{"action":"created","issue":{"url":"https://api.github.com/repos/weaveworks/weave/issues/2354","repository_url":"https://api.github.com/repos/weaveworks/weave","labels_url":"https://api.github.com/repos/weaveworks/weave/issues/2354/labels{/name}","comments_url":"https://api.github.com/repos/weaveworks/weave/issues/2354/comments","events_url":"https://api.github.com/repos/weaveworks/weave/issues/2354/events","html_url":"https://github.com/weaveworks/weave/issues/2354","id":159453057,"number":2354,"title":"Cannot connect TCP/UDP between containers on different hosts when using sleeve mode","user":{"login":"deitch","id":282526,"avatar_url":"https://avatars.githubusercontent.com/u/282526?v=3","gravatar_id":"","url":"https://api.github.com/users/deitch","html_url":"https://github.com/deitch","followers_url":"https://api.github.com/users/deitch/followers","following_url":"https://api.github.com/users/deitch/following{/other_user}","gists_url":"https://api.github.com/users/deitch/gists{/gist_id}","starred_url":"https://api.github.com/users/deitch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deitch/subscriptions","organizations_url":"https://api.github.com/users/deitch/orgs","repos_url":"https://api.github.com/users/deitch/repos","events_url":"https://api.github.com/users/deitch/events{/privacy}","received_events_url":"https://api.github.com/users/deitch/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"bboreham","id":8125524,"avatar_url":"https://avatars.githubusercontent.com/u/8125524?v=3","gravatar_id":"","url":"https://api.github.com/users/bboreham","html_url":"https://github.com/bboreham","followers_url":"https://api.github.com/users/bboreham/followers","following_url":"https://api.github.com/users/bboreham/following{/other_user}","gists_url":"https://api.github.com/users/bboreham/gists{/gist_id}","starred_url":"https://api.github.com/users/bboreham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bboreham/subscriptions","organizations_url":"https://api.github.com/users/bboreham/orgs","repos_url":"https://api.github.com/users/bboreham/repos","events_url":"https://api.github.com/users/bboreham/events{/privacy}","received_events_url":"https://api.github.com/users/bboreham/received_events","type":"User","site_admin":false},"milestone":null,"comments":19,"created_at":"2016-06-09T16:32:45Z","updated_at":"2016-06-10T15:39:05Z","closed_at":null,"body":"2 hosts source1@10.99.101.129 and target1@10.99.101.131 running on CentOS 7, latest version of weave on both hosts:\r\n\r\n````\r\n[root@target1 ~]# weave version\r\nweave script 1.5.2\r\nweave router 1.5.2\r\nweave proxy  1.5.2\r\nweave plugin 1.5.2\r\n````\r\n\r\n* weave with fastdp: WORKS \r\n* weave with sleeve mode: \r\n  * containers on the same host: WORKS\r\n  * containers on different hosts: FAILS. icmp ping is fine, but tcp and udp packets do not respond.\r\n\r\nIt is not firewalld:\r\n\r\n1. I added 192.168.0.0/16 that weave is using to trusted zones\r\n2. I ran `watch -n 2 -d iptables -nvL FORWARD` and `watch -n 2 -d iptables -nvL INPUT` and see the packets accepted (whereas they were rejected before I added 192.168.0.0/16 to the trusted zone)\r\n\r\nI have netserver running on port 7002 in container address 192.168.0.1 on target1, and am trying to reach it from container address 192.168.128.0 on source1. Oddly, here is what I see what I run tcpdump on either container while doing the simple `telnet 192.168.0.1 7002`:\r\n\r\n````\r\n16:21:48.499767 IP 192.168.128.0.36558 > 192.168.0.1.7002: Flags [S], seq 2020838195, win 27400, options [mss 1370,sackOK,TS val 1552792 ecr 0,nop,wscale 8], length 0\r\n16:21:48.501464 IP 192.168.0.1.7002 > 192.168.128.0.36558: Flags [S.], seq 1921444052, ack 2020838196, win 43690, options [mss 65495,sackOK,TS val 1476106 ecr 1549786,nop,wscale 8]\r\n````\r\n\r\n`SYN` -> `SYN-ACK` -> (nothing)\r\n\r\nIf I strace the net server process, I see it waiting on the file description. It never responds, which means that the kernel never establishes the TCP connection to hand back to it.\r\n\r\nEven if I stop firewalld entirely, I still have the same issue.\r\n\r\nWhat basic thing am I missing here? Why is it not sending the final `ACK`? And even tcpdump on source1 is seeing the `SYN-ACK`, but not responding? Shouldn't the kernel be doing this?\r\n"},"comment":{"url":"https://api.github.com/repos/weaveworks/weave/issues/comments/225217503","html_url":"https://github.com/weaveworks/weave/issues/2354#issuecomment-225217503","issue_url":"https://api.github.com/repos/weaveworks/weave/issues/2354","id":225217503,"user":{"login":"deitch","id":282526,"avatar_url":"https://avatars.githubusercontent.com/u/282526?v=3","gravatar_id":"","url":"https://api.github.com/users/deitch","html_url":"https://github.com/deitch","followers_url":"https://api.github.com/users/deitch/followers","following_url":"https://api.github.com/users/deitch/following{/other_user}","gists_url":"https://api.github.com/users/deitch/gists{/gist_id}","starred_url":"https://api.github.com/users/deitch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deitch/subscriptions","organizations_url":"https://api.github.com/users/deitch/orgs","repos_url":"https://api.github.com/users/deitch/repos","events_url":"https://api.github.com/users/deitch/events{/privacy}","received_events_url":"https://api.github.com/users/deitch/received_events","type":"User","site_admin":false},"created_at":"2016-06-10T15:39:05Z","updated_at":"2016-06-10T15:39:05Z","body":"Sure, I will run netcat (which my laptop keeps auto-correcting to \"nectar\"...) and tcpdump.\r\n\r\nI figure *something* in the environment is off, but I want to know.\r\n\r\nI need to go offline for the weekend in ~45 mins, so I will get it done before."}}
{"actor":{"display_login":"deitch"}}