neels has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-upf/+/35668?usp=email )
Change subject: manual: explain IP forwarding
......................................................................
Patch Set 1:
(1 comment)
File doc/manuals/chapters/running.adoc:
https://gerrit.osmocom.org/c/osmo-upf/+/35668/comment/3034821b_1b92a649
PS1, Line 259: and to two specific network interfaces eth0 and eth23.
but where to put this configuration??
--
To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/35668?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-upf
Gerrit-Branch: master
Gerrit-Change-Id: I7b54f9203c1a77efd43f90b9a1c0105bc5c3efde
Gerrit-Change-Number: 35668
Gerrit-PatchSet: 1
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de>
Gerrit-CC: Jenkins Builder
Gerrit-Comment-Date: Wed, 24 Jan 2024 02:55:03 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
neels has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-upf/+/35668?usp=email )
Change subject: manual: explain IP forwarding
......................................................................
Patch Set 1: Code-Review-1
(1 comment)
Patchset:
PS1:
the IP Forwarding netfilter rules are not tested
--
To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/35668?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-upf
Gerrit-Branch: master
Gerrit-Change-Id: I7b54f9203c1a77efd43f90b9a1c0105bc5c3efde
Gerrit-Change-Number: 35668
Gerrit-PatchSet: 1
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de>
Gerrit-CC: Jenkins Builder
Gerrit-Comment-Date: Wed, 24 Jan 2024 02:54:37 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-upf/+/35664?usp=email )
Change subject: manual: fix typo in running.adoc
......................................................................
manual: fix typo in running.adoc
Change-Id: Ibb1b548f588b27b23af687e5c44d18e81bca7c87
---
M doc/manuals/chapters/running.adoc
1 file changed, 10 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-upf refs/changes/64/35664/1
diff --git a/doc/manuals/chapters/running.adoc b/doc/manuals/chapters/running.adoc
index 0f56521..5c0a7b4 100644
--- a/doc/manuals/chapters/running.adoc
+++ b/doc/manuals/chapters/running.adoc
@@ -177,4 +177,4 @@
----
When running more than one osmo-upf process on a system, pick distinct table
-names to avoid name collisions in the nftables reulesets.
+names to avoid name collisions in the nftables rulesets.
--
To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/35664?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-upf
Gerrit-Branch: master
Gerrit-Change-Id: Ibb1b548f588b27b23af687e5c44d18e81bca7c87
Gerrit-Change-Number: 35664
Gerrit-PatchSet: 1
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-MessageType: newchange
neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-upf/+/35665?usp=email )
Change subject: manual: 'Running': flatten section depths a bit
......................................................................
manual: 'Running': flatten section depths a bit
I'd like to add more sub-levels in an upcoming commit, and the levels
are becoming too many. So let's get rid of one depth level in the
'Running osmo-upf' chapter.
Change-Id: I0bd43300aa4b45315ea58ab35c77da005d1a4fa4
---
M doc/manuals/chapters/running.adoc
1 file changed, 17 insertions(+), 6 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-upf refs/changes/65/35665/1
diff --git a/doc/manuals/chapters/running.adoc b/doc/manuals/chapters/running.adoc
index 5c0a7b4..683c444 100644
--- a/doc/manuals/chapters/running.adoc
+++ b/doc/manuals/chapters/running.adoc
@@ -59,9 +59,7 @@
table-name osmo-upf-2
----
-=== Configuring Primary Links
-
-==== Configure PFCP Server
+=== Configure PFCP Server
The following example configures OsmoUPF to listen for PFCP association requests
from Control Plane Function entities on local interface 10.9.8.7, port 8805:
@@ -83,7 +81,7 @@
must not be "0.0.0.0", which is an unfortunate consequence. This is likely to
improve in the future, see https://osmocom.org/issues/5682 .
-==== Configure Linux Kernel GTP Features
+=== Linux Kernel Features
OsmoUPF uses two distinct Linux kernel features:
@@ -103,7 +101,7 @@
forwarding proxy, without encapsulation/decapsulation of GTP payloads.
[[gtp_module]]
-===== Configure Linux Kernel GTP Module for `tunend`
+=== Configure Linux Kernel GTP Module for `tunend`
The Linux kernel GTP module is used for the `tunend` use case, i.e. GTP
encapsulation/decapsulation from/to "the internet".
@@ -160,7 +158,7 @@
this GTP device. When using ANY, there should be exactly one GTP dev configured.
[[nftables]]
-===== Configure Linux netfilter for `tunmap`
+=== Configure Linux netfilter for `tunmap`
The Linux kernel netfilter module is used for GTP tunnel proxying, also known as
tunnel forwarding or tunnel mapping.
--
To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/35665?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-upf
Gerrit-Branch: master
Gerrit-Change-Id: I0bd43300aa4b45315ea58ab35c77da005d1a4fa4
Gerrit-Change-Number: 35665
Gerrit-PatchSet: 1
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-MessageType: newchange
neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-upf/+/35666?usp=email )
Change subject: manual: 'Running': tweak, mention 'tunmap' and 'tunend'
......................................................................
manual: 'Running': tweak, mention 'tunmap' and 'tunend'
Change-Id: I9760ca214933d0b05080a3e70807b0cd06380a27
---
M doc/manuals/chapters/running.adoc
1 file changed, 17 insertions(+), 4 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-upf refs/changes/66/35666/1
diff --git a/doc/manuals/chapters/running.adoc b/doc/manuals/chapters/running.adoc
index 683c444..32db271 100644
--- a/doc/manuals/chapters/running.adoc
+++ b/doc/manuals/chapters/running.adoc
@@ -85,10 +85,10 @@
OsmoUPF uses two distinct Linux kernel features:
-* The GTP module is used for GTP encapsulation/decapsulation from/to
+* The GTP module is used for `tunend`: GTP encapsulation/decapsulation from/to
"the internet".
-* The netfilter module is used for GTP tunnel proxying, also known as
+* The netfilter module is used for `tunmap`: GTP tunnel proxying, also known as
tunnel forwarding or tunnel mapping.
.Linux kernel feature usage
@@ -97,8 +97,12 @@
include::upf_gtp_roles.dot[]
----
-GTP kernel module configuration can be omitted for sites that serve only as GTP
-forwarding proxy, without encapsulation/decapsulation of GTP payloads.
+GTP kernel module configuration in the `tunend` section can be omitted for sites
+that serve only as GTP forwarding proxy, without encapsulation/decapsulation of
+GTP payloads.
+
+Likewise, netfilter configuration in the `tunmap` section can be omitted for
+sites only serving as GTP tunnel endpoint.
[[gtp_module]]
=== Configure Linux Kernel GTP Module for `tunend`
--
To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/35666?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-upf
Gerrit-Branch: master
Gerrit-Change-Id: I9760ca214933d0b05080a3e70807b0cd06380a27
Gerrit-Change-Number: 35666
Gerrit-PatchSet: 1
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-MessageType: newchange
neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-upf/+/35668?usp=email )
Change subject: manual: explain IP forwarding
......................................................................
manual: explain IP forwarding
Change-Id: I7b54f9203c1a77efd43f90b9a1c0105bc5c3efde
---
M doc/manuals/chapters/running.adoc
1 file changed, 47 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-upf refs/changes/68/35668/1
diff --git a/doc/manuals/chapters/running.adoc b/doc/manuals/chapters/running.adoc
index d1a399b..ee66970 100644
--- a/doc/manuals/chapters/running.adoc
+++ b/doc/manuals/chapters/running.adoc
@@ -167,7 +167,7 @@
The Linux kernel netfilter module is used for GTP tunnel proxying, also known as
tunnel forwarding or tunnel mapping.
-When using the netfilter module, you may set up `osmo-upf.cfg` for:
+When using the netfilter module, you should configure:
- GTP Echo (required)
- netfilter table name (optional)
@@ -220,3 +220,40 @@
When running more than one osmo-upf process on a system, pick distinct table
names to avoid name collisions in the nftables rulesets.
+
+=== IP Forwarding
+
+In order to allow the forwarding GTP payloads, the Linux operating system must
+be configured to allow IP forwarding. There are several options:
+
+To allow IP forwarding from and to all interfaces globally in a reboot-safe way,
+you may put a line like this in /etc/sysctl.conf:
+
+----
+net.ipv4.ip_forward=1
+----
+
+To do the same in an ad-hoc way that is not reboot safe but takes effect
+immediately:
+
+----
+sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"
+----
+
+The above options may be too permissive for your production environment. It is
+possible to instruct netfilter to allow IP forwarding for specific interfaces
+only, with a configuration like this:
+
+----
+define gtp_netdevs = { eth0, eth23 };
+
+table inet filter {
+ chain forward {
+ type filter hook forward priority filter; policy drop;
+ iifname $gtp_netdevs oifname $gtp_netdevs udp dport 2152 accept
+ }
+}
+----
+
+This netfilter ruleset allows IP forwarding, but limited to the GTP-U port 2152,
+and to two specific network interfaces eth0 and eth23.
--
To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/35668?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-upf
Gerrit-Branch: master
Gerrit-Change-Id: I7b54f9203c1a77efd43f90b9a1c0105bc5c3efde
Gerrit-Change-Number: 35668
Gerrit-PatchSet: 1
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-MessageType: newchange
neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-upf/+/35667?usp=email )
Change subject: manual: explain GTP Echo workaround for tunmap
......................................................................
manual: explain GTP Echo workaround for tunmap
Change-Id: Ic824fc876d1fad181254cb6894e51464c443b53c
---
M doc/manuals/chapters/running.adoc
1 file changed, 56 insertions(+), 7 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-upf refs/changes/67/35667/1
diff --git a/doc/manuals/chapters/running.adoc b/doc/manuals/chapters/running.adoc
index 32db271..d1a399b 100644
--- a/doc/manuals/chapters/running.adoc
+++ b/doc/manuals/chapters/running.adoc
@@ -99,10 +99,10 @@
GTP kernel module configuration in the `tunend` section can be omitted for sites
that serve only as GTP forwarding proxy, without encapsulation/decapsulation of
-GTP payloads.
+GTP payloads -- except to provide GTP Echo service, see <<gtp_echo>>.
-Likewise, netfilter configuration in the `tunmap` section can be omitted for
-sites only serving as GTP tunnel endpoint.
+Netfilter configuration in the `tunmap` section can be omitted for sites only
+serving as GTP tunnel endpoint.
[[gtp_module]]
=== Configure Linux Kernel GTP Module for `tunend`
@@ -167,11 +167,51 @@
The Linux kernel netfilter module is used for GTP tunnel proxying, also known as
tunnel forwarding or tunnel mapping.
-Using the netfilter module usually requires no configuration in `osmo-upf.cfg`.
+When using the netfilter module, you may set up `osmo-upf.cfg` for:
+- GTP Echo (required)
+- netfilter table name (optional)
-`osmo-upf` creates a new netfilter table, under which it submits rule sets for
-GTP tunnel proxying. This table name defaults to `osmo-upf`. A custom table name
-can be configured in `osmo-upf.cfg` like this:
+[[gtp_echo]]
+==== GTP Echo
+
+Each GTP peer should respond directly to GTP Echo requests.
+- A GTP device configured for `tunend` implicitly includes a GTP Echo service.
+- For `tunmap`, no GTP Echo mechanism is implemented.
+
+So, when your use case is `tunmap`, you should still add a GTP device as for
+`tunend`, only to provide the GTP Echo service. There are some options:
+
+If you have no GTP devices configured in `osmo-upf.cfg` yet, you can add a
+single GTP device without a specific IP address, in order to respond to GTP-U
+Echo requests on all interfaces to anyone that is asking:
+
+----
+tunend
+ dev create gtp-echo
+----
+
+This will bind osmo-upf on 0.0.0.0:2152 to respond to GTP Echo requests.
+
+If you would like to limit GTP Echo responses to specific network interfaces,
+you need to add a separate GTP device per local IP address:
+
+----
+tunend
+ dev create gtp-echo1 192.168.0.23
+ dev create gtp-echo2 10.9.8.17
+----
+
+This will bind osmo-upf only on 192.168.0.23:2152 and 10.9.8.17:2152 to respond
+to GTP Echo requests.
+
+For creating and manipulating a GTP device in more versatile ways, see
+<<gtp_module>>.
+
+==== netfilter Table Name
+
+For `tunmap`, `osmo-upf` creates a new netfilter table, under which it submits
+rule sets for GTP tunnel proxying. This table name defaults to `osmo-upf`. A
+custom table name can be configured in `osmo-upf.cfg` like this:
----
tunmap
--
To view, visit https://gerrit.osmocom.org/c/osmo-upf/+/35667?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-upf
Gerrit-Branch: master
Gerrit-Change-Id: Ic824fc876d1fad181254cb6894e51464c443b53c
Gerrit-Change-Number: 35667
Gerrit-PatchSet: 1
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-MessageType: newchange