From mboxrd@z Thu Jan 1 00:00:00 1970 From: Robert White Subject: Re: PPTP passthrough Date: Wed, 3 May 2017 10:38:12 +0000 Message-ID: <019de373-baa3-0e9e-d7f0-4fa63c106091@pobox.com> References: <6d2c9c2f-2636-9e3f-b8e1-eec95eb02370@suse.com.au> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <6d2c9c2f-2636-9e3f-b8e1-eec95eb02370@suse.com.au> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" To: Steven O'Connor , netfilter@vger.kernel.org On 05/03/17 02:13, Steven O'Connor wrote: > PPTP pass-through seems to be broken. When the client tries to connect, > a gre packet is sent but the reply gre packet is dropped at my firewall. > > The relevant conntrack dump shows a mismatch between the expected reply > and the packet received, srckey/dstkey do not match. Is that significant? > > > gre 47 27 src=aaa.bbb.cc.ddd dst=www.xxx.yy.zz srckey=0x0 > dstkey=0xb053 [UNREPLIED] src=www.xxx.yy.zz dst=aaa.bbb.cc.ddd > srckey=0xb053 dstkey=0x0 mark=0 use=1 > gre 47 27 src=192.168.0.212 dst=aaa.bbb.cc.ddd srckey=0x0 > dstkey=0x1380 [UNREPLIED] src=aaa.bbb.cc.ddd dst=www.xxx.yy.zz > srckey=0x1380 dstkey=0x0 mark=0 use=1 > > Doesn't help without your firewall rules. Do you have a expected,related,established rule in your outgoing chain? The private address (the only one you didn't blank) suggests that some SNAT rule is just a little too ambitious for your own good. One of the things I do is limit SNAT rules to packets that come from real internal-network interfaces. (I use interface group numbers or wildcards to make that easier.) Basically you probably don't want to SNAT any the packets generated by the local machine.