0 devname=ExtraIP devindex=21 ifindex=24
saddr=185.216.161.(My Subnet) daddr=185.216.160.(Remote ExtraIP) ref=0
key=0/0 flags=0/0 dscp-copy=0 diffservcode=000000
  RX bytes:4820535 (4.5 Mb)  TX bytes:14344 (14.0 kb);
  RX packets:61343, TX packets:170, TX carrier_err:2 collisions:0
  npu-info: asic_offload=0, enc/dec=0/0, enc_bk=0/0/0, dec_bk=0/0/0

total tunnel = 1

diag netlink interface list | grep -A1 "ExtraIP":

if=ExtraIP family=00 type=778 index=24 mtu=1476 link=0 master=0
ref=12 state=start present fw_flags=0 flags=up p2p run noarp multicast

[JesperV]

If I do the following:

diag sniffer packet any 'host (FIRST USABLE IP HERE)' 4

And visit that IP from my mobile with 5G internet,

I do see incomming packets from my 5g internet to that first usable ip incomming, but it still gives me a ERR_CONNECTION_TIMED_OUT.

Even though there is a firewall rule, ExtraIP -> Server Network that has a VIP in destination with 443 linking to a IP that works with 443.

[AEK]

Try with diag debug flow and it should reveal why the traffic is blocked.

diag debug enable
diag debug flow filter addr ...
diag debug console timestamp enable
diag debug flow show function-name enable
diag debug flow show iprope enable
diag debug flow trace start 100

[JesperV]

Here is a the output of that.

Spoiler

2025-05-07 13:49:53 id=20085 trace_id=242 func=print_pkt_detail line=5810 msg="vd-root:0 received a packet(proto=6, 77.63.116.194:7722->185.216.161.122:443) from ExtraIP. flag [S], seq 568359894, ack 0, win 65535"
2025-05-07 13:49:53 id=20085 trace_id=242 func=init_ip_session_common line=5981 msg="allocate a new session-0003e5ba"
2025-05-07 13:49:53 id=20085 trace_id=242 func=iprope_dnat_check line=5121 msg="in-[ExtraIP], out-[]"
2025-05-07 13:49:53 id=20085 trace_id=242 func=iprope_dnat_tree_check line=830 msg="len=1"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__iprope_check_one_dnat_policy line=4994 msg="checking gnum-100000 policy-7"
2025-05-07 13:49:53 id=20085 trace_id=242 func=get_new_addr line=1193 msg="find DNAT: IP-10.81.20.50, port-443"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__iprope_check_one_dnat_policy line=5077 msg="matched policy-7, act=accept, vip=7, flag=100, sflag=2000020"
2025-05-07 13:49:53 id=20085 trace_id=242 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000020, vid-7, ret-matched, act-accept, flag-00000100"
2025-05-07 13:49:53 id=20085 trace_id=242 func=fw_pre_route_handler line=181 msg="VIP-10.81.20.50:443, outdev-ExtraIP"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__ip_session_run_tuple line=3522 msg="DNAT 185.216.161.122:443->10.81.20.50:443"
2025-05-07 13:49:53 id=20085 trace_id=242 func=vf_ip_route_input_common line=2615 msg="find a route: flag=00000000 gw-10.81.20.50 via Server Network"
2025-05-07 13:49:53 id=20085 trace_id=242 func=iprope_fwd_check line=765 msg="in-[ExtraIP], out-[Server Network], skb_flags-020000e0, vid-7, app_id: 0, url_cat_id: 0"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__iprope_tree_check line=561 msg="gnum-100004, use addr/intf hash, len=4"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__iprope_check_one_policy line=1960 msg="checked gnum-100004 policy-22, ret-matched, act-accept"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__iprope_user_identity_check line=1777 msg="ret-matched"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__iprope_check line=2203 msg="gnum-4e20, check-5f023d28"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__iprope_check_one_policy line=1960 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__iprope_check_one_policy line=1960 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__iprope_check_one_policy line=1960 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__iprope_check line=2222 msg="gnum-4e20 check result: ret-no-match, act-accept, flag-00000000, flag2-00000000"
2025-05-07 13:49:53 id=20085 trace_id=242 func=__iprope_check_one_policy line=2174 msg="policy-22 is matched, act-accept"
2025-05-07 13:49:53 id=20085 trace_id=242 func=iprope_fwd_check line=806 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-22"
2025-05-07 13:49:53 id=20085 trace_id=242 func=iprope_fwd_auth_check line=825 msg="after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-22"
2025-05-07 13:49:53 id=20085 trace_id=242 func=fw_forward_handler line=803 msg="Allowed by Policy-22:"
2025-05-07 13:49:53 id=20085 trace_id=242 func=ipd_post_route_handler line=490 msg="out Server Network vwl_zone_id 0, state2 0x0, quality 0.
"
2025-05-07 13:49:53 id=20085 trace_id=243 func=print_pkt_detail line=5810 msg="vd-root:0 received a packet(proto=6, 10.81.20.50:443->77.63.116.194:7722) from Server Network. flag [S.], seq 2230821619, ack 568359895, win 65535"
2025-05-07 13:49:53 id=20085 trace_id=243 func=resolve_ip_tuple_fast line=5891 msg="Find an existing session, id-0003e5ba, reply direction"
2025-05-07 13:49:53 id=20085 trace_id=243 func=vf_ip_route_input_common line=2615 msg="find a route: flag=04000000 gw-62.45.170.129 via VLAN100"
2025-05-07 13:49:53 id=20085 trace_id=243 func=npu_handle_session44 line=1223 msg="Trying to offloading session from Server Network to VLAN100, skb.npu_flag=00000400 ses.state=00210200 ses.npu_state=0x00040000"
2025-05-07 13:49:53 id=20085 trace_id=243 func=fw_forward_dirty_handler line=397 msg="state=00210200, state2=00000000, npu_state=00040000"
2025-05-07 13:49:53 id=20085 trace_id=243 func=__ip_session_run_tuple line=3508 msg="SNAT 10.81.20.50->185.216.161.122:443"
2025-05-07 13:49:53 id=20085 trace_id=243 func=ipd_post_route_handler line=490 msg="out VLAN100 vwl_zone_id 0, state2 0x0, quality 0.
"

This is what chatgpt says, don't know if it is accurate:

:white_heavy_check_mark: DNAT works:
185.216.161.122:443 → 10.81.20.50:443

:white_heavy_check_mark: SNAT works (return path uses correct public IP):
10.81.20.50 → 77.63.116.194 gets SNAT'ed as 185.216.161.122

:white_heavy_check_mark: Routing works:
FortiGate routes outbound via VLAN100, which is what you intended.

:pushpin: BUT... despite all this, the client never receives the SYN-ACK.

:magnifying_glass_tilted_left: What's wrong?
The packet is being sent twice out from the firewall:

ipd_post_route_handler ... out VLAN100

But the client doesn’t receive the SYN-ACK. 

[JesperV]

Now I am getting this error:

Spoiler

2025-05-07 14:33:10 id=20085 trace_id=309 func=print_pkt_detail line=5810 msg="vd-root:0 received a packet(proto=6, 82.199.64.68:50786->185.216.161.122:443) from ExtraIP. flag [S], seq 1842012866, ack 0, win 64240"
2025-05-07 14:33:10 id=20085 trace_id=309 func=init_ip_session_common line=5981 msg="allocate a new session-00042aaf"
2025-05-07 14:33:10 id=20085 trace_id=309 func=iprope_dnat_check line=5121 msg="in-[ExtraIP], out-[]"
2025-05-07 14:33:10 id=20085 trace_id=309 func=iprope_dnat_tree_check line=830 msg="len=1"
2025-05-07 14:33:10 id=20085 trace_id=309 func=__iprope_check_one_dnat_policy line=4994 msg="checking gnum-100000 policy-7"
2025-05-07 14:33:10 id=20085 trace_id=309 func=get_new_addr line=1193 msg="find DNAT: IP-10.81.20.50, port-0"
2025-05-07 14:33:10 id=20085 trace_id=309 func=__iprope_check_one_dnat_policy line=5077 msg="matched policy-7, act=accept, vip=7, flag=100, sflag=2000020"
2025-05-07 14:33:10 id=20085 trace_id=309 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000020, vid-7, ret-matched, act-accept, flag-00000100"
2025-05-07 14:33:10 id=20085 trace_id=309 func=fw_pre_route_handler line=181 msg="VIP-10.81.20.50:443, outdev-ExtraIP"
2025-05-07 14:33:10 id=20085 trace_id=309 func=__ip_session_run_tuple line=3522 msg="DNAT 185.216.161.122:443->10.81.20.50:443"
2025-05-07 14:33:10 id=20085 trace_id=309 func=ip_route_input_slow line=2264 msg="reverse path check fail, drop"
2025-05-07 14:33:10 id=20085 trace_id=309 func=ip_session_handle_no_dst line=6065 msg="trace"
2025-05-07 14:33:10 id=20085 trace_id=310 func=print_pkt_detail line=5810 msg="vd-root:0 received a packet(proto=6, 82.199.64.68:50787->185.216.161.122:443) from ExtraIP. flag [S], seq 406690344, ack 0, win 64240"
2025-05-07 14:33:10 id=20085 trace_id=310 func=init_ip_session_common line=5981 msg="allocate a new session-00042ab1"
2025-05-07 14:33:10 id=20085 trace_id=310 func=iprope_dnat_check line=5121 msg="in-[ExtraIP], out-[]"
2025-05-07 14:33:10 id=20085 trace_id=310 func=iprope_dnat_tree_check line=830 msg="len=1"
2025-05-07 14:33:10 id=20085 trace_id=310 func=__iprope_check_one_dnat_policy line=4994 msg="checking gnum-100000 policy-7"
2025-05-07 14:33:10 id=20085 trace_id=310 func=get_new_addr line=1193 msg="find DNAT: IP-10.81.20.50, port-0"
2025-05-07 14:33:10 id=20085 trace_id=310 func=__iprope_check_one_dnat_policy line=5077 msg="matched policy-7, act=accept, vip=7, flag=100, sflag=2000020"
2025-05-07 14:33:10 id=20085 trace_id=310 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000020, vid-7, ret-matched, act-accept, flag-00000100"
2025-05-07 14:33:10 id=20085 trace_id=310 func=fw_pre_route_handler line=181 msg="VIP-10.81.20.50:443, outdev-ExtraIP"
2025-05-07 14:33:10 id=20085 trace_id=310 func=__ip_session_run_tuple line=3522 msg="DNAT 185.216.161.122:443->10.81.20.50:443"
2025-05-07 14:33:10 id=20085 trace_id=310 func=ip_route_input_slow line=2264 msg="reverse path check fail, drop"
2025-05-07 14:33:10 id=20085 trace_id=310 func=ip_session_handle_no_dst line=6065 msg="trace"

[AEK]

"reverse path check fail" means there is no route back to the source IP.

That's normal because you don't have a route to client IP through the GRE tunnel.