[7.250] Gateway Policy Route stop to work [NOTABUG]

My Gateway Policy route for ftp stops to works without a reason.
My configuration:
2Mbit SDSL (Def GW)
16MBit ADSL (no daily disconnect, static ip)

i route ftp traffic to the ADSL Line, after a night FTP stop to work,
disabling/enabling Police Route resolves this problem.
(Policyroute for HTTP still work)

Not sure where i have to look if this error occurs....

Gregor Kemter

Parents

0 tom_01 over 17 years ago

I guess this is related to the daily (nightly?) SDSL reconnect. Can you confirm by triggering a reconnect manually (power-cycle SDSL router) please?

Thanks!
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gkemter over 17 years ago in reply to tom_01

Both of my lines dont have a daily disconnect/reconnect.

After manualy disconnect/reconnect ADSL all policy routes stop to work.
After reboot (eg install 7.260) all my policy routes stop to work.
I have to disable and renable all to got it working again.

regards

Gregor Kemter
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gkemter over 17 years ago in reply to tom_01

A reboot affects all Policy routes.
After night only ftp route stop to work.
Maybe the firewall make some cleanups/restarts of services after 24:00 ?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 da_merlin over 16 years ago in reply to gkemter

Can you verify there is no reconnect entry in /etc/crontab ?

You can verify the policy rules with these commands:

# ip rule
0: from all lookup local
1: from all fwmark 0x1 lookup 1
32766: from all lookup main
32767: from all lookup default

# ip show table 1
default dev eth0  scope link

# iptables -L -v -n -t mangle
Chain POLICY_ROUTING_OUT (1 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK match !0x0
    0     0 MARK       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spts:1:65535 dpt:445 MARK match 0x0 MARK set 0x1
    0     0 MARK       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spts:1:65535 dpt:445 MARK match 0x0 MARK set 0x1

Chain POLICY_ROUTING_PRE (1 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK match !0x0
    0     0 MARK       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spts:1:65535 dpt:445 MARK match 0x0 MARK set 0x1
    0     0 MARK       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spts:1:65535 dpt:445 MARK match 0x0 MARK set 0x1
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 gkemter over 16 years ago in reply to da_merlin

Here we go:

after manual disconnect/reconnect adsl line, my http policy routes stop to work, here the output:


borgqueen:/ # ip rule

0:      from all lookup local 

1:      from all fwmark 0x1 lookup 1 

32765:  from 192.168.254.0/24 to 192.168.11.0/24 lookup 42 

32765:  from 192.168.254.0/24 to 10.133.168.128/25 lookup 42 

32765:  from 192.168.254.0/24 to 192.168.15.0/24 lookup 42 

32765:  from all iif lo lookup 42 

32766:  from all lookup main 

32767:  from all lookup default 



....



borgqueen:/ # ip show table 1

Object "show" is unknown, try "ip help".



....



borgqueen:/ # iptables -L -v -n -t mangle

Chain PREROUTING (policy ACCEPT 531K packets, 305M bytes)

 pkts bytes target     prot opt in     out     source               destination         

 534K  305M POLICY_ROUTING_PRE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           



Chain INPUT (policy ACCEPT 62390 packets, 18M bytes)

 pkts bytes target     prot opt in     out     source               destination         

   84 12734 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK set 0x0 

   84 12734 AFC_DETECT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           



Chain FORWARD (policy ACCEPT 460K packets, 284M bytes)

 pkts bytes target     prot opt in     out     source               destination         



Chain OUTPUT (policy ACCEPT 78995 packets, 29M bytes)

 pkts bytes target     prot opt in     out     source               destination         

78395   28M POLICY_ROUTING_OUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           



Chain POSTROUTING (policy ACCEPT 471K packets, 294M bytes)

 pkts bytes target     prot opt in     out     source               destination         

  604  306K MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK set 0x0 

  604  306K AFC_DETECT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           



Chain AFC_DETECT (2 references)

 pkts bytes target     prot opt in     out     source               destination         

  106 19156 RETURN     all  --  *      *       127.0.0.0/8          127.0.0.0/8         

    2   117 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:4444 dpts:1:65535 ADDRTYPE match src-type LOCAL 

    2   200 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:22 dpts:1:65535 ADDRTYPE match src-type LOCAL 

    1    40 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spts:1:65535 dpt:4444 ADDRTYPE match dst-type LOCAL 

    3   224 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spts:1:65535 dpt:22 ADDRTYPE match dst-type LOCAL 

    7   553 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK match 0x10000/0x10000 

  132 30993 NFQUEUE    all  --  *      *       192.168.254.0/24     0.0.0.0/0           NFQUEUE num 1 bypass 

   97 57475 NFQUEUE    all  --  *      *       0.0.0.0/0            192.168.254.0/24    NFQUEUE num 1 bypass 

    5  1759 NFQUEUE    all  --  *      *       0.0.0.0/0            0.0.0.0/0           ADDRTYPE match dst-type LOCAL NFQUEUE num 1 bypass 

    6   352 NFQUEUE    all  --  *      *       0.0.0.0/0            0.0.0.0/0           ADDRTYPE match src-type LOCAL NFQUEUE num 1 bypass 

  325  206K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           



Chain POLICY_ROUTING_OUT (1 references)

 pkts bytes target     prot opt in     out     source               destination         

    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK match !0x0 

    0     0 MARK       all  --  eth3   *       192.168.177.0/24     0.0.0.0/0           MARK match 0x0 MARK set 0x1 

    0     0 MARK       tcp  --  *      *       213.148.150.210      0.0.0.0/0           tcp spts:1:65535 dpt:80 MARK match 0x0 MARK set 0x1 

    0     0 MARK       tcp  --  *      *       213.148.150.210      0.0.0.0/0           tcp spts:1:65535 dpt:443 MARK match 0x0 MARK set 0x1 



Chain POLICY_ROUTING_PRE (1 references)

 pkts bytes target     prot opt in     out     source               destination         

    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK match !0x0 

  117  4680 MARK       all  --  eth3   *       192.168.177.0/24     0.0.0.0/0           MARK match 0x0 MARK set 0x1 

    0     0 MARK       tcp  --  *      *       213.148.150.210      0.0.0.0/0           tcp spts:1:65535 dpt:80 MARK match 0x0 MARK set 0x1 

    0     0 MARK       tcp  --  *      *       213.148.150.210      0.0.0.0/0           tcp spts:1:65535 dpt:443 MARK match 0x0 MARK set 0x1 



Chain SANITYCHECK_FORWARD (0 references)

 pkts bytes target     prot opt in     out     source               destination         



Chain SANITYCHECK_IN (0 references)

 pkts bytes target     prot opt in     out     source               destination

Gregor Kemter

0 da_merlin over 16 years ago in reply to gkemter

Sorry, typo in command.
Right one is "ip route show table 1"

As you can see in POLICY_ROUTING_PRE, there a three policy routes
  117  4680 MARK       all  --  eth3   *       192.168.177.0/24     0.0.0.0/0           MARK match 0x0 MARK set 0x1
    0     0 MARK       tcp  --  *      *       213.148.150.210      0.0.0.0/0           tcp spts:1:65535 dpt:80 MARK match 0x0 MARK set 0x1
    0     0 MARK       tcp  --  *      *       213.148.150.210      0.0.0.0/0           tcp spts:1:65535 dpt:443 MARK match 0x0 MARK set 0x1

One for network 192.168.177.0/24, one for HTTP and one for HTTPS.

So the FTP rule is missing ?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gkemter over 16 years ago in reply to da_merlin

The policy route for FTP is disabled because it stops to work, i am to lazy to disable/enable it every morning, i will recheck it on monday. [:)]

But after reconnect dsl the 3 routes in POLICY_ROUTING_PRE also dont work.

Gregor Kemter
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 da_merlin over 16 years ago in reply to gkemter

Is the source IP 213.148.150.210 of the rule correct ?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gkemter over 16 years ago in reply to da_merlin

I route http traffic from proxy , so the ip is correct .
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 gkemter over 16 years ago in reply to gkemter

@da_merlin

Here we go Part #2

Stats after enabling FTP-Policyrouting and before 24:00


borgqueen:/home/login # ip rule

0:      from all lookup local 

1:      from all fwmark 0x1 lookup 1 

32765:  from 192.168.254.0/24 to 192.168.11.0/24 lookup 42 

32765:  from 192.168.254.0/24 to 10.133.168.128/25 lookup 42 

32765:  from 192.168.254.0/24 to 192.168.15.0/24 lookup 42 

32765:  from all iif lo lookup 42 

32766:  from all lookup main 

32767:  from all lookup default 



...

borgqueen:/home/login # ip route show table 1

default via 213.148.133.72 dev ppp0 



..

borgqueen:/home/login # iptables -L -v -n -t mangle

Chain PREROUTING (policy ACCEPT 24M packets, 14G bytes)

 pkts bytes target     prot opt in     out     source               destination         

  25M   14G POLICY_ROUTING_PRE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           



Chain INPUT (policy ACCEPT 4745K packets, 1799M bytes)

 pkts bytes target     prot opt in     out     source               destination         

6590K 2524M MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK set 0x0 

6590K 2524M AFC_DETECT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           



Chain FORWARD (policy ACCEPT 18M packets, 12G bytes)

 pkts bytes target     prot opt in     out     source               destination         



Chain OUTPUT (policy ACCEPT 6753K packets, 2595M bytes)

 pkts bytes target     prot opt in     out     source               destination         

6752K 2594M POLICY_ROUTING_OUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           



Chain POSTROUTING (policy ACCEPT 19M packets, 11G bytes)

 pkts bytes target     prot opt in     out     source               destination         

  24M   14G MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK set 0x0 

  24M   14G AFC_DETECT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           



Chain AFC_DETECT (2 references)

 pkts bytes target     prot opt in     out     source               destination         

7569K 1633M RETURN     all  --  *      *       127.0.0.0/8          127.0.0.0/8         

 173K  202M RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:4444 dpts:1:65535 ADDRTYPE match src-type LOCAL 

  308 53600 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:22 dpts:1:65535 ADDRTYPE match src-type LOCAL 

 113K   10M RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spts:1:65535 dpt:4444 ADDRTYPE match dst-type LOCAL 

  494 35316 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spts:1:65535 dpt:22 ADDRTYPE match dst-type LOCAL 

1683K 1075M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK match 0x10000/0x10000 

4033K 1901M NFQUEUE    all  --  *      *       192.168.254.0/24     0.0.0.0/0           NFQUEUE num 1 bypass 

1857K 1213M NFQUEUE    all  --  *      *       0.0.0.0/0            192.168.254.0/24    NFQUEUE num 1 bypass 

1005K  617M NFQUEUE    all  --  *      *       0.0.0.0/0            0.0.0.0/0           ADDRTYPE match dst-type LOCAL NFQUEUE num 1 bypass 

 924K  132M NFQUEUE    all  --  *      *       0.0.0.0/0            0.0.0.0/0           ADDRTYPE match src-type LOCAL NFQUEUE num 1 bypass 

  14M 9674M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           



Chain POLICY_ROUTING_OUT (1 references)

 pkts bytes target     prot opt in     out     source               destination         

    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK match !0x0 

    0     0 MARK       all  --  eth3   *       192.168.177.0/24     0.0.0.0/0           MARK match 0x0 MARK set 0x1 

 6623  978K MARK       tcp  --  *      *       213.148.150.210      0.0.0.0/0           tcp spts:1:65535 dpt:80 MARK match 0x0 MARK set 0x1 

   37  5565 MARK       tcp  --  *      *       213.148.150.210      0.0.0.0/0           tcp spts:1:65535 dpt:443 MARK match 0x0 MARK set 0x1 

    0     0 MARK       tcp  --  eth1   *       192.168.254.0/24     0.0.0.0/0           tcp spts:1024:65535 dpts:20:21 MARK match 0x0 MARK set 0x1 



Chain POLICY_ROUTING_PRE (1 references)

 pkts bytes target     prot opt in     out     source               destination         

 6002 1556K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           MARK match !0x0 

 211K 8518K MARK       all  --  eth3   *       192.168.177.0/24     0.0.0.0/0           MARK match 0x0 MARK set 0x1 

    0     0 MARK       tcp  --  *      *       213.148.150.210      0.0.0.0/0           tcp spts:1:65535 dpt:80 MARK match 0x0 MARK set 0x1 

    0     0 MARK       tcp  --  *      *       213.148.150.210      0.0.0.0/0           tcp spts:1:65535 dpt:443 MARK match 0x0 MARK set 0x1 

    0     0 MARK       tcp  --  eth1   *       192.168.254.0/24     0.0.0.0/0           tcp spts:1024:65535 dpts:20:21 MARK match 0x0 MARK set 0x1 



Chain SANITYCHECK_FORWARD (0 references)

 pkts bytes target     prot opt in     out     source               destination         



Chain SANITYCHECK_IN (0 references)

 pkts bytes target     prot opt in     out     source               destination

Tomorrow, after ftp stops to work, i will post the result.

Gregor Kemter

0 gkemter over 16 years ago in reply to gkemter

after a lot of test , finaly i figure it out :

The policy routes dont stop to work.
My problem with ftp policy route is :
ftp connect works,
but all ftp commands like ls are very slow.
So i got a timeout retrieving directorylist from ftp.

The funny thing is:
(For testing i use ftp.astaro.de)
i have a separate lan segment with 192.168.177.0/24 and a policy route:
192.168.177.0. -> 192.168.177.1 -> any -> any -> Target DSL_GW
This one works perfect

192.168.254.0 -> 192.168.254.254 -> ftp -> any -> Target DSL_GW
This one works, but need ~ 5-10sec to retrieve directorycontent after ftp connect
Here i try to split the rules for ftp-data and ftp-control but same result.

I also check the DSL Line without astaro on a standalone PC, ftp works like a charm.

Gregor Kemter
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 tom_01 over 16 years ago in reply to gkemter

ftp-data means port 20, but modern clients and servers don't use that port for data connections any more, since it may require "superuser" privileges on many operating systems.

Set your client to always use passive mode. If it supports using a fixed source port range for outgoing passive connections, you can route that range.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 tom_01 over 16 years ago in reply to gkemter

ftp-data means port 20, but modern clients and servers don't use that port for data connections any more, since it may require "superuser" privileges on many operating systems.

Set your client to always use passive mode. If it supports using a fixed source port range for outgoing passive connections, you can route that range.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 gkemter over 16 years ago in reply to tom_01

ftp-data means port 20, but modern clients and servers don't use that port for data connections any more, since it may require "superuser" privileges on many operating systems.

Set your client to always use passive mode. If it supports using a fixed source port range for outgoing passive connections, you can route that range.

I change the Question:

what is the best practice with ASG 7.3 and FTP Proxy enabled/disabled, to route outgoing ftp-traffic over a secondary dsl interface ?

Gregor Kemter
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel