Re: ip_nat_pptp ICMP rejected failures

[Matt Domsch <matt@domsch.com>]

[-- Attachment #1: Type: text/plain, Size: 5466 bytes --]

On Wed, Oct 05, 2005 at 05:44:53PM +0200, Harald Welte wrote:
> On Wed, Oct 05, 2005 at 10:13:09AM -0500, Matt Domsch wrote:
> there have been patches for lots of 2.4 and 2.6 releases, though.

Indeed, I've been lazy in this respect, no disrespect intended.
 
> thanks for the detailed bugreport, I'll try to analyze the problem once
> I'm back from http://workshop.netfilter.org/

Enjoy the workshop!
 
> Please try to explicitly add a drop rule for the ICMP packets and see
> whether it works then.  Sounds strange, but I have my reasons for asking
> ;)


Progress.  To the raw table I added:
-A OUTPUT -p icmp --icmp-type protocol-unreachable --destination PPTP_SERVER -j DROP

Now what happens is that the LCP Configuration Requests and LCP
Configuration Acks generated by the PPTP_SERVER aren't getting NAT'd
by the firewall coming back to my client, so LCP is never
established.  Removing ip_nat_pptp resolves this of course.


No.     Time        Source                Destination           Protocol Info
     47 1.029527    CLIENT_IP           PPTP_SERVER         TCP      4668 > 1723 [SYN] Seq=0 Ack=0 Win=64512 Len=0 MSS=1460
     48 1.029729    FW_PUBLIC_IP        PPTP_SERVER         TCP      4668 > 1723 [SYN] Seq=0 Ack=0 Win=64512 Len=0 MSS=1460
     49 1.056471    PPTP_SERVER         FW_PUBLIC_IP        TCP      1723 > 4668 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460
     50 1.056586    PPTP_SERVER         CLIENT_IP           TCP      1723 > 4668 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460
     51 1.071807    CLIENT_IP           PPTP_SERVER         PPTP     Start-Control-Connection-Request
     52 1.071899    FW_PUBLIC_IP        PPTP_SERVER         PPTP     Start-Control-Connection-Request
     53 1.096896    PPTP_SERVER         FW_PUBLIC_IP        PPTP     Start-Control-Connection-Reply
     54 1.096993    PPTP_SERVER         CLIENT_IP           PPTP     Start-Control-Connection-Reply
     55 1.108357    CLIENT_IP           PPTP_SERVER         PPTP     Outgoing-Call-Request
     56 1.108461    FW_PUBLIC_IP        PPTP_SERVER         PPTP     Outgoing-Call-Request
     57 1.133729    PPTP_SERVER         FW_PUBLIC_IP        PPTP     Outgoing-Call-Reply
     58 1.133875    PPTP_SERVER         CLIENT_IP           PPTP     Outgoing-Call-Reply
     59 1.137014    CLIENT_IP           PPTP_SERVER         PPTP     Set-Link-Info
     60 1.137101    FW_PUBLIC_IP        PPTP_SERVER         PPTP     Set-Link-Info
     61 1.149890    CLIENT_IP           PPTP_SERVER         PPP LCP  Configuration Request
     62 1.150004    FW_PUBLIC_IP        PPTP_SERVER         PPP LCP  Configuration Request
     63 1.174587    PPTP_SERVER         FW_PUBLIC_IP        PPP LCP  Configuration Request
====== The previous packet should be NAT'd here, but it's not.
     64 1.174765    PPTP_SERVER         FW_PUBLIC_IP        PPP LCP  Configuration Ack
====== The previous packet should be NAT'd here, but it's not.
     71 1.335423    PPTP_SERVER         FW_PUBLIC_IP        TCP      1723 > 4668 [ACK] Seq=189 Ack=349 Win=17172 Len=0
     72 1.335582    PPTP_SERVER         CLIENT_IP           TCP      1723 > 4668 [ACK] Seq=189 Ack=349 Win=17172 Len=0
     96 2.319976    PPTP_SERVER         FW_PUBLIC_IP        PPP LCP  Configuration Request
====== The previous packet should be NAT'd here, but it's not.
    125 3.136456    CLIENT_IP           PPTP_SERVER         PPP LCP  Configuration Request
    126 3.136592    FW_PUBLIC_IP        PPTP_SERVER         PPP LCP  Configuration Request
    127 3.160169    PPTP_SERVER         FW_PUBLIC_IP        PPP LCP  Configuration Ack
====== The previous packet should be NAT'd here, but it's not.
    181 5.319708    PPTP_SERVER         FW_PUBLIC_IP        PPP LCP  Configuration Request
====== The previous packet should be NAT'd here, but it's not.
    213 6.133984    CLIENT_IP           PPTP_SERVER         PPP LCP  Configuration Request
    214 6.134116    FW_PUBLIC_IP        PPTP_SERVER         PPP LCP  Configuration Request
    215 6.159191    PPTP_SERVER         FW_PUBLIC_IP        PPP LCP  Configuration Ack
====== The previous packet should be NAT'd here, but it's not.
    308 9.319669    PPTP_SERVER         FW_PUBLIC_IP        PPP LCP  Configuration Request
====== The previous packet should be NAT'd here, but it's not.
    340 10.144477   CLIENT_IP           PPTP_SERVER         PPP LCP  Configuration Request
    341 10.144617   FW_PUBLIC_IP        PPTP_SERVER         PPP LCP  Configuration Request
    342 10.167478   PPTP_SERVER         FW_PUBLIC_IP        PPP LCP  Configuration Ack
    427 13.061012   CLIENT_IP           PPTP_SERVER         PPTP     Set-Link-Info
    428 13.061137   FW_PUBLIC_IP        PPTP_SERVER         PPTP     Set-Link-Info
    429 13.071593   CLIENT_IP           PPTP_SERVER         PPP LCP  Termination Request
    430 13.071680   FW_PUBLIC_IP        PPTP_SERVER         PPP LCP  Termination Request
    431 13.095415   PPTP_SERVER         FW_PUBLIC_IP        PPP LCP  Termination Ack
    435 13.258806   PPTP_SERVER         FW_PUBLIC_IP        TCP      1723 > 4668 [ACK] Seq=189 Ack=373 Win=17148 Len=0
    436 13.258922   PPTP_SERVER         CLIENT_IP           TCP      1723 > 4668 [ACK] Seq=189 Ack=373 Win=17148 Len=0


There's no apparent difference between the packets that are NATd
without ip_nat_pptp and the packets that aren't when using ip_nat_pptp.

Thanks,
Matt

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]