PPTP kapcsolódás esetén GRE hiba

Hálózatok általános

Egy tűzfal mögötti vpn szerverre szeretnék kapcsolódni Windows 7 kliensből.

iptables:

iptables -A INPUT -i eth0 -p tcp -j ACCEPT --dport 47
iptables -A INPUT -i eth0 -p tcp -j ACCEPT --dport 1723

iptables -A FORWARD -s 0/0 -p 47 -j ACCEPT
iptables -A FORWARD -s 0/0 -p tcp --dport 1723 -j ACCEPT

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 47 -j DNAT --to 192.168.1.111
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1723 -j DNAT --to 192.168.1.111

log:

2018:11:01-22:43:53 vpn pptpd[4132]: MGR: Launching /usr/sbin/pptpctrl to handle client
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: local address = 192.168.1.1
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: remote address = 192.168.1.2
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: Client x.x.x.x control connection started
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: Received PPTP Control Message (type: 1)
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: Made a START CTRL CONN RPLY packet
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: I wrote 156 bytes to the client.
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: Sent packet to client
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: Received PPTP Control Message (type: 7)
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: Set parameters to 100000000 maxbps, 64 window size
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: Made a OUT CALL RPLY packet
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: Starting call (launching pppd, opening GRE)
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: pty_fd = 6
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: tty_fd = 7
2018:11:01-22:43:53 vpn pptpd[4133]: CTRL (PPPD Launcher): program binary = /usr/sbin/pppd
2018:11:01-22:43:53 vpn pptpd[4133]: CTRL (PPPD Launcher): local address = 192.168.1.1
2018:11:01-22:43:53 vpn pptpd[4133]: CTRL (PPPD Launcher): remote address = 192.168.1.2
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: I wrote 32 bytes to the client.
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: Sent packet to client
2018:11:01-22:43:53 vpn pppd-pptp[4133]: Plugin aua.so loaded.
2018:11:01-22:43:53 vpn pppd-pptp[4133]: AUA plugin initialized.
2018:11:01-22:43:53 vpn pppd-pptp[4133]: pppd 2.4.7 started by (unknown), uid 0
2018:11:01-22:43:53 vpn pppd-pptp[4133]: using channel 14
2018:11:01-22:43:53 vpn pppd-pptp[4133]: Starting negotiation on /dev/pts/1
2018:11:01-22:43:53 vpn pppd-pptp[4133]: sent [LCP ConfReq id=0x1
]
2018:11:01-22:43:53 vpn pptpd[4132]: GRE: Bad checksum from pppd.
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: Received PPTP Control Message (type: 15)
2018:11:01-22:43:53 vpn pptpd[4132]: CTRL: Got a SET LINK INFO packet with standard ACCMs
2018:11:01-22:43:56 vpn pppd-pptp[4133]: sent [LCP ConfReq id=0x1
]

2018:11:01-22:44:20 vpn pppd-pptp[4133]: sent [LCP ConfReq id=0x1
]
2018:11:01-22:44:23 vpn pppd-pptp[4133]: LCP: timeout sending Config-Requests
2018:11:01-22:44:23 vpn pppd-pptp[4133]: Connection terminated.
2018:11:01-22:44:23 vpn pppd-pptp[4133]: Modem hangup
2018:11:01-22:44:23 vpn pppd-pptp[4133]: Exit.
2018:11:01-22:44:23 vpn pptpd[4132]: GRE: read(fd=6,buffer=805a560,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
2018:11:01-22:44:23 vpn pptpd[4132]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7)
2018:11:01-22:44:23 vpn pptpd[4132]: CTRL: Reaping child PPP[4133]
2018:11:01-22:44:23 vpn pptpd[4132]: CTRL: Client x.x.x.x control connection finished
2018:11:01-22:44:23 vpn pptpd[4132]: CTRL: Exiting now
2018:11:01-22:44:23 vpn pptpd[31793]: MGR: Reaped child 4132

Mi lehet a gondja?

  • 1168 megtekintés

cseréltem ezt is:
iptables -t nat -A PREROUTING -i eth3 -p gre -j DNAT --to 192.168.1.111

ugyanaz

iptables most:
iptables -A INPUT -i eth0 -p gre -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -j ACCEPT --dport 1723

iptables -A FORWARD -s 0/0 -p gre -j ACCEPT
iptables -A FORWARD -s 0/0 -p tcp --dport 1723 -j ACCEPT

iptables -t nat -A PREROUTING -i eth0 -p gre -j DNAT --to 192.168.1.111
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1723 -j DNAT --to 192.168.1.111

( stra | 2018. 11. 02., p – 10:42 )

A tűzfalon be vannak töltve a NAT-hoz és connection trackinghez szükséges modulok? (nf_conntrack_pptp, nf_nat_pptp)

igen:

nf_nat_pptp 13115 0
nf_nat_proto_gre 13009 1 nf_nat_pptp
nf_conntrack_pptp 19258 1 nf_nat_pptp
nf_conntrack_proto_gre 14434 1 nf_conntrack_pptp
nf_nat 21841 7 ipt_MASQUERADE,nf_nat_proto_gre,nf_nat_ipv4,nf_nat_pptp,xt_nat,xt_REDIRECT,iptable_nat
nf_conntrack 97201 9 nf_conntrack_proto_gre,ipt_MASQUERADE,nf_nat,nf_nat_ipv4,nf_nat_pptp,xt_conntrack,iptable_nat,nf_conntrack_ipv4,nf_conntrack_pptp