pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work"
From: Rocco Caputo (rcaputo_at_pobox.com)
Date: 07/30/03
- Previous message: Don Bowman: "RE: Help with FreeBSD Bridged Firewall"
- Next in thread: Julian Elischer: "Re: pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
- Reply: Julian Elischer: "Re: pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Wed, 30 Jul 2003 15:15:30 -0400 To: freebsd-net@freebsd.org
[Originally posted to freebsd-questions, but someone suggested
freebsd-net instead.]
I've acquired DSL. My modem's PPPoE and NAT have a tendency to remap
ports, so I switched it to bridged Ethernet. Now I'm using ppp(8) for
PPPoE. I'm using ipfw2 for QOS things (pipes and queues). I'm using
ipf for firewalling and ftp proxying.
Almost everything works well, except (so far) active FTP and pinging the
tun0 interface.
tcpdump shows ICMP echo requests and responses, but ping does not see
them. Opening ipf (pass in all, pass out all) "fixes" ping.
ipfnat's active ftp proxy sees the PORT request and punches a hole
through the firewall, but incoming packets don't arrive. Opening ipf
"fixes" this, too.
Other incoming connections seem to work fine. DNS works fine. TCP
works fine.
I've read the handbook, the howtos, searched the list archives, usenet,
and the web. Nothing solved it.
So. What have I overlooked? Where have I gone wrong? Would you like
to see my cling-film collection? How about an extensive (but perhaps
not exhaustive) collection of excerpts from my system configuration
files? Ok, it is included.
-- Rocco Caputo - rcaputo@pobox.com - http://poe.perl.org/ === ppp.conf default: ident user-ppp VERSION (built COMPILATIONDATE) set log CBCP CCP Chat Connect Command IPCP tun Phase Warning papchap: add default HISADDR disable ipv6cp disable vjcomp enable iface-alias enable lqr enable tcpmssfixup nat enable yes nat log yes nat same_ports yes set authkey ***** set authname ***** set cd 5 set crtscts off set device PPPoE:dc0 set dia set ifaddr 68.213.211.142/0 192.168.36.176/0 set login set lqrperiod 1 set mru 1492 set mtu 1492 set redial 1 0 set server /var/run/tun0 "" 0177 set speed sync set timeout 0 === netstat -rn Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default 192.168.36.176 UGSc 80 1377475 tun0 10 link#2 UC 4 0 rl0 10.0.0.7 link#2 UHLW 0 8 rl0 10.0.0.18 00:e0:18:0b:ac:22 UHLW 1 115334 rl0 303 10.0.0.25 00:e0:18:30:68:32 UHLW 0 292874 lo0 10.0.0.100 00:e0:18:30:65:f6 UHLW 1 111019 rl0 163 127.0.0.1 127.0.0.1 UH 6 196295 lo0 192.168.1 link#1 UC 2 0 dc0 192.168.1.25 00:04:5a:59:8e:92 UHLW 0 142112 lo0 192.168.1.254 00:60:0f:31:c7:86 UHLW 0 75153 dc0 865 192.168.36.176 68.213.211.142 UH 76 71059 tun0 === ipfstat -i block in quick on tun0 from 0.0.0.0/8 to any block in quick on tun0 from 127.0.0.0/8 to any block in quick on tun0 from 169.254.0.0/16 to any block in quick on tun0 from 172.16.0.0/12 to any block in quick on tun0 from 192.0.2.0/24 to any block in quick on tun0 from 192.168.0.0/16 to any block in quick on tun0 from 224.0.0.0/4 to any block in quick on tun0 from 240.0.0.0/4 to any pass in quick on lo0 from any to any pass in quick on rl0 from any to any pass in quick on dc0 from any to any pass in quick on tun0 proto tcp from any to any port = 80 flags S/FSRPAU keep state keep frags pass in quick on tun0 proto tcp from any to any port = 113 flags S/FSRPAU keep state keep frags pass in quick on tun0 proto tcp from any to any port = 433 flags S/FSRPAU keep state keep frags pass in quick on tun0 proto tcp from any to any port 6881 >< 6999 flags S/FSRPAU keep state keep frags pass in quick on tun0 proto tcp from any to any port = 11512 flags S/FSRPAU keep state keep frags pass in quick on tun0 proto tcp from any to any port 32000 >< 32100 flags S/FSRPAU keep state keep frags block in quick from any to any === ipfstat -o block out quick on tun0 from 0.0.0.0/8 to any block out quick on tun0 from 127.0.0.0/8 to any block out quick on tun0 from 169.254.0.0/16 to any block out quick on tun0 from 172.16.0.0/12 to any block out quick on tun0 from 192.0.2.0/24 to any block out quick on tun0 from 192.168.0.0/16 to any block out quick on tun0 from 224.0.0.0/4 to any block out quick on tun0 from 240.0.0.0/4 to any pass out quick on lo0 from any to any pass out quick on rl0 from any to any pass out quick on dc0 from any to any pass out quick on tun0 proto icmp from any to any keep state pass out quick on tun0 proto tcp from any to any flags S/FSRPAU keep state keep frags pass out quick on tun0 proto udp from any to any keep state keep frags block out quick from any to any === ipnat -l List of active MAP/Redirect filters: map tun0 68.213.211.142/32 -> 68.213.211.142/32 proxy port ftp ftp/tcp List of active sessions: (none) === various rc.conf bits ifconfig_dc0="inet 192.168.1.25 netmask 255.255.255.0" network_interfaces="lo0 rl0 dc0 tun0" firewall_enable="YES" firewall_logging="YES" firewall_type="/etc/rc.firewall.custom" firewall_flags="-p /usr/bin/cpp" ipfilter_enable="YES" ipfilter_program="/sbin/ipf" ipfilter_rules="/etc/ipf.rules" ipnat_enable="YES" ppp_enable="yes" ppp_mode="ddial" ppp_nat="yes" ppp_profile="papchap" === ipfw show 01110 queue 18 icmp from any to any in via tun0 01110 queue 18 ip from any to any in via tun0 iptos lowdelay,throughput 01120 queue 18 tcp from any to any in via tun0 tcpflags ack 01120 queue 18 tcp from any to any in via tun0 tcpflags ack 01300 queue 14 ip from any to any in via tun0 iptos lowdelay 01310 queue 14 tcp from any 6666-6669 to any in via tun0 01320 queue 14 tcp from any 80 to any in via tun0 01400 queue 11 tcp from any 119 to any in via tun0 01410 queue 11 tcp from any 5999 to any in via tun0 01420 queue 11 tcp from any to any in via tun0 iplen 1500 01430 queue 11 tcp from any 6881-6889 to any in via tun0 01440 queue 11 tcp from any to any dst-port 6881-6889 in via tun0 01900 queue 12 ip from any to any in via tun0 02100 queue 28 icmp from any to any out via tun0 02110 queue 28 ip from any to any out via tun0 iptos lowdelay,throughput 02120 queue 28 tcp from any to any out via tun0 tcpflags ack 02130 queue 28 tcp from any to any out via tun0 setup 02300 queue 24 ip from any to any out via tun0 iptos lowdelay 02310 queue 24 tcp from any to any dst-port 6666-6669 out via tun0 02400 queue 21 tcp from any 80 to any out via tun0 02410 queue 21 tcp from any 443 to any out via tun0 02420 queue 21 tcp from any 11512 to any out via tun0 02430 queue 21 tcp from any to any dst-port 119 out via tun0 02440 queue 21 tcp from any to any dst-port 5999 out via tun0 02450 queue 21 tcp from any to any out via tun0 iplen 1500 02460 queue 21 tcp from any 6881-6889 to any out via tun0 02470 queue 21 tcp from any to any dst-port 6881-6889 out via tun0 02900 queue 22 ip from any to any out via tun0 60000 allow ip from any to any via lo0 60010 allow ip from any to any via rl0 60020 allow ip from any to any via dc0 60030 allow ip from any to any via tun0 60040 allow ip from any to any 65535 deny ip from any to any === ipfw queue show 00010: 368.000 Kbit/s 0 ms 36 KB 0 queues (1 buckets) droptail mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000 00011: 736.000 Kbit/s 0 ms 73 KB 0 queues (1 buckets) droptail mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000 00012: 1.472 Mbit/s 0 ms 147 KB 0 queues (1 buckets) droptail mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000 00020: 64.000 Kbit/s 0 ms 6144 B 0 queues (1 buckets) droptail mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000 00021: 128.000 Kbit/s 0 ms 12 KB 0 queues (1 buckets) droptail mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000 00022: 256.000 Kbit/s 0 ms 25 KB 0 queues (1 buckets) droptail mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000 === end _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
- Previous message: Don Bowman: "RE: Help with FreeBSD Bridged Firewall"
- Next in thread: Julian Elischer: "Re: pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
- Reply: Julian Elischer: "Re: pppoe, can't ping tun0, ipfnat ftp proxy "doesn't work""
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
|
