Re: PPTP passthrough

[Steven O'Connor <steven@suse.com.au>]

On 03/05/17 20:38, Robert White wrote:
> On 05/03/17 02:13, Steven O'Connor wrote:
>> PPTP pass-through seems to be broken. When the client tries to connect,
>> a gre packet is sent but the reply gre packet is dropped at my firewall.
>>
>> The relevant conntrack dump shows a mismatch between the expected reply
>> and the packet received, srckey/dstkey do not match. Is that significant?
>>
>>
>> gre      47 27 src=aaa.bbb.cc.ddd dst=www.xxx.yy.zz srckey=0x0
>> dstkey=0xb053 [UNREPLIED] src=www.xxx.yy.zz dst=aaa.bbb.cc.ddd
>> srckey=0xb053 dstkey=0x0 mark=0 use=1
>> gre      47 27 src=192.168.0.212 dst=aaa.bbb.cc.ddd srckey=0x0
>> dstkey=0x1380 [UNREPLIED] src=aaa.bbb.cc.ddd dst=www.xxx.yy.zz
>> srckey=0x1380 dstkey=0x0 mark=0 use=1
>>
>>
> Doesn't help without your firewall rules.
>
> Do you have a expected,related,established rule in your outgoing chain?
>
> The private address (the only one you didn't blank) suggests that some
> SNAT rule is just a little too ambitious for your own good.
>
> One of the things I do is limit SNAT rules to packets that come from
> real internal-network interfaces. (I use interface group numbers or
> wildcards to make that easier.) Basically you probably don't want to
> SNAT any the packets generated by the local machine.
>
>
>
>
I'm not using any SNAT only masquerade.

The default policy LAN->NET is accept. I have also added a rule to 
accept gre.

It has been working previously but after an update to the kernel or 
shorewall it has stopped working.  I only use pptp occasionally so I 
cannot be sure when it stopped.

The firewall can accept pptp connections from the net and it is only the 
passthru that is broken.


-- 
Steven O'Connor
=============================================
Support Services Pty Ltd   ABN 49 006 226 428
2 Commonwealth Terrace, Sandhurst VIC 3977
Fax 03 9888 2677, Mobile 0417 571 113
=============================================