Checklist
When packets go out and never come back, work through this list. Each line names the capture or command that confirms or rules it out.
| Suspect | What you'll see | Confirm with |
|---|---|---|
| Missing return route | Request arrives at the far end; no reply leaves it | Capture at destination; ip route get <source> there |
| Missing NAT | Requests leave the edge with a private source address | monitor traffic on the WAN interface; show nat source rules |
| Asymmetric routing + stateful firewall | Reply arrives at a different router than the request left; that router drops it | tcpdump -e at the far end (which MAC?); invalid-state counters |
| Reverse-path filtering | Packets arrive on an interface that isn't the route back to their source, then vanish | rp_filter / VyOS source-validation; nstat IPReversePathFilter |
| Firewall drop (any) | Packet seen on the inbound interface but not the outbound one | Captures on both interfaces; firewall rule counters |
| MTU black hole | Small packets fine, large ones retransmitted forever; ICMP need-to-frag ignored or missing | ping -M do -s 1472; capture icmp; MSS in SYN/SYN-ACK |
| ARP/neighbour failure | Router never sends the packet onto the last segment | ip neigh on the router; capture for ARP requests without replies |
Habits that save hours
- Capture on both sides of every device you suspect, at the same time.
- Use
-ewhenever more than one router could be involved: the MAC tells you which one. - Pin the source port (
nc -p 40000,curl --local-port) so your test flow is easy to filter. - Don't trust a single summary counter. In this lab,
show firewall's state-policy table showed 0 invalid drops while the forward path's own chain had dropped 63. Check the chain your traffic actually traverses (sudo nft list ruleset). - Change one thing at a time, and capture again after every change.
vyos@R1:~$ show configuration commands | match "interfaces ethernet|nat source|firewall"
set firewall global-options state-policy established action 'accept'
set firewall global-options state-policy invalid action 'drop'
set firewall global-options state-policy related action 'accept'
set firewall ipv4 forward filter default-action 'drop'
set firewall ipv4 forward filter rule 10 action 'accept'
set firewall ipv4 forward filter rule 10 description 'LAN may start connections'
set firewall ipv4 forward filter rule 10 inbound-interface name 'eth0'
set firewall ipv4 forward filter rule 10 state 'new'
set interfaces ethernet eth0 address '10.0.0.1/24'
set interfaces ethernet eth0 description 'LAN'
set interfaces ethernet eth0 hw-id '52:54:00:00:00:01'
set interfaces ethernet eth0 ip adjust-mss '1360'
set interfaces ethernet eth1 address '203.0.113.1/24'
set interfaces ethernet eth1 description 'WAN'
set interfaces ethernet eth1 hw-id '52:54:00:00:01:01'
set interfaces ethernet eth1 mtu '1400'
set nat source rule 100 description 'LAN to WAN'
set nat source rule 100 outbound-interface name 'eth1'
set nat source rule 100 source address '10.0.0.0/24'
set nat source rule 100 translation address 'masquerade'- Lines 2–4: Global state policy: accept established/related, drop invalid, for all chains.
- Lines 5–9: Forwarding: default drop, allow new connections from the LAN.
- Line 12: hw-id ties the interface name to the NIC's MAC address. VyOS adds it automatically.
- Line 13: The MSS clamp from scenario 3.
- Line 17: The reduced WAN MTU that caused scenario 3.
- Lines 18–21: Source NAT from scenario 1.
vyos@R1:~$ monitor traffic interface eth1 save /tmp/wan.pcap filter "tcp port 80"
tcpdump: listening on eth1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C10 packets captured
10 packets received by filter
0 packets dropped by kernel- Line 1:
savewrites a pcap on the router instead of printing. Copy it off with scp and open it in Wireshark, or read it withsudo tcpdump -r.
Check your understanding
Captures show a packet arriving on a router's inside interface and never leaving its outside interface. Routing to the destination is fine. What do you check next?
- The far-end server
- The router's firewall and NAT counters, at the nftables level if necessary
- The client's ARP cache
- The DNS server
Where next
- Linux Network ConnectivityPrerequisite · Beginner · 80 min
Find out why a Linux machine can't reach something, layer by layer: interfaces and addresses, routes and ip route get, ARP and the neighbour table, ping and traceroute, DNS, and listening sockets — with real output from a three-host lab.
- Debugging BGP: every session state, reproducedAlso covers tcpdump, troubleshooting · Intermediate · 60 min
Break a working BGP lab a dozen ways and learn to read each failure: Idle, Connect, Active and OpenSent, max-prefix, firewalls, wrong AS, TTL, hold timers, missing policy and unreachable next hops, all with real FRR output and packet captures.
- Setting up VyOS with NATAlso covers NAT · Beginner · 45 min
A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.
- Zone-based firewall on VyOSAlso covers NAT · Intermediate · 35 min
Rebuild the NAT lesson's router with a zone-based firewall: WAN, LAN, a DMZ and the router itself, with one ruleset per direction. Includes the missing-return-traffic mistake, post-NAT matching, and a full test matrix.