GRE tunnel on OpenWrt 25.12.2

Installing and Using OpenWrt
1

Hello,

I am trying to make a GRE tunnel pass through my router, with very little sucess.
This used to work before, but now I am extremely puzzled.

This is what I see with tcpdump on the wan side:

tcpdump -i eth1 proto gre -e -n

13:04:51.988395 00:00:5e:00:01:95 > b8:a3:86:4c:bd:58, ethertype IPv4 (0x0800), length 102: 44.5.7.255 > 155.4.225.195: GREv0, proto IPv4 (0x0800), length 68: 44.5.7.114 > 224.0.0.5: OSPFv2, Hello, length 44

So, I see tunnel packets coming in

This is on the local side

root@OpenWrt:~# tcpdump -i eth0 proto gre -e -n

13:06:28.602111 18:e8:29:2d:0b:ee > b8:a3:86:4c:bd:57, ethertype 802.1Q (0x8100), length 106: vlan 1, p 1, ethertype IPv4 (0x0800), 192.168.1.250 > 44.5.7.255: GREv0, proto IPv4 (0x0800), length 68

So, we are all set

This is the firewall rule supposed to feed the packets in:

config rule
option src 'wan'
option dest 'lan'
option name 'Allow-GRE'
option proto 'gre'
option target 'ACCEPT'
list src_ip '44.5.7.255' // this is the sender
list dest_ip '192.168.1.250'

With this rule I expected to see the incoming packets on the lan side with destination address translated, but, no such packets.

config redirect
option name 'Forward-GRE'
option src 'wan'
option dest 'lan'
option proto 'gre'
option dest_ip '192.168.1.250'
option src_ip '44.5.7.255'
option src_dip '155.4.225.195'
option reflection '0'
option family 'ipv4'

Simpler question:
Why does my inside GRE packets going out not just NATed and sent out?

How do I figure out why the OpenWrt ( just updated ) is not handling protocol GRE?
I gave installed gre, kmod-gre and kmod-gre6.....

Gullik

2

Very interesting.....

I just nuked my router, removed all configs, and I do not have any port forwarding rules
any more, as well as no traffic rules, except for std config.

To my surprice, the link came up, and I now have an extra gre connection up.

How this can work, possibly some defaults for outgoing transfer, that maps GRE protocol like
outgoing udp or tcp, so it must probably be initated by MY gre router passing
the tunnel out.

Now, I do not think this is OK, I would like to filter on incoming so i KNOW where it is coming from,
but I would hate the link to go dead........

I probably WILL have to add a filter, and that should be safe, I can always remove it, but why did this not work when I tried to apply my limited intelligence to it ?

Very much puzzled.

Gullik