Differences

This shows you the differences between two versions of the page.

--- hardware:gretunnel [2019/01/05 17:41] – created veera
+++ hardware:gretunnel [2023/04/10 20:06] (current) – [Setting up a GRE Tunnel to send Netflow to remote machine] veera
@@ Line 1: / Line 1: @@
+====== Setting up a GRE Tunnel to send Netflow to remote machine ======
+This document explains how to setup a point to point GRE Tunnel which will be used to route Netflow packets to a remote Trisul.
-On the gateway machine
+The gateway machine is at one end of the tunnel, the Trisul server is at the other end. All  your routers can send Netflow to the Gateway machine on port 2055, or 5111. They will be send to the Trisul server through the tunnel.
+Substitute the following settings in this guide to suit your environment
+  - Trisul Probe real IP :  192.168.2.99
+  - Gateway Node real IP :  192.169.2.81    (both should be able to ping each other)
+  - Port used : UDP 5111
+  - GRE tunnel for the point to point tunnel : 10.200.200.200/30  (not visible outside)
+===== Ensure kernel module ip_gre is loaded  =====
+On the machine ensure the ip_gre kernel module is loaded. If you are using a LXC or Docker container ensure the kernel on the host has the module loaded
 <code>
-  ip tunnel add gre1 mode gre remote 192.168.2.99 local 192.168.2.81 ttl 255
-  ip link set gre0 up
+modprobe ip_gre
-  ip link set gre1 up
-  ip addr add 10.10.10.81/24 dev gre1
 </code>
-Confirm the route is present
+Loading this kernel module will create a device called gre0
+===== Setup GRE on the gateway node =====
+On the gateway machine with IP 192.169.2.81
+Stop firewalld or ufw
 <code>
-ip route
+#ubuntu
+ufw disable
+#rhel
+systemctl stop firewalld
+</code>
-.10.10.0/24 dev gre1 proto kernel scope link src 10.10.10.99
+The tunnel address 10.200.200.201
+<code>
+ip tunnel add gre1 mode gre remote 192.168.2.99 local 192.168.2.81 ttl 255
+ip link set gre1 up
+ip addr add 10.200.200.201/30 dev gre1
+</code>
+Now the interface **gre1** must be up and ready
+<code>
+# ip route
+.200.200.200/30 dev gre1 proto kernel scope link src 10.10.10.99
 .17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
 .168.2.0/24 dev enp2s0 proto kernel scope link src 192.168.2.99
 </code>
-Use IPTables to NAT to the remote GRE
+===== Use IPTables to DNAT to the remote GRE =====
+On the gateway node.
 <code>
-iptables -t nat -A PREROUTING -p udp --dport 5111 -j DNAT --to-destination 10.10.10.99:5111
+iptables -t nat -A PREROUTING -p udp --dport 5111 -j DNAT --to-destination 10.200.200.202:5111
 </code>
-On the Trisul probe machine
+===== Create other side of tunnel on Trisul probe node =====
-  ip tunnel add gre1 mode gre remote 192.168.2.81  local 192.168.2.99  ttl 255
-  ip link set gre1 up
+On the Trisul probe machine with real IP 192.168.2.99
-  ip addr add  10.10.10.99/24  dev gre1
+<code>
+ip tunnel add gre1 mode gre remote 192.168.2.81  local 192.168.2.99  ttl 255
+ip link set gre1 up
+ip addr add  10.200.200.202/30  dev gre1
+</code>
+Now both sides should be able to PING the other on the 10.200.200.201 and 10.200.200.202 addresses.
+===== Run Trisul on gre1 in LIBPCAP mode =====
+Now, the Trisul Probe node will redeive all the router netflows on the **new gre1** interface.
+  - Login as admin
+  - Add the gre1 capture adapter
+  - Change the mode to libpcap - this is required to capture from the **gre1** interface
+===== Credits =====
+Creating a GRE tunnel http://ask.xmodulo.com/create-gre-tunnel-linux.html