Mailing List Archive: vpnc: devel

VPNC works for client machines in network but not from Proxy server

Index | Next | Previous | View Threaded

brizuela.victor.javier at gmail

Jan 19, 2010, 8:29 AM

Post #1 of 4 (1454 views)
Permalink

VPNC works for client machines in network but not from Proxy server

Hello,

I am having a strange problem trying to use VPNC. I am able to connect
to a VPN network from both my PC and the proxy server, but on the
proxy server no traffic seems to return.

Here is a connection attempt from my PC (192.168.1.74):

dusty:~# vpnc dasa
VPNC started in background (pid: 11582)...
dusty:~# ping 10.10.20.20
PING 10.10.20.20 (10.10.20.20) 56(84) bytes of data.
64 bytes from 10.10.20.20: icmp_seq=1 ttl=63 time=7.90 ms
64 bytes from 10.10.20.20: icmp_seq=2 ttl=63 time=8.18 ms
64 bytes from 10.10.20.20: icmp_seq=3 ttl=63 time=7.58 ms
64 bytes from 10.10.20.20: icmp_seq=4 ttl=63 time=7.95 ms
64 bytes from 10.10.20.20: icmp_seq=5 ttl=63 time=7.73 ms
^C
--- 10.10.20.20 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4017ms
rtt min/avg/max/mdev = 7.583/7.871/8.181/0.225 ms

Now, from the proxy server (192.168.2.1):

sphinx:~# vpnc dasa
VPNC started in background (pid: 27469)...
sphinx:~# ping 10.10.20.20
PING 10.10.20.20 (10.10.20.20) 56(84) bytes of data.
^C
--- 10.10.20.20 ping statistics ---
63 packets transmitted, 0 received, 100% packet loss, time 62032ms

Here is the routing table after I run vpnc on the proxy server:

sphinx:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
200.45.109.14 200.69.253.78 255.255.255.255 UGH 0 0 0 eth2
200.69.253.64 0.0.0.0 255.255.255.240 U 0 0 0 eth2
200.69.253.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
192.168.0.0 0.0.0.0 255.255.252.0 U 0 0 0 eth1
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 tun0

That didn't seem to be correct, so I added:
route add -net 10.10.20.0 netmask 255.255.255.0 gw 200.45.109.14 dev tun0

which didn't help.

On the other hand, here is the routing table on my PC after I run vpnc:

dusty:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
200.45.109.14 192.168.2.1 255.255.255.255 UGH 0 0 0 eth0
10.10.20.95 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.10.20.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.0.0 0.0.0.0 255.255.252.0 U 0 0 0 eth0
0.0.0.0 192.168.2.1 0.0.0.0 UG 0 0 0 eth0

I don't get what's going on here. I have the exact same version of
vpnc of both machines (0.5.1, which comes with Debian Lenny) and I'm
using the same configuration file:

DNSUpdate No
IPSec gateway 200.45.109.14
IPSec ID Some_id
IPSec secret Some_passwd
IKE Authmode psk
Xauth username Some_username
Xauth password Some_other_passwd
Target networks 10.10.20.0/24

Anyone has any idea of what could be going on here? I could post a
debug output of vpnc if necessary, only that I didn't want to prolong
an already long email.

BTW, I tried downloading and compiling the latest version of vpnc from
the website but that didn't work either.

Any help would be greatly appreciated. Thanks,

--
Victor Javier Brizuela
http://w2bh.com.ar/

BOFH excuse #38:
secretary plugged hairdryer into UPS
_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

brizuela.victor.javier at gmail

Jan 20, 2010, 7:34 AM

Post #2 of 4 (1387 views)
Permalink

Re: VPNC works for client machines in network but not from Proxy server [In reply to]

On Tue, Jan 19, 2010 at 13:29, Victor Javier Brizuela
<brizuela.victor.javier [at] gmail> wrote:
> Hello,
>
> I am having a strange problem trying to use VPNC. I am able to connect
> to a VPN network from both my PC and the proxy server, but on the
> proxy server no traffic seems to return.
>
(...)
>
> Here is the routing table after I run vpnc on the proxy server:
>
> sphinx:~# route -n
> Kernel IP routing table
> Destination Gateway Genmask Flags Metric Ref Use Iface
> 200.45.109.14 200.69.253.78 255.255.255.255 UGH 0 0 0 eth2
> 200.69.253.64 0.0.0.0 255.255.255.240 U 0 0 0 eth2
> 200.69.253.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
> 192.168.0.0 0.0.0.0 255.255.252.0 U 0 0 0 eth1
> 0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 tun0

These routes seemed very strange, so I did a purge of the package and
reinstalled, and now I see something much more sane after starting
vpnc on the proxy:

sphinx:/etc/vpnc# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
200.45.109.14 200.69.253.78 255.255.255.255 UGH 0 0 0 eth2
10.10.20.95 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
200.69.253.64 0.0.0.0 255.255.255.240 U 0 0 0 eth2
10.10.20.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
200.69.253.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
192.168.0.0 0.0.0.0 255.255.252.0 U 0 0 0 eth1
0.0.0.0 200.69.253.78 0.0.0.0 UG 0 0 0 eth2

My problem is still there, though. I can succesfully use vpnc from
client machines on the network but no traffic seems to go through when
I start it on the proxy.

Is there anywhere I could look to shed some light on this problem?

Thanks,

--
Victor Javier Brizuela
http://w2bh.com.ar/

BOFH excuse #38:
secretary plugged hairdryer into UPS

_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

brizuela.victor.javier at gmail

Jan 27, 2010, 6:42 AM

Post #3 of 4 (1363 views)
Permalink

Re: VPNC works for client machines in network but not from Proxy server [In reply to]

On Wed, Jan 20, 2010 at 12:34, Victor Javier Brizuela
<brizuela.victor.javier [at] gmail> wrote:
> My problem is still there, though. I can succesfully use vpnc from
> client machines on the network but no traffic seems to go through when
> I start it on the proxy.

Well, I finally tracked down my problem to a firewall issue. But the
problem has reversed now, I can connect from the proxy server and
succesfully exchange traffic, but no PCs on the network are able to
transfer anything through the VPN conection established by the proxy.
I currently have the following iptables rules set for forwarding:

iptables -A FORWARD -p esp -j ACCEPT
iptables -A FORWARD -p udp --dport isakmp -j ACCEPT
iptables -A FORWARD -p udp --dport 10000 -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT

Do I need something else to make this work, maybe an SNAT rule?

Thanks,

--
Victor Javier Brizuela
http://w2bh.com.ar/

BOFH excuse #38:
secretary plugged hairdryer into UPS
_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

Tomas.Kopal at eccam

Jan 28, 2010, 2:41 AM

Post #4 of 4 (1364 views)
Permalink

Re: VPNC works for client machines in network but not from Proxy server [In reply to]

On 27.1.2010 15:42, Victor Javier Brizuela wrote:
> On Wed, Jan 20, 2010 at 12:34, Victor Javier Brizuela
> <brizuela.victor.javier [at] gmail> wrote:
>
>> My problem is still there, though. I can succesfully use vpnc from
>> client machines on the network but no traffic seems to go through when
>> I start it on the proxy.
>>
> Well, I finally tracked down my problem to a firewall issue. But the
> problem has reversed now, I can connect from the proxy server and
> succesfully exchange traffic, but no PCs on the network are able to
> transfer anything through the VPN conection established by the proxy.
> I currently have the following iptables rules set for forwarding:
>
> iptables -A FORWARD -p esp -j ACCEPT
> iptables -A FORWARD -p udp --dport isakmp -j ACCEPT
> iptables -A FORWARD -p udp --dport 10000 -j ACCEPT
> iptables -A FORWARD -o tun+ -j ACCEPT
>
> Do I need something else to make this work, maybe an SNAT rule?
>
> Thanks,
>
>

Does the access through the VPN work on the proxy, or is even the proxy
unable to communicate? How is your routing set up on the proxy and the
clients?

Regards

Tomas

_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads