[Megoldva] ipip tunnel probléma

Sziasztok!

Van egy kis problémám CentOS 7 IPIP tunnelingel és gondoltam hátha itt valaki tud segíteni. 

Van két hostom: 10.0.1.107 (host A) és 10.0.0.169 (host B), mindkettő a  255.255.248.0 maszkal. Tudják egymás pingelni semmi gond. A B-én van subnet: 10.20.0.0/16 amit szeretnék elérni az A-ról. Gondoltam csinálok rá egy IPIP tunnelt aminek a két oldal 10.21.1.1 és 10.21.1.2.

host A:

$ nmcli connection add type ip-tunnel ip-tunnel.mode ipip con-name tun0 ifname tun0 remote 10.0.0.169 local 10.0.1.107
Connection 'tun0' successfully added.
$ nmcli connection modify tun0 ipv4.addresses '10.21.1.1/30'
$ nmcli connection modify tun0 ipv4.method manual
$ nmcli connection modify tun0 +ipv4.routes "10.20.0.0/16 10.21.1.2"
$ nmcli connection up tun0
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/7)
$ echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
$ sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
net.ipv4.ip_forward = 1

host B:

$ nmcli connection add type ip-tunnel ip-tunnel.mode ipip con-name tun0 ifname tun0 remote 10.0.1.107 local  10.0.0.169
Connection 'tun0'  successfully added.
$ nmcli connection modify tun0 ipv4.addresses '10.21.1.2/30'
$ nmcli connection modify tun0 ipv4.method manual
$ nmcli connection up tun0
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/7)
$ echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
$ sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
net.ipv4.ip_forward = 1

A gond az, hogy a fenti nem mükődik. Nem tudom pingelni a távoli tunnel címeket. Tehát host A-ról a 10.21.1.2-t például. Ugyanakor a tcpdump azt mutatja van forgalom:

a# ping 10.21.1.2
PING 10.21.1.2 (10.21.1.2) 56(84) bytes of data.
^C
--- 10.21.1.2 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms

b$ tcpdump -nni tun0


12:22:28.379441 IP 10.21.1.1 > 10.21.1.2: ICMP echo request, id 20995, seq 1, length 64
12:22:28.379512 IP 10.21.1.2 > 10.21.1.1: ICMP echo reply, id 20995, seq 1, length 64
12:22:29.378786 IP 10.21.1.1 > 10.21.1.2: ICMP echo request, id 20995, seq 2, length 64
12:22:29.378853 IP 10.21.1.2 > 10.21.1.1: ICMP echo reply, id 20995, seq 2, length 64
12:22:30.378807 IP 10.21.1.1 > 10.21.1.2: ICMP echo request, id 20995, seq 3, length 64
12:22:30.378890 IP 10.21.1.2 > 10.21.1.1: ICMP echo reply, id 20995, seq 3, length 64
12:22:31.378685 IP 10.21.1.1 > 10.21.1.2: ICMP echo request, id 20995, seq 4, length 64
12:22:31.378759 IP 10.21.1.2 > 10.21.1.1: ICMP echo reply, id 20995, seq 4, length 64

Az ip route is szerintem jó:

a# ip route get 10.21.1.2
10.21.1.2 dev tun0 src 10.21.1.1 
    cache expires 433sec mtu 1480 

Firewalld ki van kapcsolva. Van valakinek ötlete?