Mailing List Archive: vpnc: devel

connection hangs inside virtual machines

Index | Next | Previous | View Threaded

netllama at gmail

Nov 15, 2009, 6:06 PM

Post #1 of 12 (2215 views)
Permalink

connection hangs inside virtual machines

Greetings,
I've been using vpnc on Linux to connect to a Cisco VPN for several
years, and its great (certainly much better than Cisco's crappy Linux
client). One long standing problem that I've experienced only
reproduces when running vpnc inside of a virtual machine environment
(VMWare, VirtualBox, etc) in which both the VM and the host OS are
Linux. Namely, the VPN connection appears to silently die after some
random period of time. vpnc is still running, but all network traffic
to and from the remote VPN end dies completely. The only fix is to
stop vpnc (vpnc-disconnect) and then re-connect again. The problem is
present up to and including version 0.5.3.

I've seen somewhat similar reports of this in the list archives, but
no solutions. I'd be happy to capture debug output if someone can
tell me which debug level would be most useful to debug this further.

Thanks in advance!

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
L. Friedman netllama [at] gmail
LlamaLand https://netllama.linux-sxs.org
_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

dcbw at redhat

Nov 15, 2009, 10:17 PM

Post #2 of 12 (2145 views)
Permalink

Re: connection hangs inside virtual machines [In reply to]

On Sun, 2009-11-15 at 18:06 -0800, Lonni J Friedman wrote:
> Greetings,
> I've been using vpnc on Linux to connect to a Cisco VPN for several
> years, and its great (certainly much better than Cisco's crappy Linux
> client). One long standing problem that I've experienced only
> reproduces when running vpnc inside of a virtual machine environment
> (VMWare, VirtualBox, etc) in which both the VM and the host OS are
> Linux. Namely, the VPN connection appears to silently die after some
> random period of time. vpnc is still running, but all network traffic
> to and from the remote VPN end dies completely. The only fix is to
> stop vpnc (vpnc-disconnect) and then re-connect again. The problem is
> present up to and including version 0.5.3.

Is the VM NAT-ed to the host adapter, or is the host machine behind a
NAT somewhere? If so, try changing the NAT traversal mode, or if that
doesn't work try setting a specific local port.

Dan

_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

netllama at gmail

Nov 16, 2009, 9:54 AM

Post #3 of 12 (2144 views)
Permalink

Re: connection hangs inside virtual machines [In reply to]

On Sun, Nov 15, 2009 at 10:17 PM, Dan Williams <dcbw [at] redhat> wrote:
> On Sun, 2009-11-15 at 18:06 -0800, Lonni J Friedman wrote:
>> Greetings,
>> I've been using vpnc on Linux to connect to a Cisco VPN for several
>> years, and its great (certainly much better than Cisco's crappy Linux
>> client). One long standing problem that I've experienced only
>> reproduces when running vpnc inside of a virtual machine environment
>> (VMWare, VirtualBox, etc) in which both the VM and the host OS are
>> Linux. Namely, the VPN connection appears to silently die after some
>> random period of time. vpnc is still running, but all network traffic
>> to and from the remote VPN end dies completely. The only fix is to
>> stop vpnc (vpnc-disconnect) and then re-connect again. The problem is
>> present up to and including version 0.5.3.
>
> Is the VM NAT-ed to the host adapter, or is the host machine behind a
> NAT somewhere? If so, try changing the NAT traversal mode, or if that
> doesn't work try setting a specific local port.

Thanks for the reply. The VM is NAT-ed to the host, and the host is
also NAT'ed (its all sitting behind my home's DSL connection, which is
behind a firewall).

I'll try playing with the different --natt-mode options tonight and
see if any have an impact.

As for setting a specific local port (with --local-port ), does it
matter what number i select, or is the goal simply to just select one
rather than getting a random port?

thanks!

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
L. Friedman netllama [at] gmail
LlamaLand https://netllama.linux-sxs.org

_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

gofman.mike at gmail

Nov 16, 2009, 9:59 AM

Post #4 of 12 (2141 views)
Permalink

Re: connection hangs inside virtual machines [In reply to]

Just FYI many firewalls automatically close idle connections.
It's either that or the rekeying problem that was reported previously.

On Mon, Nov 16, 2009 at 12:54 PM, Lonni J Friedman <netllama [at] gmail>wrote:

> On Sun, Nov 15, 2009 at 10:17 PM, Dan Williams <dcbw [at] redhat> wrote:
> > On Sun, 2009-11-15 at 18:06 -0800, Lonni J Friedman wrote:
> >> Greetings,
> >> I've been using vpnc on Linux to connect to a Cisco VPN for several
> >> years, and its great (certainly much better than Cisco's crappy Linux
> >> client). One long standing problem that I've experienced only
> >> reproduces when running vpnc inside of a virtual machine environment
> >> (VMWare, VirtualBox, etc) in which both the VM and the host OS are
> >> Linux. Namely, the VPN connection appears to silently die after some
> >> random period of time. vpnc is still running, but all network traffic
> >> to and from the remote VPN end dies completely. The only fix is to
> >> stop vpnc (vpnc-disconnect) and then re-connect again. The problem is
> >> present up to and including version 0.5.3.
> >
> > Is the VM NAT-ed to the host adapter, or is the host machine behind a
> > NAT somewhere? If so, try changing the NAT traversal mode, or if that
> > doesn't work try setting a specific local port.
>
> Thanks for the reply. The VM is NAT-ed to the host, and the host is
> also NAT'ed (its all sitting behind my home's DSL connection, which is
> behind a firewall).
>
> I'll try playing with the different --natt-mode options tonight and
> see if any have an impact.
>
> As for setting a specific local port (with --local-port ), does it
> matter what number i select, or is the goal simply to just select one
> rather than getting a random port?
>
> thanks!
>
>
>
> --
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> L. Friedman netllama [at] gmail
> LlamaLand https://netllama.linux-sxs.org
>
> _______________________________________________
> vpnc-devel mailing list
> vpnc-devel [at] unix-ag
> https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
> http://www.unix-ag.uni-kl.de/~massar/vpnc/<http://www.unix-ag.uni-kl.de/%7Emassar/vpnc/>
>

netllama at gmail

Nov 16, 2009, 10:04 AM

Post #5 of 12 (2140 views)
Permalink

Re: connection hangs inside virtual machines [In reply to]

I'm confident its not an idle connection problem. I can be actively
pinging a system across the VPN, and have the connection spontaneously
die.

Which rekeying problem are you referring to?

thanks.

On Mon, Nov 16, 2009 at 9:59 AM, Michael Gofman <gofman.mike [at] gmail> wrote:
> Just FYI many firewalls automatically close idle connections.
> It's either that or the rekeying problem that was reported previously.
>
> On Mon, Nov 16, 2009 at 12:54 PM, Lonni J Friedman <netllama [at] gmail>
> wrote:
>>
>> On Sun, Nov 15, 2009 at 10:17 PM, Dan Williams <dcbw [at] redhat> wrote:
>> > On Sun, 2009-11-15 at 18:06 -0800, Lonni J Friedman wrote:
>> >> Greetings,
>> >> I've been using vpnc on Linux to connect to a Cisco VPN for several
>> >> years, and its great (certainly much better than Cisco's crappy Linux
>> >> client). One long standing problem that I've experienced only
>> >> reproduces when running vpnc inside of a virtual machine environment
>> >> (VMWare, VirtualBox, etc) in which both the VM and the host OS are
>> >> Linux. Namely, the VPN connection appears to silently die after some
>> >> random period of time. vpnc is still running, but all network traffic
>> >> to and from the remote VPN end dies completely. The only fix is to
>> >> stop vpnc (vpnc-disconnect) and then re-connect again. The problem is
>> >> present up to and including version 0.5.3.
>> >
>> > Is the VM NAT-ed to the host adapter, or is the host machine behind a
>> > NAT somewhere? If so, try changing the NAT traversal mode, or if that
>> > doesn't work try setting a specific local port.
>>
>> Thanks for the reply. The VM is NAT-ed to the host, and the host is
>> also NAT'ed (its all sitting behind my home's DSL connection, which is
>> behind a firewall).
>>
>> I'll try playing with the different --natt-mode options tonight and
>> see if any have an impact.
>>
>> As for setting a specific local port (with --local-port ), does it
>> matter what number i select, or is the goal simply to just select one
>> rather than getting a random port?
>>

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
L. Friedman netllama [at] gmail
LlamaLand https://netllama.linux-sxs.org

_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

gofman.mike at gmail

Nov 16, 2009, 10:36 AM

Post #6 of 12 (2144 views)
Permalink

Re: connection hangs inside virtual machines [In reply to]

The issue was reported here:
http://lists.unix-ag.uni-kl.de/pipermail/vpnc-devel/2009-October/003285.html

On Mon, Nov 16, 2009 at 1:04 PM, Lonni J Friedman <netllama [at] gmail>wrote:

> I'm confident its not an idle connection problem. I can be actively
> pinging a system across the VPN, and have the connection spontaneously
> die.
>
> Which rekeying problem are you referring to?
>
> thanks.
>
> On Mon, Nov 16, 2009 at 9:59 AM, Michael Gofman <gofman.mike [at] gmail>
> wrote:
> > Just FYI many firewalls automatically close idle connections.
> > It's either that or the rekeying problem that was reported previously.
> >
> > On Mon, Nov 16, 2009 at 12:54 PM, Lonni J Friedman <netllama [at] gmail>
> > wrote:
> >>
> >> On Sun, Nov 15, 2009 at 10:17 PM, Dan Williams <dcbw [at] redhat> wrote:
> >> > On Sun, 2009-11-15 at 18:06 -0800, Lonni J Friedman wrote:
> >> >> Greetings,
> >> >> I've been using vpnc on Linux to connect to a Cisco VPN for several
> >> >> years, and its great (certainly much better than Cisco's crappy Linux
> >> >> client). One long standing problem that I've experienced only
> >> >> reproduces when running vpnc inside of a virtual machine environment
> >> >> (VMWare, VirtualBox, etc) in which both the VM and the host OS are
> >> >> Linux. Namely, the VPN connection appears to silently die after some
> >> >> random period of time. vpnc is still running, but all network
> traffic
> >> >> to and from the remote VPN end dies completely. The only fix is to
> >> >> stop vpnc (vpnc-disconnect) and then re-connect again. The problem
> is
> >> >> present up to and including version 0.5.3.
> >> >
> >> > Is the VM NAT-ed to the host adapter, or is the host machine behind a
> >> > NAT somewhere? If so, try changing the NAT traversal mode, or if that
> >> > doesn't work try setting a specific local port.
> >>
> >> Thanks for the reply. The VM is NAT-ed to the host, and the host is
> >> also NAT'ed (its all sitting behind my home's DSL connection, which is
> >> behind a firewall).
> >>
> >> I'll try playing with the different --natt-mode options tonight and
> >> see if any have an impact.
> >>
> >> As for setting a specific local port (with --local-port ), does it
> >> matter what number i select, or is the goal simply to just select one
> >> rather than getting a random port?
> >>
>
>
>
> --
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> L. Friedman netllama [at] gmail
> LlamaLand https://netllama.linux-sxs.org
>
> _______________________________________________
> vpnc-devel mailing list
> vpnc-devel [at] unix-ag
> https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
> http://www.unix-ag.uni-kl.de/~massar/vpnc/<http://www.unix-ag.uni-kl.de/%7Emassar/vpnc/>
>

netllama at gmail

Nov 16, 2009, 6:48 PM

Post #7 of 12 (2135 views)
Permalink

Re: connection hangs inside virtual machines [In reply to]

On Mon, Nov 16, 2009 at 9:54 AM, Lonni J Friedman <netllama [at] gmail> wrote:
> On Sun, Nov 15, 2009 at 10:17 PM, Dan Williams <dcbw [at] redhat> wrote:
>> On Sun, 2009-11-15 at 18:06 -0800, Lonni J Friedman wrote:
>>> Greetings,
>>> I've been using vpnc on Linux to connect to a Cisco VPN for several
>>> years, and its great (certainly much better than Cisco's crappy Linux
>>> client). One long standing problem that I've experienced only
>>> reproduces when running vpnc inside of a virtual machine environment
>>> (VMWare, VirtualBox, etc) in which both the VM and the host OS are
>>> Linux. Namely, the VPN connection appears to silently die after some
>>> random period of time. vpnc is still running, but all network traffic
>>> to and from the remote VPN end dies completely. The only fix is to
>>> stop vpnc (vpnc-disconnect) and then re-connect again. The problem is
>>> present up to and including version 0.5.3.
>>
>> Is the VM NAT-ed to the host adapter, or is the host machine behind a
>> NAT somewhere? If so, try changing the NAT traversal mode, or if that
>> doesn't work try setting a specific local port.
>
> Thanks for the reply. The VM is NAT-ed to the host, and the host is
> also NAT'ed (its all sitting behind my home's DSL connection, which is
> behind a firewall).
>
> I'll try playing with the different --natt-mode options tonight and
> see if any have an impact.
>
> As for setting a specific local port (with --local-port ), does it
> matter what number i select, or is the goal simply to just select one
> rather than getting a random port?

OK, I tried all of the above, with poor results. When setting the
--natt-mode option:

force-natt: died after a few minutes (original problem)
cisco-udp: died after a few minutes (original problem)
none: connected, but couldn't reach any remote hosts

When setting the --local-port option to anything other than 0, I got
(as the root user):

--local-port : Failed to bind to port X: permission denied

Any other suggestions?

thanks

_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

jengelh at medozas

Nov 16, 2009, 11:15 PM

Post #8 of 12 (2139 views)
Permalink

Re: connection hangs inside virtual machines [In reply to]

On Tuesday 2009-11-17 03:48, Lonni J Friedman wrote:
>OK, I tried all of the above, with poor results. When setting the
>--natt-mode option:
>
>force-natt: died after a few minutes (original problem)
>cisco-udp: died after a few minutes (original problem)
>none: connected, but couldn't reach any remote hosts

"None" reaching no hosts means your firewall blocks ESP -
or even that the VPN server itself does not accept ESP (been there).

>When setting the --local-port option to anything other than 0, I got
>(as the root user):
>--local-port : Failed to bind to port X: permission denied
>Any other suggestions?

port 0 means select a free one; anything between 1 and 1023 is reserved
for root.
_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

netllama at gmail

Nov 17, 2009, 7:26 AM

Post #9 of 12 (2144 views)
Permalink

Re: connection hangs inside virtual machines [In reply to]

On Mon, Nov 16, 2009 at 11:15 PM, Jan Engelhardt <jengelh [at] medozas> wrote:
>
> On Tuesday 2009-11-17 03:48, Lonni J Friedman wrote:
>>OK, I tried all of the above, with poor results. When setting the
>>--natt-mode option:
>>
>>force-natt: died after a few minutes (original problem)
>>cisco-udp: died after a few minutes (original problem)
>>none: connected, but couldn't reach any remote hosts
>
> "None" reaching no hosts means your firewall blocks ESP -
> or even that the VPN server itself does not accept ESP (been there).
>
>>When setting the --local-port option to anything other than 0, I got
>>(as the root user):
>>--local-port : Failed to bind to port X: permission denied
>>Any other suggestions?
>
> port 0 means select a free one; anything between 1 and 1023 is reserved
> for root.

Right, but I was running vpnc as root, so shouldn't it have worked for
any port that wasn't already in use?

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
L. Friedman netllama [at] gmail
LlamaLand https://netllama.linux-sxs.org

_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

jengelh at medozas

Nov 17, 2009, 9:28 AM

Post #10 of 12 (2136 views)
Permalink

Re: connection hangs inside virtual machines [In reply to]

On Tuesday 2009-11-17 16:26, Lonni J Friedman wrote:
>>>When setting the --local-port option to anything other than 0, I got
>>>(as the root user):
>>>--local-port : Failed to bind to port X: permission denied
>>>Any other suggestions?
>>
>> port 0 means select a free one; anything between 1 and 1023 is reserved
>> for root.
>
>Right, but I was running vpnc as root, so shouldn't it have worked for
>any port that wasn't already in use?

selinux is bound to interfere whenever you least expect it.
Could that be your case?
_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

netllama at gmail

Nov 17, 2009, 9:39 AM

Post #11 of 12 (2135 views)
Permalink

Re: connection hangs inside virtual machines [In reply to]

On Tue, Nov 17, 2009 at 9:28 AM, Jan Engelhardt <jengelh [at] medozas> wrote:
>
> On Tuesday 2009-11-17 16:26, Lonni J Friedman wrote:
>>>>When setting the --local-port option to anything other than 0, I got
>>>>(as the root user):
>>>>--local-port : Failed to bind to port X: permission denied
>>>>Any other suggestions?
>>>
>>> port 0 means select a free one; anything between 1 and 1023 is reserved
>>> for root.
>>
>>Right, but I was running vpnc as root, so shouldn't it have worked for
>>any port that wasn't already in use?
>
> selinux is bound to interfere whenever you least expect it.
> Could that be your case?

Nope, selinux is disabled on both the guest & host OS's.

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
L. Friedman netllama [at] gmail
LlamaLand https://netllama.linux-sxs.org
_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

netllama at gmail

Nov 18, 2009, 8:28 AM

Post #12 of 12 (2135 views)
Permalink

Re: connection hangs inside virtual machines [In reply to]

Any other suggestions? Will some debug level output be useful?

thanks

On Tue, Nov 17, 2009 at 9:39 AM, Lonni J Friedman <netllama [at] gmail> wrote:
> On Tue, Nov 17, 2009 at 9:28 AM, Jan Engelhardt <jengelh [at] medozas> wrote:
>>
>> On Tuesday 2009-11-17 16:26, Lonni J Friedman wrote:
>>>>>When setting the --local-port option to anything other than 0, I got
>>>>>(as the root user):
>>>>>--local-port : Failed to bind to port X: permission denied
>>>>>Any other suggestions?
>>>>
>>>> port 0 means select a free one; anything between 1 and 1023 is reserved
>>>> for root.
>>>
>>>Right, but I was running vpnc as root, so shouldn't it have worked for
>>>any port that wasn't already in use?
>>
>> selinux is bound to interfere whenever you least expect it.
>> Could that be your case?
>
> Nope, selinux is disabled on both the guest & host OS's.
>
_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads