On 04/05/17 08:07, Rob Sterenborg (Lists) wrote:
On 04/05/17 05:42, Steven O'Connor wrote:
On 04/05/17 00:45, Rob Sterenborg (lists) wrote:
On 3-5-2017 04:13, Steven O'Connor wrote:
PPTP pass-through seems to be broken. When the client tries to
connect,
a gre packet is sent but the reply gre packet is dropped at my
firewall.
The relevant conntrack dump shows a mismatch between the expected
reply
and the packet received, srckey/dstkey do not match. Is that
significant?
gre 47 27 src=aaa.bbb.cc.ddd dst=www.xxx.yy.zz srckey=0x0
dstkey=0xb053 [UNREPLIED] src=www.xxx.yy.zz dst=aaa.bbb.cc.ddd
srckey=0xb053 dstkey=0x0 mark=0 use=1
gre 47 27 src=192.168.0.212 dst=aaa.bbb.cc.ddd srckey=0x0
dstkey=0x1380 [UNREPLIED] src=aaa.bbb.cc.ddd dst=www.xxx.yy.zz
srckey=0x1380 dstkey=0x0 mark=0 use=1
You don't show any rules, so just a guess.
Do you allow/forward protocol 47 (gre) packets?
--
Rob
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
The default policy LAN->NET is accept. I have also added a rule to
accept gre.
It has been working previously but after an update to the kernel or
shorewall it has stopped working. I only use pptp occasionally so I
cannot be sure when it stopped.
The firewall can accept pptp connections from the net and it is only
the passthru that is broken.
IIRC something changed with autoloading helper modules (don't know
exactly when): are the PPTP helper modules loaded?
nf_nat_pptp.ko
nf_conntrack_pptp.ko
You would need nf_nat_pptp.ko for NAT-ing the PPTP protocol.
Oh, and lets not forget:
nf_nat_proto_gre.ko
nf_conntrack_proto_gre.ko
--
Rob
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
