This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

no networkt when pptp is active

Hi all!
I just wanted to test PPTP access and noticed, when a pptp connection is active, i can't access neither the firewall nor any of it's attached networks.
Has this also to do with the kerner nat module issue or is it a missconfiguration of my astaro? (Haven't installed the patch yet, cause connecting to my astaro as a pptp server seems to work just fine.)

Here's some more information about my system/setup:

Astaro 4.015, 3 NICs (WAN, LAN & WLAN)
added users for pptp connections with LAN subnet IPs
users can connect to my astaro via pptp and ping computer in my LAN
what further information do you need?

[/list]

Thanks a lot in advance.
Best regards.
Chris

This thread was automatically locked due to age.

Parents

0 SecApp over 22 years ago

The next thing needed would be your network numberings; sanitize your Internet ones. Symptomatically, what you describe sounds like an IP routing overlap...
Cancel
Vote Up 0 Vote Down

Cancel

0 DerChris over 22 years ago in reply to SecApp

Hi SecApp!
Yeah ... that's exactly, what I had in mind. Here's some more detailed Information about my setup:

o 3 NICs:

WAN: 130.83.19.167/24
LAN: 192.168.1.254/24
WLAN: 192.168.1.254/24

[/list]

o NAT on WAN for LAN & WLAN

o generell rules:

Any/Any -> WAN: drop
LAN/Any -> Any: allow
WLAN/Any -> Any: allow
(There're a few more rules 'cause I need some forewarded ports)

[/list]

o pptp users get a predefined IP from the LAN segment

o routing table:
Code:

130.83.19.0/24 dev eth1  scope link 
192.168.2.0/24 dev eth2  scope link 
192.168.1.0/24 dev eth0  scope link 
127.0.0.0/8 dev lo  scope link 
default via 130.83.19.254 dev eth1 
local 192.168.2.254 dev eth2  table local  proto kernel  scope host  src 192.168.2.254 
broadcast 192.168.1.0 dev eth0  table local  proto kernel  scope link  src 192.168.1.254 
broadcast 192.168.2.255 dev eth2  table local  proto kernel  scope link  src 192.168.2.254 
broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
broadcast 130.83.19.255 dev eth1  table local  proto kernel  scope link  src 130.83.19.167 
local 192.168.1.254 dev eth0  table local  proto kernel  scope host  src 192.168.1.254 
broadcast 192.168.2.0 dev eth2  table local  proto kernel  scope link  src 192.168.2.254 
broadcast 192.168.1.255 dev eth0  table local  proto kernel  scope link  src 192.168.1.254 
broadcast 130.83.19.0 dev eth1  table local  proto kernel  scope link  src 130.83.19.167 
broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
local 130.83.19.167 dev eth1  table local  proto kernel  scope host  src 130.83.19.167 
local 127.0.0.1 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src 127.0.0.1

o no static routes defined

Thanks in advance.
Reguards
Chris

0 SecApp over 22 years ago in reply to DerChris

I'm missing something; why is LAN the same network number as WLAN??

Maybe you mean to make a Network Group WLAN, comprised of LAN and PPTP-Pool?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 SecApp over 22 years ago in reply to DerChris

I'm missing something; why is LAN the same network number as WLAN??

Maybe you mean to make a Network Group WLAN, comprised of LAN and PPTP-Pool?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 MadHakish over 22 years ago in reply to SecApp

Yeah. No ppp0 interface as a GW for pptp clients either..
Cancel
Vote Up 0 Vote Down

Cancel
0 DerChris over 22 years ago in reply to MadHakish

yeah, sorry.
you're right.
The WLAN has the ip 192.168.2.254/24
Just a misstyping.

pptp user do not actually "dial in". I just want to use pptp as a secure host 2 net connection over the internet. The pptp clients get an IP from my LAN net. (Predefined IP for each user.)
Cancel
Vote Up 0 Vote Down

Cancel
0 MadHakish over 22 years ago in reply to DerChris

You can't access from pptp client side correct?

Astaro does deny by default, so even if you don't have rules set to deny, it will still deny and you must open access through the firewall.
Cancel
Vote Up 0 Vote Down

Cancel
0 DerChris over 22 years ago in reply to MadHakish

pptp client side can acces the internet as well as as the "normal" host in my LAN Network.
The "normal" hosts can't reach the internet anymore, when a pptp connection is esablished. :-/
(I know it sounds strange, but that's how it is.)
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 22 years ago in reply to DerChris

OK; it's beginning to make sense. The PPTP conection: it's being established with the firewall?

While the PPTP connection is established, on the internal host get a snapshot of its routing table (Windows: route print; Linux: route -n; Esperanto: itinero).
Cancel
Vote Up 0 Vote Down

Cancel