[8.920][BUG] IPv6 connection issues (was: Proxy does not handle dual stack servers!)

Since swapping my ASG v8 with v9 beta I'm having problems accessing dual-stack enabled servers.

Servers like my own (blackdot.be) or even astaro.org time out when using the HTTP Proxy. If I disable the IPv6 DNS entry it works fine. So I know it is IPv6 related.

2012:04:10-23:12:16 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2850" request="0x841e5c8" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/images/en-int/myastaro.png" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:16 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x836ccf0" url="http://www.astaro.com/elqNow/elqCfg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:16 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x836cb88" url="http://www.astaro.com/elqNow/elqImg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:33 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2836" request="0xbcd35198" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/css/navigations.css" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:33 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2742" request="0xbcd06768" url="http://www.astaro.com/misc/jquery.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:33 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2850" request="0x830fb68" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/images/en-int/myastaro.png" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:34 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x834f060" url="http://www.astaro.com/elqNow/elqCfg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:12:34 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x830fe38" url="http://www.astaro.com/elqNow/elqImg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:13:34 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2742" request="0x830fb68" url="http://www.astaro.com/misc/jquery.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:14 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2001:1938:81:164::2" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2708" request="0x834f768" url="http://blackdot.be/" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:35 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2746" request="0x834f060" url="http://www.astaro.com/elqNow/elqCfg.js" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:35 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="2001:6f8:1480:15:11a8:c2f0:eb92[:D]869" dstip="2a02:788:12:38::5" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2850" request="0x830fb68" url="http://www.astaro.com/sites/all/themes/yaml/layouts/yaml_astaro/images/en-int/myastaro.png" exceptions="" error="Connection to server timed out"
2012:04:10-23:14:43 inertia httpproxy[10369]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="172.16.15.111" dstip="2001:1938:81:164::2" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2708" request="0x83a3300" url="http://www.blackdot.be/" exceptions="" error="Connection to server timed out"

Parents

0 da_merlin over 13 years ago

Hi sjorge,

I can connect to your web server via IPv6 (also have sixxs at home).

Can you run tcpdump on your ASG (e.g. tcpdump -v -n -i aiccu) and
verify the tcp SYN in send and SYN,ACK is received?

Cheers
Ulrich
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 sjorge over 13 years ago in reply to da_merlin

I don't seem to be getting a SYN,ACK unless I'm reading it wrong:

sjorge@Axion ~ $ date

Wed Apr 11 19:13:17 CEST 2012

sjorge@Axion ~ $ telnet 2001:1938:81:164::2 80

Trying 2001:1938:81:164::2...

telnet: connect to address 2001:1938:81:164::2: Operation timed out

telnet: Unable to connect to remote host

sjorge@Axion ~ $ date

Wed Apr 11 19:14:47 CEST 2012

inertia:/root # tcpdump -v -n -i aiccu

tcpdump: WARNING: aiccu: no IPv4 address assigned

tcpdump: listening on aiccu, link-type RAW (Raw IP), capture size 96 bytes

19:13:20.899533 IP6 (hlim 63, next-header TCP (6) payload length: 44) 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945.50901 > 2001:1938:81:164::2.80: S 268177802:268177802(0) win 65535 

19:13:39.054777 IP6 (hlim 59, next-header UDP (17) payload length: 58) 2001:6f8:1480:30::2.57551 > 2001:4860:4860::8844.53: 36698+ [1au][|domain]

19:13:39.054978 IP6 (hlim 59, next-header UDP (17) payload length: 58) 2001:6f8:1480:30::2.57551 > 2001:4860:4860::8888.53: 36698+ [1au][|domain]

19:13:39.105561 IP6 (hlim 51, next-header UDP (17) payload length: 120) 2001:4860:4860::8888.53 > 2001:6f8:1480:30::2.57551: 36698[|domain]

19:13:39.110757 IP6 (hlim 51, next-header UDP (17) payload length: 120) 2001:4860:4860::8844.53 > 2001:6f8:1480:30::2.57551: 36698[|domain]

19:13:39.114416 IP6 (hlim 254, next-header ICMPv6 (58) payload length: 168) 2001:6f8:1480:30::2 > 2001:4860:4860::8844: ICMP6, destination unreachable, length 168[|icmp6]

19:13:39.129767 IP6 (hlim 254, next-header ICMPv6 (58) payload length: 168) 2001:6f8:1480:30::2 > 2001:4860:4860::8888: ICMP6, destination unreachable, length 168[|icmp6]

19:13:54.522798 IP6 (hlim 64, next-header ICMPv6 (58) payload length: 988) 2001:6f8:202:3e1::1 > 2001:6f8:202:3e1::2: ICMP6, echo request, length 988, seq 12999

19:13:54.525968 IP6 (hlim 64, next-header ICMPv6 (58) payload length: 988) 2001:6f8:202:3e1::2 > 2001:6f8:202:3e1::1: ICMP6, echo reply, length 988, seq 12999

19:14:08.947541 IP6 (hlim 59, next-header UDP (17) payload length: 76) 2001:6f8:1480:30::2.34911 > 2001:4860:4860::8888.53: 54806+ [1au][|domain]

19:14:08.947878 IP6 (hlim 59, next-header UDP (17) payload length: 76) 2001:6f8:1480:30::2.34911 > 2001:4860:4860::8844.53: 54806+ [1au][|domain]

19:14:08.996511 IP6 (hlim 51, next-header UDP (17) payload length: 76) 2001:4860:4860::8888.53 > 2001:6f8:1480:30::2.34911: 54806 NXDomain[|domain]

19:14:08.996559 IP6 (hlim 51, next-header UDP (17) payload length: 76) 2001:4860:4860::8844.53 > 2001:6f8:1480:30::2.34911: 54806 NXDomain[|domain]

19:14:09.003661 IP6 (hlim 254, next-header ICMPv6 (58) payload length: 124) 2001:6f8:1480:30::2 > 2001:4860:4860::8844: ICMP6, destination unreachable, length 124[|icmp6]

19:14:09.004131 IP6 (hlim 254, next-header ICMPv6 (58) payload length: 124) 2001:6f8:1480:30::2 > 2001:4860:4860::8888: ICMP6, destination unreachable, length 124[|icmp6]

19:14:32.808294 IP6 (hlim 9, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 22263

19:14:32.809902 IP6 (hlim 9, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 34594

19:14:32.809943 IP6 (hlim 9, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 55881

19:14:32.810081 IP6 (hlim 8, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 22263

19:14:32.811501 IP6 (hlim 8, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 34594

19:14:32.811546 IP6 (hlim 8, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 55881

19:14:36.069582 IP6 (hlim 9, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 26984

19:14:36.071178 IP6 (hlim 8, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 26984

19:14:38.008360 IP6 (hlim 9, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 33213

19:14:38.009818 IP6 (hlim 8, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 33213

19:14:40.009630 IP6 (hlim 9, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 47626

19:14:40.011075 IP6 (hlim 8, next-header ICMPv6 (58) payload length: 12) 2001:0:5ef5:73b8:2c09:14f0:a44f:2e6f > 2001:6f8:1480::1: [icmp6 sum ok] ICMP6, echo request, length 12, seq 47626

^C

27 packets captured

27 packets received by filter

0 packets dropped by kernel

I do get replies for a ping?!

sjorge@Axion ~ $ date

Wed Apr 11 19:15:50 CEST 2012

sjorge@Axion ~ $ ping6 2001:1938:81:164::2

PING6(56=40+8+8 bytes) 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945 --> 2001:1938:81:164::2

16 bytes from 2001:1938:81:164::2, icmp_seq=0 hlim=52 time=227.562 ms

16 bytes from 2001:1938:81:164::2, icmp_seq=1 hlim=52 time=222.532 ms

16 bytes from 2001:1938:81:164::2, icmp_seq=2 hlim=52 time=233.982 ms

16 bytes from 2001:1938:81:164::2, icmp_seq=3 hlim=52 time=235.219 ms

16 bytes from 2001:1938:81:164::2, icmp_seq=4 hlim=52 time=226.275 ms

16 bytes from 2001:1938:81:164::2, icmp_seq=5 hlim=52 time=226.295 ms

^C

--- 2001:1938:81:164::2 ping6 statistics ---

6 packets transmitted, 6 packets received, 0.0% packet loss

round-trip min/avg/max/std-dev = 222.532/228.644/235.219/4.498 ms



sjorge@Axion ~ $ date

Wed Apr 11 19:16:09 CEST 2012

inertia:/root # tcpdump -v -n -i aiccu

tcpdump: WARNING: aiccu: no IPv4 address assigned

tcpdump: listening on aiccu, link-type RAW (Raw IP), capture size 96 bytes

19:16:02.382561 IP6 (hlim 63, next-header ICMPv6 (58) payload length: 16) 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945 > 2001:1938:81:164::2: [icmp6 sum ok] ICMP6, echo request, length 16, seq 0

19:16:02.606287 IP6 (hlim 53, next-header ICMPv6 (58) payload length: 16) 2001:1938:81:164::2 > 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945: [icmp6 sum ok] ICMP6, echo reply, length 16, seq 0

19:16:03.382183 IP6 (hlim 63, next-header ICMPv6 (58) payload length: 16) 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945 > 2001:1938:81:164::2: [icmp6 sum ok] ICMP6, echo request, length 16, seq 1

19:16:03.601843 IP6 (hlim 53, next-header ICMPv6 (58) payload length: 16) 2001:1938:81:164::2 > 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945: [icmp6 sum ok] ICMP6, echo reply, length 16, seq 1

19:16:04.393690 IP6 (hlim 63, next-header ICMPv6 (58) payload length: 16) 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945 > 2001:1938:81:164::2: [icmp6 sum ok] ICMP6, echo request, length 16, seq 2

19:16:04.612755 IP6 (hlim 53, next-header ICMPv6 (58) payload length: 16) 2001:1938:81:164::2 > 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945: [icmp6 sum ok] ICMP6, echo reply, length 16, seq 2

19:16:05.383017 IP6 (hlim 63, next-header ICMPv6 (58) payload length: 16) 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945 > 2001:1938:81:164::2: [icmp6 sum ok] ICMP6, echo request, length 16, seq 3

19:16:05.608829 IP6 (hlim 53, next-header ICMPv6 (58) payload length: 16) 2001:1938:81:164::2 > 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945: [icmp6 sum ok] ICMP6, echo reply, length 16, seq 3

19:16:06.382848 IP6 (hlim 63, next-header ICMPv6 (58) payload length: 16) 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945 > 2001:1938:81:164::2: [icmp6 sum ok] ICMP6, echo request, length 16, seq 4

19:16:06.606160 IP6 (hlim 53, next-header ICMPv6 (58) payload length: 16) 2001:1938:81:164::2 > 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945: [icmp6 sum ok] ICMP6, echo reply, length 16, seq 4

19:16:07.383167 IP6 (hlim 63, next-header ICMPv6 (58) payload length: 16) 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945 > 2001:1938:81:164::2: [icmp6 sum ok] ICMP6, echo request, length 16, seq 5

19:16:07.605714 IP6 (hlim 53, next-header ICMPv6 (58) payload length: 16) 2001:1938:81:164::2 > 2001:6f8:1480:15[:D]0c8:7052:a7ea:4945: [icmp6 sum ok] ICMP6, echo reply, length 16, seq 5

^C

12 packets captured

12 packets received by filter

0 packets dropped by kernel

Hopefully this rings a bell for you guys because I'm still at a loss.

0 sjorge over 13 years ago in reply to sjorge

Since this is bugging me I'm doing some further digging.
This is not localized to only my server and HTTP. I don't get SYN,ACKS back for any IPv6 server on any port! (HTTP, HTTPS, SSH, NNTP,DNS)

I ran another nc6 to port 80 on my server. This time capturing both @gateway and @server.

Server

procyon ~ # tcpdump -vn -s0 -isixxs

tcpdump: WARNING: sixxs: no IPv4 address assigned

tcpdump: listening on sixxs, link-type RAW (Raw IP), capture size 65535 bytes

18:16:30.450180 IP6 (hlim 64, next-header ICMPv6 (58) payload length: 988) 2001:1938:81:164::1 > 2001:1938:81:164::2: [icmp6 sum ok] ICMP6, echo request, length 988, seq 22384

18:16:30.450291 IP6 (hlim 64, next-header ICMPv6 (58) payload length: 988) 2001:1938:81:164::2 > 2001:1938:81:164::1: [icmp6 sum ok] ICMP6, echo reply, length 988, seq 22384

^C

2 packets captured

2 packets received by filter

0 packets dropped by kernel

Gateway

inertia:/root # tcpdump -vn -s0 -iaiccu

tcpdump: WARNING: aiccu: no IPv4 address assigned

tcpdump: listening on aiccu, link-type RAW (Raw IP), capture size 65535 bytes

20:16:05.303931 IP6 (hlim 63, next-header TCP (6) payload length: 40) 2001:6f8:1480:15:21a:4dff:fe49:b5d.57120 > 2001:1938:81:164::2.80: S, cksum 0x8407 (correct), 3634183084:3634183084(0) win 14400 

20:16:16.360873 IP6 (hlim 59, next-header UDP (17) payload length: 58) 2001:6f8:1480:30::2.28066 > 2001:4860:4860::8888.53: [udp sum ok] 33539+ [1au] A? all.broker.sophos.com. (50)

20:16:16.360905 IP6 (hlim 59, next-header UDP (17) payload length: 58) 2001:6f8:1480:30::2.28066 > 2001:4860:4860::8844.53: [udp sum ok] 33539+ [1au] A? all.broker.sophos.com. (50)

20:16:16.409376 IP6 (hlim 51, next-header UDP (17) payload length: 122) 2001:4860:4860::8888.53 > 2001:6f8:1480:30::2.28066: [udp sum ok] 33539 4/0/1 all.broker.sophos.com. A 176.34.185.65, all.broker.sophos.com. A 46.137.160.57, all.broker.sophos.com. A 46.137.170.158, all.broker.sophos.com. A 79.125.12.158 (114)

20:16:16.427221 IP6 (hlim 254, next-header ICMPv6 (58) payload length: 170) 2001:6f8:1480:30::2 > 2001:4860:4860::8888: [icmp6 sum ok] ICMP6, destination unreachable, length 170, unreachable port, 2001:6f8:1480:30::2 udp port 28066

20:16:16.480158 IP6 (hlim 51, next-header UDP (17) payload length: 122) 2001:4860:4860::8844.53 > 2001:6f8:1480:30::2.28066: [udp sum ok] 33539 4/0/1 all.broker.sophos.com. A 176.34.185.65, all.broker.sophos.com. A 46.137.160.57, all.broker.sophos.com. A 46.137.170.158, all.broker.sophos.com. A 79.125.12.158 (114)

20:16:16.490620 IP6 (hlim 254, next-header ICMPv6 (58) payload length: 170) 2001:6f8:1480:30::2 > 2001:4860:4860::8844: [icmp6 sum ok] ICMP6, destination unreachable, length 170, unreachable port, 2001:6f8:1480:30::2 udp port 28066

^C

7 packets captured

7 packets received by filter

0 packets dropped by kernel

I can see the original SYN leave the gateway, but it never arrives at my server [:S]

FWIIW The config I'm currently running was imported from my v8 setup I had before upgrading to v9 beta. And it worked fine on v8.

I could provide you with a configuration dump if you like.

0 sjorge over 13 years ago in reply to sjorge

I made progress!

IPS disabled => IPv6 works
IPS enable => IPv6 doesn't work (except ICMPv6)

Same result with 0 or all rules selected :s

2012:04:11-22:03:36 inertia snort[8530]: +++++++++++++++++++++++++++++++++++++++++++++++++++

2012:04:11-22:03:36 inertia snort[8530]: Initializing rule chains...

2012:04:11-22:03:38 inertia snort[8530]: 11509 Snort rules read

2012:04:11-22:03:38 inertia snort[8530]: 11488 detection rules

2012:04:11-22:03:38 inertia snort[8530]: 0 decoder rules

2012:04:11-22:03:38 inertia snort[8530]: 21 preprocessor rules

2012:04:11-22:03:38 inertia snort[8530]: 11509 Option Chains linked into 1025 Chain Headers

2012:04:11-22:03:38 inertia snort[8530]: 0 Dynamic rules

2012:04:11-22:03:38 inertia snort[8530]: +++++++++++++++++++++++++++++++++++++++++++++++++++

2012:04:11-22:03:38 inertia snort[8530]:

2012:04:11-22:03:41 inertia snort[8530]: +-------------------[Rule Port Counts]---------------------------------------

2012:04:11-22:03:41 inertia snort[8530]: | tcp udp icmp ip

2012:04:11-22:03:41 inertia snort[8530]: | src 3900 68 0 0

2012:04:11-22:03:41 inertia snort[8530]: | dst 6044 501 0 0

2012:04:11-22:03:41 inertia snort[8530]: | any 899 121 76 56

2012:04:11-22:03:41 inertia snort[8530]: | nc 330 53 10 12

2012:04:11-22:03:41 inertia snort[8530]: | s+d 13 25 0 0

2012:04:11-22:03:41 inertia snort[8530]: +----------------------------------------------------------------------------

...

2012:04:11-22:03:41 inertia snort[8530]: 512 out of 1024 flowbits in use.

2012:04:11-22:03:57 inertia snort[8530]:

2012:04:11-22:03:57 inertia snort[8530]: [ Port Based Pattern Matching Memory ]

2012:04:11-22:03:57 inertia snort[8530]: +-[AC-BNFA Search Info Summary]------------------------------

2012:04:11-22:03:57 inertia snort[8530]: | Instances : 1722

2012:04:11-22:03:57 inertia snort[8530]: | Patterns : 488765

2012:04:11-22:03:57 inertia snort[8530]: | Pattern Chars : 9495254

2012:04:11-22:03:57 inertia snort[8530]: | Num States : 5342120

2012:04:11-22:03:57 inertia snort[8530]: | Num Match States : 529685

2012:04:11-22:03:57 inertia snort[8530]: | Memory : 113.56Mbytes

2012:04:11-22:03:57 inertia snort[8530]: | Patterns : 20.24M

2012:04:11-22:03:57 inertia snort[8530]: | Match Lists : 30.34M

2012:04:11-22:03:57 inertia snort[8530]: | Transitions : 62.57M

2012:04:11-22:03:57 inertia snort[8530]: +-------------------------------------------------

2012:04:11-22:03:57 inertia snort[8530]: [ Number of null byte prefixed patterns trimmed: 35387 ]

2012:04:11-22:03:57 inertia snort[8530]: nfqmnlmmap DAQ configured to inline.

2012:04:11-22:03:57 inertia snort[8530]: The DAQ version does not support reload.

2012:04:11-22:03:57 inertia snort[8530]: Initializing daemon mode

2012:04:11-22:03:57 inertia snort[8569]: Daemon initialized, signaled parent pid: 8530

2012:04:11-22:03:57 inertia snort[8569]: Reload thread starting...

2012:04:11-22:03:57 inertia snort[8569]: Reload thread started, thread 0xe5befb70 (8569)

2012:04:11-22:03:57 inertia snort[8569]: Checking PID path...

2012:04:11-22:03:57 inertia snort[8569]: PID path stat checked out ok, PID path set to /var/run/

2012:04:11-22:03:57 inertia snort[8569]: Writing PID "8569" to file "/var/run//snort_1.pid"

2012:04:11-22:03:57 inertia snort[8569]: Set gid to 800

2012:04:11-22:03:57 inertia snort[8569]: Set uid to 800

2012:04:11-22:03:57 inertia snort[8569]:

2012:04:11-22:03:57 inertia snort[8569]: --== Initialization Complete ==--

2012:04:11-22:03:57 inertia snort[8569]: Commencing packet processing (pid=8569)

2012:04:11-22:03:57 inertia snort[8569]: Decoding Raw IP4

2012:04:11-22:04:12 inertia snort[8569]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="BAD-TRAFFIC TMG Firewall Client long host entry exploit attempt" group="500" srcip="8.8.4.4" dstip="172.16.30.2" proto="17" srcport="53" dstport="14205" sid="19187" class="Attempted User Privilege Gain" priority="1" generator="3" msgid="0"

2012:04:11-22:03:57 inertia snort[8569]: Decoding Raw IP4

I'm not familier with snort, but some googling gave me this thread.
#633066 - snort: Decoding raw packets assumes IPv4 packet - Debian Bug report logs

I think this is related. Hopefully this is enough information for you guys to fix IPS with IPv6.

For now I'll do with IPS disabled but I would really like to enable it again before 9.000 final [;)]

Reply

0 sjorge over 13 years ago in reply to sjorge

I made progress!

IPS disabled => IPv6 works
IPS enable => IPv6 doesn't work (except ICMPv6)

Same result with 0 or all rules selected :s

2012:04:11-22:03:36 inertia snort[8530]: +++++++++++++++++++++++++++++++++++++++++++++++++++

2012:04:11-22:03:36 inertia snort[8530]: Initializing rule chains...

2012:04:11-22:03:38 inertia snort[8530]: 11509 Snort rules read

2012:04:11-22:03:38 inertia snort[8530]: 11488 detection rules

2012:04:11-22:03:38 inertia snort[8530]: 0 decoder rules

2012:04:11-22:03:38 inertia snort[8530]: 21 preprocessor rules

2012:04:11-22:03:38 inertia snort[8530]: 11509 Option Chains linked into 1025 Chain Headers

2012:04:11-22:03:38 inertia snort[8530]: 0 Dynamic rules

2012:04:11-22:03:38 inertia snort[8530]: +++++++++++++++++++++++++++++++++++++++++++++++++++

2012:04:11-22:03:38 inertia snort[8530]:

2012:04:11-22:03:41 inertia snort[8530]: +-------------------[Rule Port Counts]---------------------------------------

2012:04:11-22:03:41 inertia snort[8530]: | tcp udp icmp ip

2012:04:11-22:03:41 inertia snort[8530]: | src 3900 68 0 0

2012:04:11-22:03:41 inertia snort[8530]: | dst 6044 501 0 0

2012:04:11-22:03:41 inertia snort[8530]: | any 899 121 76 56

2012:04:11-22:03:41 inertia snort[8530]: | nc 330 53 10 12

2012:04:11-22:03:41 inertia snort[8530]: | s+d 13 25 0 0

2012:04:11-22:03:41 inertia snort[8530]: +----------------------------------------------------------------------------

...

2012:04:11-22:03:41 inertia snort[8530]: 512 out of 1024 flowbits in use.

2012:04:11-22:03:57 inertia snort[8530]:

2012:04:11-22:03:57 inertia snort[8530]: [ Port Based Pattern Matching Memory ]

2012:04:11-22:03:57 inertia snort[8530]: +-[AC-BNFA Search Info Summary]------------------------------

2012:04:11-22:03:57 inertia snort[8530]: | Instances : 1722

2012:04:11-22:03:57 inertia snort[8530]: | Patterns : 488765

2012:04:11-22:03:57 inertia snort[8530]: | Pattern Chars : 9495254

2012:04:11-22:03:57 inertia snort[8530]: | Num States : 5342120

2012:04:11-22:03:57 inertia snort[8530]: | Num Match States : 529685

2012:04:11-22:03:57 inertia snort[8530]: | Memory : 113.56Mbytes

2012:04:11-22:03:57 inertia snort[8530]: | Patterns : 20.24M

2012:04:11-22:03:57 inertia snort[8530]: | Match Lists : 30.34M

2012:04:11-22:03:57 inertia snort[8530]: | Transitions : 62.57M

2012:04:11-22:03:57 inertia snort[8530]: +-------------------------------------------------

2012:04:11-22:03:57 inertia snort[8530]: [ Number of null byte prefixed patterns trimmed: 35387 ]

2012:04:11-22:03:57 inertia snort[8530]: nfqmnlmmap DAQ configured to inline.

2012:04:11-22:03:57 inertia snort[8530]: The DAQ version does not support reload.

2012:04:11-22:03:57 inertia snort[8530]: Initializing daemon mode

2012:04:11-22:03:57 inertia snort[8569]: Daemon initialized, signaled parent pid: 8530

2012:04:11-22:03:57 inertia snort[8569]: Reload thread starting...

2012:04:11-22:03:57 inertia snort[8569]: Reload thread started, thread 0xe5befb70 (8569)

2012:04:11-22:03:57 inertia snort[8569]: Checking PID path...

2012:04:11-22:03:57 inertia snort[8569]: PID path stat checked out ok, PID path set to /var/run/

2012:04:11-22:03:57 inertia snort[8569]: Writing PID "8569" to file "/var/run//snort_1.pid"

2012:04:11-22:03:57 inertia snort[8569]: Set gid to 800

2012:04:11-22:03:57 inertia snort[8569]: Set uid to 800

2012:04:11-22:03:57 inertia snort[8569]:

2012:04:11-22:03:57 inertia snort[8569]: --== Initialization Complete ==--

2012:04:11-22:03:57 inertia snort[8569]: Commencing packet processing (pid=8569)

2012:04:11-22:03:57 inertia snort[8569]: Decoding Raw IP4

2012:04:11-22:04:12 inertia snort[8569]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="BAD-TRAFFIC TMG Firewall Client long host entry exploit attempt" group="500" srcip="8.8.4.4" dstip="172.16.30.2" proto="17" srcport="53" dstport="14205" sid="19187" class="Attempted User Privilege Gain" priority="1" generator="3" msgid="0"

Children

No Data

[8.920][BUG] IPv6 connection issues (was: Proxy does not handle dual stack servers!)

Submitted a Tech Support Case lately from the Support Portal?