LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 12-07-2005, 06:11 PM   #1
sundialsvcs
Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 5,401

Rep: Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119
2.6: ping on established(!) VPN tunnel doesn't! [SOLVED]


Here's a wierd-one for ya...

I am using IPSec-Tools .. actually a modified version which supports the XAUTH protocol. I am using that version right now, successfully on a 2.4 machine.

But, on a 2.6 machine on the same network, behind the same router, with the same configuration, I get something "vewy skwewy..." (to quote Elmer Fudd).

I start Racoon, issue the SetKey commands, ping 192.168.30.1 (this being a port within the range of addresses exposed on the other network through the tunnel.
  • In a few moments, the VPN tunnel is established, successfully.
  • Knowing that the first exchange is simply going to get Racoon to do its thing, I stop pinging, wait a few seconds, and try again.
  • Using ethereal I can see UCMP Echo Reply packets being sent back .. from 192.168.30.1 -> the address of my ethernet adapter, yes, on the 2.6 machine! The remote host is trying to respond properly! Yes, the received packet appears to Ethereal to be valid in every way!
  • But nothing comes out on the terminal. ping will say that so-many packets were transmitted and that there was "100% packet loss."
  • The output from setkey -DP on both machines is virtually the same. They both show an established tunnel, both show policies in place.
  • The 2.6 machine isn't even running a firewall.

When I, now very curious, do the same thing on the 2.4 machine, and using a somewhat older version of ethereal, I do not see exactly the same output (it is an older version...), but I do promptly see ping delivering output to the terminal.

So... what dumb thing am I overlooking?

Last edited by sundialsvcs; 12-09-2005 at 05:01 PM.
 
Old 12-09-2005, 05:09 PM   #2
sundialsvcs
Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 5,401

Original Poster
Rep: Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119Reputation: 1119
The Solution ...

The problem turned out to be a difference between the 2.4 implementation of IPSEC and the 2.6. The new kernel applies the spdadd rules (setkey command) rules more stringently than 2.4 did.

Previously, I had only a rule which specified -P out. I did not have, nor did I need on 2.4, a second, reverse rule which specified -P in.

Apparently, kernel 2.6 does perform this check more stringently, as indeed it should. (And my 2.4 is quite old, so maybe they fixed it there, too.)

Without the rule, what happens is that (as I saw in ethereal or tcpdump...), the IPSec packet comes in, it gets decrypted, the payload gets re-injected into the stream, and ... because there is no matching rule, the packet is silently dropped.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
W2K > VPN tunnel > Linux > M$ Exchange joadoor Linux - Networking 0 07-22-2004 05:50 AM
VPN Tunnel Through SSH gauge73 Linux - Networking 4 05-16-2004 08:24 PM
routing problem with VPN tunnel hsiehkc Linux - Networking 0 01-16-2004 12:39 AM
FreeSWan: Canīt ping through tunnel razametal Linux - Networking 6 05-07-2003 11:22 PM
VPN tunnel dvong3 Linux - Networking 2 10-16-2002 03:20 AM


All times are GMT -5. The time now is 10:49 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration