This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

US Dept of Defense integrated into L2TP VPN?

My carrier, Sprint is using legacy DoD addresses for cell phone connections but there appears to be something wrong with the VPN functionality... see posts later in this thread.

I'm connecting my smartphone to my local home net using L2TP via the Sophos UTM.

I'm reviewing the firewall logs and notice traffic on port 443 being blocked between two addresses:
Source:

21.194.27.36 Dept of Defense

Dest:

50.115.125.93 [URL="http://mxtoolbox.com/SuperTool.aspx?action=ptr%3a50.115.125.93&run=toolpage#"]50.115.125.93.static.westdc.net ??
[/URL]

69.171.245.49 Facebook

Here's what I can find on the source:
[SIZE=2]Location[/SIZE] [SIZE=2]

UNITED STATES, OHIO, COLUMBUS[/SIZE] [SIZE=2]Latitude, Longitude[/SIZE] [SIZE=2]39.96638, -83.01277 (39°57'59"S -83°0'46"E)[/SIZE] [SIZE=2]Connection through[/SIZE] [SIZE=2]DOD NETWORK INFORMATION CENTER[/SIZE] [SIZE=2]Local Time[/SIZE] [SIZE=2]04 Dec, 2013 05:17 PM (UTC -05:00)[/SIZE] [SIZE=2]Domain[/SIZE] [SIZE=2]NIC.MIL[/SIZE]
Here are a couple of lines from the logs:


[FONT=monospace]14:08:16 Packet filter rule #6 L2TP 21.194.27.36 : 39669 → 50.115.125.93 : 443 [RST] len=40 ttl=63 tos=0x00 srcmac=0:0:2f[:D]2:32:f7
[/FONT]
[FONT=monospace]14:08:19 Packet filter rule #6 L2TP 21.194.27.36 : 39669 → 50.115.125.93 : 443 [RST] len=40 ttl=63 tos=0x00 srcmac=0:0:2f[:D]2:32:f7
[/FONT]
[FONT=monospace]14:08:19 Packet filter rule #6 L2TP 21.194.27.36 : 38247 → 69.171.245.49 : 443 [ACK PSH] len=130 ttl=63 tos=0x00 srcmac=0:0:2f[:D]2:32:f7
[/FONT]
[FONT=monospace]14:08:26 Packet filter rule #6 L2TP 21.194.27.36 : 39669 → 50.115.125.93 : 443 [RST] len=40 ttl=63 tos=0x00 srcmac=0:0:2f[:D]2:32:f7
[/FONT]

Note the L2TP is the traffic being parsed.

Could I get some fresh eyes on this?

Thanks,

Doug

This thread was automatically locked due to age.

0 SalishSwede over 11 years ago in reply to SalishSwede

Thanks for all the input.
The one detail I'll track down is the curious MAC address.
I'll update this when I have an answer.
Cancel
Vote Up 0 Vote Down

Cancel
0 SalishSwede over 11 years ago in reply to TheDrew

Bingo! Thanks.
Edit: This clarifies the ip address but as my later post points out, this address should not be sending traffic to external addresses like Google or Facebook. This traffic should have been encapsulated and thus have the vpn ip address.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago in reply to TheDrew

If you are seeing a DoD IP Address tied to a MAC in your logs

Hi,

There will always be a local MAC address in every log entry.

It's how ethernet works.

If it's on the external interface, then the MAC is of the ISP cable modem/bridge or router.

If it's on an internal interface, then it's an internal device's MAC.

I don't know what MACs mean exactly on a VPN connection, but I suspect it's similar.
ifconfig shows a MAC of all 0's on one of my tunnels, but it is not L2TP.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago in reply to TheDrew

1) What is the public IP address of your phone? I could care less what the exact IP is, more does it match to the suspected DoD IP block?

Dougga, you can look through your l2tp logs on the UTM to find the phone's previous addresses.
Edit: Nevermind. I see you found the IP.

BTW, when posting multiple replies in a row, it's hard to tell which post you're replying to if there's no quote. e.g. "Bingo! Thanks."

Glad you got it figured out.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 SalishSwede over 11 years ago in reply to BarryG

My head's not adequately wrapping around how a vpn ip address created on my phone and it's associated MAC addresss made it to the UTM.  The UTM shows the DoD/Sprint cell address sending traffic to Facebook and the like.  This shouldn't happen in my understanding of tunnelling. Any traffic going through the tunnel should be using the internal VPN pool address of 10.242.x.y.

21.x.y.z (my phone's internet addr)----> UTM External Addr 75.x.y.z
10.242.x.y (L2TP Tunnel Addr)     -----> Separate routing rules for L2TP Pool 10.242/16

How did 21.x.y.z source address get sent to facebook or google public addresses.  This is bypassing the VPN functionality, otherwise the packet filter would show 10.242.x.y as the source address.

What am I missing?
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

Hi,

The MAC address is probably that of the tunnel.

I agree with you that the IP should have been the 10.242 address; there's probably a bug in the Android l2tp client.

The firewall seems to have done the right thing by dropping the packets, but I wonder why they were blocked by your rule and not by spoof protection (assuming that is turned on).

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 SalishSwede over 11 years ago in reply to BarryG

I agree with you that the IP should have been the 10.242 address; there's probably a bug in the Android l2tp client.

The firewall seems to have done the right thing by dropping the packets,  but I wonder why they were blocked by your rule and not by spoof  protection (assuming that is turned on).
Yes, exactly.

Spoof protection is indeed on.  Not strict, but on.  I may change that to strict.

There may be a problem with the UTM as well.  It could be a matter of precedence.  I see ambiguity between management of traffic between the Application Control rules and the Firewall rules.  If rules are set in both places, there's no indication which has precedence.  e.g.- Firewall rule blocking Steam traffic & App Control rule allowing it.

Best case is this is just a similar precedence issue.  In this case, before I put the DoD rule in, spoofing rules would have caught the traffic.

Worst case is, the traffic is allowed to flow un-managed and unencrypted.
Cancel
Vote Up 0 Vote Down

Cancel
0 SalishSwede over 11 years ago in reply to BarryG

Hi,

there's probably a bug in the Android l2tp client.

Barry

I created a bug with the CyanogemMod team to look into this.

https://jira.cyanogenmod.org/browse/CYAN-2864
Cancel
Vote Up 0 Vote Down

Cancel