<stintel>
why would it forward neighbor solicitations?
<stintel>
or try to forward, firewall says no
Stat_headcrabbed has quit [Ping timeout: 480 seconds]
<dwfreed>
stintel: what device is 60:55:f9:f7:06:98, the router?
<dwfreed>
the router that produced that log message, that is
<dwfreed>
actually I think the MAC I wanted was 00:90:7f:d7:e3:07
<KanjiMonster>
stintel: forward in l3 or l2?
<dwfreed>
given hoplimit is 254 instead of 255, that appears to be an l3 forward
<KanjiMonster>
good point
<stintel>
dwfreed: indeed, 00:90:7f:d7:e3:07 is router, 60:55:f9:f7:06:98 is client
<KanjiMonster>
though that log is obviously a violation of rfc4861 "A node MUST silently discard any received Neighbor Solicitation messages that do not satisfy all of the following validity checks: ... The IP Hop Limit field has a value of 255"
<KanjiMonster>
that was not silently ;p
<stintel>
so the problem came from a wrong arp entry, vrrp setup, the client had fe80::1 associated with the mac of the router that went to backup state
<dwfreed>
KanjiMonster: that's not received, note it says "reject iot out"
<KanjiMonster>
true
<dwfreed>
stintel: ah, so the backup router was trying to forward all traffic to the active router
<stintel>
well the client was sending packets for fe80::1 to the backup router, which did not have the IP assigned to that interface, and thus decides to forward it again
<dwfreed>
yeah
<stintel>
I think the problem was vrrp_startup_delay too low
<dwfreed>
"I don't have that IP, I don't know why you sent it to me, but I do know how to reach that IP and I can forward, so let me forward that for you"
<dwfreed>
"oh wait, firewall says lolno"
<stintel>
yeah, I can see why it happens, still it seems weird to forward that kind of packet
<dwfreed>
routers do weird things
<stintel>
:P
<stintel>
ugh I should dig into this whole vrrp setup again
<stintel>
I have use_vmac enabled, but then
<stintel>
my switch is constantly complaining about the MAC flapping
<stintel>
so I enabled vmac_xmit_base
KanjiMonster has quit [Read error: Connection reset by peer]
KanjiMonster has joined #openwrt-devel
minimal has quit [Quit: Leaving]
<dwfreed>
meanwhile I'm about to attempt to transmit a routing protocol over a tunnel protocol that was not intended to carry it, with some nasty hacks
<dwfreed>
(IS-IS over wireguard, with the help of gretap, intended such that only IS-IS goes over the gretap)
<stintel>
:D
<stintel>
not only routers do weird things ;)
<jakllsch>
dwfreed: to be fair, ISIS wasn't originally intended for IP..
<dwfreed>
jakllsch: but that's the beauty of IS-IS, routing any packet protocol is just a matter of adding a few more types
<dwfreed>
OSPF had to be redesigned to implement IPv6
<KanjiMonster>
the routing protocol where searching for it might put you on some terror watch lists ;P
<SwedeMike>
you can all rejoice that in the IETF, extensions to IS-IS and OSPF are now done in the same working group, at the same time, because the protocols are very similar to what mechanisms and information they carry
<jakllsch>
there are a lot of innocuous words that do that now...