[7.450][BUG][NOTABUG] SSL-VPN does not work as expected

Hi,

I've a problem connecting to my home-astaro with vpn-ssl. The VPN works, I get an ip-adress and I'm able to ping my pc at home. But...
- I can not connect with rdp to my server...
- I can connect with ultra-vnc to my pc...
- I can not use any network ressource on the network at work...
- I can not use anything on the web (behind our asg-320 at work)

The old behavior (7.402) was:
No problem with connections to home-server via rdp/vnc and servers at work via rdp/vnc at the same time. Websurfing via asg-320 at work without problems...

Regards,
Rainer

Parents

0 d12fk over 16 years ago

That's odd. Do you have auto packet filter rules enabled on both sides? Is there anything in the packet filter logs for the traffic that is not getting through?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Knudel over 16 years ago in reply to d12fk

I will test it tomorrow, as I'm at home now.
That what I've done:
Installed a new machine with 7.45, restored a backup from the old machine (7.402), download the new install-package from the user portal and installed this on my laptop.
Behavior as discribed above.
Installed only the new certificates on my work-pc with the "old" vpn-client. Same procedure...
I'll check the logs tomorrow...

Rainer.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 16 years ago in reply to Knudel

Show the details in the client log from where you are now.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Knudel over 16 years ago in reply to BAlfson

This is the Client log from my PC at work, connecting to my astaro at home:

Wed Jun 03 19:24:28 2009 OpenVPN 2.1_rc1 Win32-MinGW [SSL] [LZO2] built on Apr 30 2007
Wed Jun 03 19:24:35 2009 LZO compression initialized
Wed Jun 03 19:24:35 2009 Control Channel MTU parms [ L:1556 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Jun 03 19:24:35 2009 Data Channel MTU parms [ L:1556 D:1450 EF:56 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Jun 03 19:24:35 2009 Local Options hash (VER=V4): '619088b2'
Wed Jun 03 19:24:35 2009 Expected Remote Options hash (VER=V4): 'a4f12474'
Wed Jun 03 19:24:35 2009 Attempting to establish TCP connection with 79.226.178.13:443
Wed Jun 03 19:24:35 2009 TCP connection established with 79.226.178.13:443
Wed Jun 03 19:24:35 2009 Socket Buffers: R=[8192->8192] S=[64512->64512]
Wed Jun 03 19:24:35 2009 TCPv4_CLIENT link local: [undef]
Wed Jun 03 19:24:35 2009 TCPv4_CLIENT link remote: 79.226.178.13:443
Wed Jun 03 19:24:35 2009 TLS: Initial packet from 79.226.178.13:443, sid=7144aa5c 4ae7ac8c
Wed Jun 03 19:24:36 2009 VERIFY OK: depth=1, /C=de/L=Gutersloh/O=Home/CN=Home_VPN_CA/emailAddress=a.b@c.de
Wed Jun 03 19:24:36 2009 VERIFY X509NAME OK: /C=de/L=Gutersloh/O=Home/CN=kallisto.welt.all/emailAddress=a.b@c.de
Wed Jun 03 19:24:36 2009 VERIFY OK: depth=0, /C=de/L=Gutersloh/O=Home/CN=kallisto.welt.all/emailAddress=a.b@c.de
Wed Jun 03 19:24:38 2009 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Jun 03 19:24:38 2009 Data Channel Encrypt: Using 128 bit message hash 'MD5' for HMAC authentication
Wed Jun 03 19:24:38 2009 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Jun 03 19:24:38 2009 Data Channel Decrypt: Using 128 bit message hash 'MD5' for HMAC authentication
Wed Jun 03 19:24:38 2009 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Jun 03 19:24:38 2009 [kallisto.welt.all] Peer Connection Initiated with 79.226.178.13:443
Wed Jun 03 19:24:39 2009 SENT CONTROL [kallisto.welt.all]: 'PUSH_REQUEST' (status=1)
Wed Jun 03 19:24:41 2009 PUSH: Received control message: 'PUSH_REPLY,ifconfig 10.242.2.6 10.242.2.5,ping-restart 120,ping 10,topology net30,route 10.242.2.1,dhcp-option DOMAIN welt.all,dhcp-option DNS 172.16.0.12,route 172.16.0.0 255.255.255.0'
Wed Jun 03 19:24:41 2009 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jun 03 19:24:41 2009 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jun 03 19:24:41 2009 OPTIONS IMPORT: route options modified
Wed Jun 03 19:24:41 2009 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Jun 03 19:24:42 2009 TAP-WIN32 device [Astaro VPN] opened: \.\Global\{148A188D-C2A9-4990-89B6-A3D812F964CD}.tap
Wed Jun 03 19:24:42 2009 TAP-Win32 Driver Version 8.4
Wed Jun 03 19:24:42 2009 TAP-Win32 MTU=1500
Wed Jun 03 19:24:42 2009 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.242.2.6/255.255.255.252 on interface {148A188D-C2A9-4990-89B6-A3D812F964CD} [DHCP-serv: 10.242.2.5, lease-time: 31536000]
Wed Jun 03 19:24:42 2009 Successful ARP Flush on interface [5] {148A188D-C2A9-4990-89B6-A3D812F964CD}
Wed Jun 03 19:24:42 2009 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Jun 03 19:24:42 2009 Route: Waiting for TUN/TAP interface to come up...
Wed Jun 03 19:24:43 2009 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Jun 03 19:24:43 2009 Route: Waiting for TUN/TAP interface to come up...
Wed Jun 03 19:24:44 2009 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Jun 03 19:24:44 2009 Route: Waiting for TUN/TAP interface to come up...
Wed Jun 03 19:24:45 2009 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Jun 03 19:24:45 2009 Route: Waiting for TUN/TAP interface to come up...
Wed Jun 03 19:24:46 2009 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Jun 03 19:24:46 2009 Route: Waiting for TUN/TAP interface to come up...
Wed Jun 03 19:24:47 2009 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Wed Jun 03 19:24:47 2009 route ADD 10.242.2.1 MASK 255.255.255.255 10.242.2.5
Wed Jun 03 19:24:47 2009 Route addition via IPAPI succeeded [adaptive]
Wed Jun 03 19:24:47 2009 route ADD 172.16.0.0 MASK 255.255.255.0 10.242.2.5
Wed Jun 03 19:24:47 2009 Route addition via IPAPI succeeded [adaptive]
Wed Jun 03 19:24:47 2009 Initialization Sequence Completed

OK. Sitting at home, connected with Sonic Wall VPN to my PC at work, wich connected back to my astaro at home. Ping ip on subnet at home from work - works. Trying to establish a rdp-session to a pc at home from pc at work - doesn't work.

Any idea?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 16 years ago in reply to Knudel

That looks like it has connected without error. What do you have in 'Local networks' in SSL on the Astaro.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 gnomme over 16 years ago in reply to BAlfson

I had ssl vpn used in my 7.403 and in 7.450 it works just fine...You must have something wrong in you configs
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Knudel over 16 years ago in reply to BAlfson

Local Networks: Internal (Network)
Automatic Paket Filter Rule: enabled.

... working since 7.0 ...

Greeting,
Rainer.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Knudel over 16 years ago in reply to BAlfson

Local Networks: Internal (Network)
Automatic Paket Filter Rule: enabled.

... working since 7.0 ...

Greeting,
Rainer.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 BAlfson over 16 years ago in reply to Knudel

Strange. Once you establish the SSL VPN, can you access the WebAdmin on the internal IP on the Astaro? You would need to use something like https://IP.ad.re.ss:4444/.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Knudel over 16 years ago in reply to BAlfson

OK, switched back to 7.402. Same Setup as before.
Connecting with Soniq Wall (Aventail) to my PC at work, connected back to my Astaro at home with VPN-SSL.

Trying to initiate a rdp-Session from my pc at work to my server at home - works (this doesn't work with 7.45).
Trying to use some network shares at work (from pc at work) while the astaro is still connected - works (this doesn't work with 7.45 either).

Strange...

Greetings,
Rainer.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Tim_Astaro over 16 years ago in reply to Knudel

Hello,

My gut feeling is this one is an interoperability issue.

As you know we have a new SSL VPN package.  The tunnel completes successfully so usually there are only 2 likely issues at play.  first, on the ASG do you see any dropped packets?  (check the packet filter, ips and im/p2p logs).  My gut (which is starting to look like a crystal ball[;)]) says you probably aren't.

Next, what do your client side routing table(s) look like?  Do you have any 3rd party AV/firewalling products that can mangle/drop packets or alter routes?  we have seen this before.  Also, did you install the client using the local administrator account on the PC?

and as a last thing to check, do all of these things fail using hostnames or IP addresses?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Knudel over 16 years ago in reply to Tim_Astaro

Hi Tom,

As I posted yesterday, I've switch back to version 7.402 for testing. Now I'm at work, so a swap to 7.45 isn't possible at the moment. I do this after work today.

Yesterday, I've done a route print with 7.45 and one with 7.402. Here are the results:

This is the routing table with 7.45:
H:\>route print
===========================================================================
Schnittstellenliste
0x1 ........................... MS TCP Loopback interface
0x2 ...00 50 56 c0 00 08 ...... VMware Virtual Ethernet Adapter for VMnet8
0x3 ...00 50 56 c0 00 01 ...... VMware Virtual Ethernet Adapter for VMnet1
0x4 ...00 30 05 3f c3 9a ...... Intel(R) PRO/100 VE Network Connection - Paketplaner-Miniport
0x5 ...00 ff 14 8a 18 8d ...... Astaro SSL VPN Adapter - Paketplaner-Miniport
===========================================================================
===========================================================================
Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway   Schnittstelle  Anzahl
          0.0.0.0          0.0.0.0     10.100.25.11   10.100.25.137       20
      10.100.25.0    255.255.255.0    10.100.25.137   10.100.25.137       20
    10.100.25.137  255.255.255.255        127.0.0.1       127.0.0.1       20
       10.242.2.1  255.255.255.255       10.242.2.5      10.242.2.6       1
       10.242.2.4  255.255.255.252       10.242.2.6      10.242.2.6       30
       10.242.2.6  255.255.255.255        127.0.0.1       127.0.0.1       30
   10.255.255.255  255.255.255.255    10.100.25.137   10.100.25.137       20
   10.255.255.255  255.255.255.255       10.242.2.6      10.242.2.6       30
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
       172.16.0.0    255.255.255.0       10.242.2.5      10.242.2.6       1
       172.21.1.0    255.255.255.0       172.21.1.1      172.21.1.1       20
       172.21.1.1  255.255.255.255        127.0.0.1       127.0.0.1       20
       172.21.8.0    255.255.255.0       172.21.8.1      172.21.8.1       20
       172.21.8.1  255.255.255.255        127.0.0.1       127.0.0.1       20
   172.21.255.255  255.255.255.255       172.21.1.1      172.21.1.1       20
   172.21.255.255  255.255.255.255       172.21.8.1      172.21.8.1       20
        224.0.0.0        240.0.0.0    10.100.25.137   10.100.25.137       20
        224.0.0.0        240.0.0.0       10.242.2.6      10.242.2.6       30
        224.0.0.0        240.0.0.0       172.21.1.1      172.21.1.1       20
        224.0.0.0        240.0.0.0       172.21.8.1      172.21.8.1       20
  255.255.255.255  255.255.255.255    10.100.25.137   10.100.25.137       1
  255.255.255.255  255.255.255.255       10.242.2.6      10.242.2.6       1
  255.255.255.255  255.255.255.255       172.21.1.1      172.21.1.1       1
  255.255.255.255  255.255.255.255       172.21.8.1      172.21.8.1       1
Standardgateway:      10.100.25.11
===========================================================================
Ständige Routen:
  Keine

This routing table comes from 7.402:

  H:\>route print
===========================================================================
Schnittstellenliste
0x1 ........................... MS TCP Loopback interface
0x2 ...00 50 56 c0 00 08 ...... VMware Virtual Ethernet Adapter for VMnet8
0x3 ...00 50 56 c0 00 01 ...... VMware Virtual Ethernet Adapter for VMnet1
0x4 ...00 30 05 3f c3 9a ...... Intel(R) PRO/100 VE Network Connection - Paketplaner-Miniport
0x5 ...00 ff 14 8a 18 8d ...... Astaro SSL VPN Adapter - Paketplaner-Miniport
===========================================================================
===========================================================================
Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway   Schnittstelle  Anzahl
          0.0.0.0          0.0.0.0     10.100.25.11   10.100.25.137       20
      10.100.25.0    255.255.255.0    10.100.25.137   10.100.25.137       20
    10.100.25.137  255.255.255.255        127.0.0.1       127.0.0.1       20
       10.242.2.1  255.255.255.255       10.242.2.5      10.242.2.6       1
       10.242.2.4  255.255.255.252       10.242.2.6      10.242.2.6       30
       10.242.2.6  255.255.255.255        127.0.0.1       127.0.0.1       30
   10.255.255.255  255.255.255.255    10.100.25.137   10.100.25.137       20
   10.255.255.255  255.255.255.255       10.242.2.6      10.242.2.6       30
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
       172.16.0.0    255.255.255.0       10.242.2.5      10.242.2.6       1
       172.21.1.0    255.255.255.0       172.21.1.1      172.21.1.1       20
       172.21.1.1  255.255.255.255        127.0.0.1       127.0.0.1       20
       172.21.8.0    255.255.255.0       172.21.8.1      172.21.8.1       20
       172.21.8.1  255.255.255.255        127.0.0.1       127.0.0.1       20
   172.21.255.255  255.255.255.255       172.21.1.1      172.21.1.1       20
   172.21.255.255  255.255.255.255       172.21.8.1      172.21.8.1       20
        224.0.0.0        240.0.0.0    10.100.25.137   10.100.25.137       20
        224.0.0.0        240.0.0.0       10.242.2.6      10.242.2.6       30
        224.0.0.0        240.0.0.0       172.21.1.1      172.21.1.1       20
        224.0.0.0        240.0.0.0       172.21.8.1      172.21.8.1       20
  255.255.255.255  255.255.255.255    10.100.25.137   10.100.25.137       1
  255.255.255.255  255.255.255.255       10.242.2.6      10.242.2.6       1
  255.255.255.255  255.255.255.255       172.21.1.1      172.21.1.1       1
  255.255.255.255  255.255.255.255       172.21.8.1      172.21.8.1       1
Standardgateway:      10.100.25.11
===========================================================================
Ständige Routen:
  Keine

@Bob
I can connect to my Astaro at home from work.

Question: I've just discovered a problem with our proxy-auto-config with wpad (dhcp-option 252). Could this cause the problem?

Greets,
Rainer.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BAlfson over 16 years ago in reply to Knudel

Is this related? "Automatically Detect Settings" Does Not Work if You Configure DHCP Option 252
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Knudel over 16 years ago in reply to BAlfson

No.

off-topic:
We have a weird configuration.
One internal server named wpad for autoconfiguration of IE and Firefox wich works perfect. At home, in my own domain, there's also a server called wpad wich delivers the settings for IE and Firefox (and dhcp configured with option 252). This works perfect for my own clients. There's also a wpad c-name in our external dns-namespace (not my idea), wich causes me a lot of problems...

Rainer.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Astaro Beta Bot over 16 years ago in reply to Knudel

Astaro Beta Report
--------------------------------
Version: 7.450
Type: BUG
State: NOTABUG
Reporter: Knudel
Contributor: 
MantisID: 
--------------------------------