On 03/05/17 20:38, Robert White wrote:
On 05/03/17 02:13, Steven O'Connor wrote:
PPTP pass-through seems to be broken. When the client tries to connect,
a gre packet is sent but the reply gre packet is dropped at my firewall.
The relevant conntrack dump shows a mismatch between the expected reply
and the packet received, srckey/dstkey do not match. Is that significant?
gre 47 27 src=aaa.bbb.cc.ddd dst=www.xxx.yy.zz srckey=0x0
dstkey=0xb053 [UNREPLIED] src=www.xxx.yy.zz dst=aaa.bbb.cc.ddd
srckey=0xb053 dstkey=0x0 mark=0 use=1
gre 47 27 src=192.168.0.212 dst=aaa.bbb.cc.ddd srckey=0x0
dstkey=0x1380 [UNREPLIED] src=aaa.bbb.cc.ddd dst=www.xxx.yy.zz
srckey=0x1380 dstkey=0x0 mark=0 use=1
Doesn't help without your firewall rules.
Do you have a expected,related,established rule in your outgoing chain?
The private address (the only one you didn't blank) suggests that some
SNAT rule is just a little too ambitious for your own good.
One of the things I do is limit SNAT rules to packets that come from
real internal-network interfaces. (I use interface group numbers or
wildcards to make that easier.) Basically you probably don't want to
SNAT any the packets generated by the local machine.
I'm not using any SNAT only masquerade.
The default policy LAN->NET is accept. I have also added a rule to
accept gre.
It has been working previously but after an update to the kernel or
shorewall it has stopped working. I only use pptp occasionally so I
cannot be sure when it stopped.
The firewall can accept pptp connections from the net and it is only the
passthru that is broken.
--
Steven O'Connor
=============================================
Support Services Pty Ltd ABN 49 006 226 428
2 Commonwealth Terrace, Sandhurst VIC 3977
Fax 03 9888 2677, Mobile 0417 571 113
=============================================
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
