On 05/03/17 02:13, Steven O'Connor wrote: > PPTP pass-through seems to be broken. When the client tries to connect, > a gre packet is sent but the reply gre packet is dropped at my firewall. > > The relevant conntrack dump shows a mismatch between the expected reply > and the packet received, srckey/dstkey do not match. Is that significant? > > > gre 47 27 src=aaa.bbb.cc.ddd dst=www.xxx.yy.zz srckey=0x0 > dstkey=0xb053 [UNREPLIED] src=www.xxx.yy.zz dst=aaa.bbb.cc.ddd > srckey=0xb053 dstkey=0x0 mark=0 use=1 > gre 47 27 src=192.168.0.212 dst=aaa.bbb.cc.ddd srckey=0x0 > dstkey=0x1380 [UNREPLIED] src=aaa.bbb.cc.ddd dst=www.xxx.yy.zz > srckey=0x1380 dstkey=0x0 mark=0 use=1 > > Doesn't help without your firewall rules. Do you have a expected,related,established rule in your outgoing chain? The private address (the only one you didn't blank) suggests that some SNAT rule is just a little too ambitious for your own good. One of the things I do is limit SNAT rules to packets that come from real internal-network interfaces. (I use interface group numbers or wildcards to make that easier.) Basically you probably don't want to SNAT any the packets generated by the local machine. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
