PPTP and GRE Protocol passthrough (NOT SOLVED)

sgolastra · January 14, 2019, 9:47am

NethServer Version: your_version
Module: your_module

Versione sistema
NethServer release 6.10 (Final)
Versione kernel
2.6.32-754.9.1.el6.x86_64

Hi team, in our company we have a box netserver, see pic:

I want to configure winzoz pptp passthrough for protocol GRE.

I have tested from a client after connection the error is:
“LCP: timeout sendig Config-Requests”

How can i setup GRE protocol passthrough ?

I have read some post but anyone explain to setup this protocol winzoz.

PLS help me!

Thanks in advance,
regard,

DundiDu

LayLow · January 14, 2019, 11:31am

Not really an answer but more a hint, you do know that PPTP is to be considered unsecure and other VPN solutions should be considered?

sgolastra · January 14, 2019, 1:05pm

Hi LayLow, thanks for yuor answerd, pptp is a temporary solutions for server test.
Anyone help me for GRE protocol?
Thanks in advance,

Regards,
SGOLASTRA

LayLow · January 14, 2019, 2:31pm

Try forwarding port 1723 UDP

sgolastra · January 14, 2019, 2:55pm

Hi LayLow, thanks a lot for your answered, i have just setup ffwd port in this mode:

Protocol ORIGIN PORT HOST DEST PORT DEST

TCP,UDP 1723 server01 1723 host role_ffwd_pptp

Anyone another suggest?

Thanks in advance,

Sgolastra

LayLow · January 14, 2019, 3:14pm

For testing, forward UDP and TCP ports 1723 and 47

filippo_carletti · January 14, 2019, 4:56pm

Rough untested idea: add something like the following to /etc/shorewall/started:

iptables -t nat -A PREROUTING -i eth0 -p gre -j DNAT --to-destination 192.168.0.1

mrmarkuz · January 14, 2019, 5:04pm

Here are some infos about shorewall and PPTP:

http://shorewall.org/PPTP.htm#ServerBehind

sgolastra · January 15, 2019, 7:29am

Hi @filippo_carletti, thanks for your reply, this command is only for eth0, right?

Nethserver have this config:
green: eth0 ip 192.168.0.1
red: eth1 ip 127.0.0.1

the commands FOR GREEN is:

iptables -t nat -A PREROUTING -i eth0 -p gre -j DNAT --to-destination 192.168.0.1

the commands FOR RED is:

iptables -t nat -A PREROUTING -i eth1 -p gre -j DNAT --to-destination 127.0.0.1

something is missing, for example, the inverse command, du u understand?

Regards,
Sgolastra.

sgolastra · January 15, 2019, 7:32am

Hi @LayLow thank you for your reply, in the past have tried configuration suggested by you, but it does not work like that, however, thanks for your help, thank very much.

Sgolastra

sgolastra · January 15, 2019, 1:51pm

Hi @mrmarkuz, thank you for reply ;-), i have read and test with a ref. of page by the PPTP Server Running Behind your Firewall.

My net area is an example:
green eth0 as ip andress 192.1.1.1 with alias ip 192.3.3.1
red eth1 192.0.0.1
winzoz pptp server test is: 192.3.3.100
external ip: 127.0.0.1

I have setup in this mode:
/etc/shorewall/rules:

######################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH

PORT PORT(S) DEST LIMIT GROUP

#SECTION ALL

SECTION ESTABLISHED

?SECTION ESTABLISHED
DNAT net loc:192.3.3.100 tcp 1723 - 127.0.0.1
DNAT net loc:192.3.3.100 47 - - 127.0.0.1

SECTION RELATED

?SECTION RELATED

SECTION NEW

?SECTION NEW

…

when i restart service shorewall the error is:

Starting shorewall: ERROR: NAT rules are only allowed in the NEW section /etc/shorewall/rules (line 29)
[FAILED]
can u help me please?

Thanks in advance,

Sgolastra.

sgolastra · January 15, 2019, 1:52pm

Opss when i post i celebrate the error and now understand , now i test

sgolastra · January 15, 2019, 2:29pm

Hi @mrmarkuz i just tested in this mode…

Scenario:
green eth0 as ip andress 192.1.1.1 with alias ip 192.3.3.1
red eth1 192.0.0.1
winzoz pptp server test is: 192.3.3.100
external ip: 127.0.0.1

/etc/shorewall/rules :
#ACTION SOURCE DEST PROTO DEST PORT(S)
DNAT net loc:192.3.3.100 tcp 1723
DNAT net loc:192.3.3.100 47

in – etc/shorewall/masq:
#INTERFACE SUBNET ADDRESS PROTO
eth0 192.3.3.0/24 192.0.0.1 47

the service restart correctly, but when i try to connect by pptp vpn client, the error is:

2019-01-15 15:20:50 Using interface ppp0
2019-01-15 15:20:50 Connect: ppp0 <–> socket[34:17]
2019-01-15 15:20:54 PPTP port-mapping for en1, interfaceIndex: 0, Protocol: None, Private Port: 0, Public Address: 0, Public Port: 0, TTL: 0.
2019-01-15 15:20:54 PPTP port-mapping for en1 inconsistent. is Connected: 1, Previous interface: 4, Current interface 0
**19-01-15 15:21:22 LCP: timeout sending Config-Requests
2019-01-15 15:21:22 Connection terminated.
2019-01-15 15:21:22 PPTP disconnecting…
2019-01-15 15:21:22 PPTP clearing port-mapping for en1
2019-01-15 15:21:22 PPTP disconnected

where I wrong?

Thanks,
Regard,

Daniele

mrmarkuz · January 15, 2019, 2:42pm

Is there a typo, you commented out the eth0 line?

~~Could it be that you need a static route on your nethserver for network 192.3.3.0 to your internal pptp server address?~~

Did you mask the addresses to keep them secret? External IP is 127.0.0.1?

sgolastra · January 15, 2019, 3:15pm

Is a typo

i have mask the andress

Thanks for your support @mrmarkuz

regards,

Sgolastra

mrmarkuz · January 15, 2019, 3:55pm

Does it work now?

You may need custom templates to make the changes to shorewall config permanent.

sgolastra · January 15, 2019, 4:26pm

Hi @mrmarkuz no the error is the same in my previous post:
the service restart correctly, but when i try to connect by pptp vpn client, the error is:

2019-01-15 15:20:50 Using interface ppp0
2019-01-15 15:20:50 Connect: ppp0 <–> socket[34:17]
2019-01-15 15:20:54 PPTP port-mapping for en1, interfaceIndex: 0, Protocol: None, Private Port: 0, Public Address: 0, Public Port: 0, TTL: 0.
2019-01-15 15:20:54 PPTP port-mapping for en1 inconsistent. is Connected: 1, Previous interface: 4, Current interface 0
**19-01-15 15:21:22 LCP: timeout sending Config-Requests
2019-01-15 15:21:22 Connection terminated.
2019-01-15 15:21:22 PPTP disconnecting…
2019-01-15 15:21:22 PPTP clearing port-mapping for en1
2019-01-15 15:21:22 PPTP disconnected

Thanks,
regards,
SGOLASTRA

mrmarkuz · January 15, 2019, 4:44pm

Here are some informations for diagnosing the problem, it seems GRE is not handled correctly:

http://pptpclient.sourceforge.net/howto-diagnosis.phtml#lcp_timeout

LayLow · January 15, 2019, 6:52pm

FYI http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/868-cisco-router-gre-ipsec.html

pike · January 15, 2019, 6:56pm

L2TP or OpenVPN could not be used as alternatives for Windows?