bad packets crash firewall.

bad packets crash firewall.

[Peter Marshall]

I am not sure if this is related to bad packets, a bad pptp patch, poor 
kernal .. I am at a loss.

I haev a firewall iptables on FC3.  It was reciently pached to include 
support for pptp.  When one of the users (who has a linux desktop) tries 
using pptp, the firewall crashes .. (the entire box panics).  Any ideas 
how one user could bring the firewall down .. I need to fix this somehow 
.  THis problem does not appear when windows users attempt to use pptp.


THank you for any advice,
Peter

Re: bad packets crash firewall.

[/dev/rob0]

Peter Marshall wrote:
> I am not sure if this is related to bad packets, a bad pptp patch, poor 
> kernal .. I am at a loss.

And we, the list, probably more so. :)

> I haev a firewall iptables on FC3.  It was reciently pached to include 
> support for pptp.  When one of the users (who has a linux desktop) tries 
> using pptp, the firewall crashes .. (the entire box panics).  Any ideas 
> how one user could bring the firewall down .. I need to fix this somehow

Is the firewall machine the one running pptpd? If so then your 
assumption that it was "bad packets" hitting netfilter would appear 
premature. Check your logs, do debugging of the more likely suspect, pptpd.

> .  THis problem does not appear when windows users attempt to use pptp.

And do yourself another favour ... dump PPTP. It's lousy and inherently 
not secure. OpenVPN ( http://openvpn.net/ ) beats it in every way. The 
only limitation is that it won't work with old DOS-based Windows 
versions, but then, it's rather reckless to support those in a business 
setting anyway IMO.
-- 
     mail to this address is discarded unless "/dev/rob0"
     or "not-spam" is in Subject: header

Re: bad packets crash firewall.

[/dev/rob0]

I wrote:
>> I am not sure if this is related to bad packets, a bad pptp patch, 
>> poor kernal .. I am at a loss.
> 
> [snip]
> 
> Check your logs, do debugging of the more likely suspect, pptpd.

Or, on further thought, the MPPE kernel patch you used is equally 
suspect. Are the Windows users using MPPE? How about the Linux one?

Please note, this is not an invitation to continue in an offtopic thread 
here, I am only trying to be complete in providing something which might 
be useful to you. I no longer support pptpd at my sites; we are moving 
them to openvpn.
-- 
     mail to this address is discarded unless "/dev/rob0"
     or "not-spam" is in Subject: header

Re: bad packets crash firewall.

[Pablo Neira]

Peter Marshall wrote:
> I am not sure if this is related to bad packets, a bad pptp patch, poor 
> kernal .. I am at a loss.

please, post the kernel oops dump to netfilter-devel so we could figure 
out why it's crashing ;)

--
Pablo