Problem with incoming ssh connections and PPTP
When I connect my server to a PPTP VPN (ppp0) it no longer accepts incoming ssh connections on the main ethernet interface (eth1) if (and this part is the weirdest) the connections come from outside the LAN. The only difference between the incoming packets according to Wireshark is the SOURCE IP.
My setup is like this: {INTERNET} <=> {ROUTER, 192.168.1.1, forwards port 22 to SERVER} <=> {SERVER, 192.168.1.2, on LAN, has ssh service running} The server has eth1 interface (192.168.1.1), and when I connect to PPTP VPN, also a ppp0 interface. Now more details on the complicated and weird stuff: If ppp0 is down, I can connect from INTERNET _and_ LAN to SERVER on eth1 without a problem. If I ppp0 is up, i can still connect to eth1 from LAN, but not from INTERNET. I have grabbed some Wireshark logs and the packets does arrive on eth1, but there simply is no response. I temporarily disabled firewall, so that is not it. The packets from INTERNET and LAN look identical to me except of course for the source IP. My guess is that the Kernel somehow blocks it, and there could be some /proc or /sys option to disable this unfortunate behavior. If you've reached this far, THANKS. If any more information is required, please please ask. I can easily upload the Wireshark logs if needed. I _really_ need help with this. EDIT: Running Ubuntu 9.04, and gnome-network-manager-pptp. /A |
What does the routing table look like once the PPTP connection is up? Most likely it's trying to route through the LAN and is not able to get out.
|
Quote:
Code:
$ route /A |
So the machine you're trying to connect from is on the 192.168.1.0/24 subnet? What is the ham0 interface? I guess the wireshark dump is the next step: your routing table looks correct to me.
|
Quote:
The .pcap file can be downloaded here: http://www.box.net/shared/m7q6eophki The first three packets (from .210) are when connecting externally. It's three SYN packets which are never replied. Then, I connect internally (from .3) and the ssh connection is established. Note also that this capture is on interface ANY, so there really is no outgoing replies. Thanks, /A |
This is what I currently think is going on:
when the incoming [SYN] on eth1 is received, and the kernel is about to reply with a [SYN, ACK], the routing tables ("default") says that packets not for the internal LAN should go through ppp0. Since it makes no sense to reply on another interface the kernel discards it. I might be wrong, but I really think I'm on to something. Now the big question is, how do you fix it... /A |
After hours of reading i got it to work. My described problem is called "routing for multiple uplinks", and is solved by some additions to the routing rules. The following script solves my case:
Code:
da@brutus:~$ sudo echo "200 my_table" >> /etc/iproute2/rt_tables # to add the table, which is required for the script /A |
All times are GMT -5. The time now is 12:16 PM. |