PPTP and GRE Protocol passthrough (NOT SOLVED)

sgolastra · 2019-01-14 09:47:31 UTC

NethServer Version: your_version
Module: your_module

Versione sistema
NethServer release 6.10 (Final)
Versione kernel
2.6.32-754.9.1.el6.x86_64

Hi team, in our company we have a box netserver, see pic:

I want to configure winzoz pptp passthrough for protocol GRE.

I have tested from a client after connection the error is:
“LCP: timeout sendig Config-Requests”

How can i setup GRE protocol passthrough ?

I have read some post but anyone explain to setup this protocol winzoz.

PLS help me!

Thanks in advance,
regard,

DundiDu

LayLow · 2019-01-14 11:31:57 UTC

Not really an answer but more a hint, you do know that PPTP is to be considered unsecure and other VPN solutions should be considered?

sgolastra · 2019-01-14 13:05:46 UTC

Hi LayLow, thanks for yuor answerd, pptp is a temporary solutions for server test.
Anyone help me for GRE protocol?
Thanks in advance,

Regards,
SGOLASTRA

LayLow · 2019-01-14 14:31:18 UTC

Try forwarding port 1723 UDP

sgolastra · 2019-01-14 14:55:00 UTC

Hi LayLow, thanks a lot for your answered, i have just setup ffwd port in this mode:

Protocol ORIGIN PORT HOST DEST PORT DEST

TCP,UDP 1723 server01 1723 host role_ffwd_pptp

Anyone another suggest?

Thanks in advance,

Sgolastra

LayLow · 2019-01-14 15:14:27 UTC

For testing, forward UDP and TCP ports 1723 and 47

filippo_carletti · 2019-01-14 16:56:16 UTC

Rough untested idea: add something like the following to /etc/shorewall/started:

iptables -t nat -A PREROUTING -i eth0 -p gre -j DNAT --to-destination 192.168.0.1

mrmarkuz · 2019-01-14 17:04:24 UTC

Here are some infos about shorewall and PPTP:

http://shorewall.org/PPTP.htm#ServerBehind

sgolastra · 2019-01-15 07:29:51 UTC

Hi @filippo_carletti, thanks for your reply, this command is only for eth0, right?

Nethserver have this config:
green: eth0 ip 192.168.0.1
red: eth1 ip 127.0.0.1

the commands FOR GREEN is:

iptables -t nat -A PREROUTING -i eth0 -p gre -j DNAT --to-destination 192.168.0.1

the commands FOR RED is:

iptables -t nat -A PREROUTING -i eth1 -p gre -j DNAT --to-destination 127.0.0.1

something is missing, for example, the inverse command, du u understand?

Regards,
Sgolastra.

sgolastra · 2019-01-15 07:32:14 UTC

Hi @LayLow thank you for your reply, in the past have tried configuration suggested by you, but it does not work like that, however, thanks for your help, thank very much.

Sgolastra

sgolastra · 2019-01-15 13:51:11 UTC

Hi @mrmarkuz, thank you for reply ;-), i have read and test with a ref. of page by the PPTP Server Running Behind your Firewall.

My net area is an example:
green eth0 as ip andress 192.1.1.1 with alias ip 192.3.3.1
red eth1 192.0.0.1
winzoz pptp server test is: 192.3.3.100
external ip: 127.0.0.1

I have setup in this mode:
/etc/shorewall/rules:

######################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH

PORT PORT(S) DEST LIMIT GROUP

#SECTION ALL

SECTION ESTABLISHED

?SECTION ESTABLISHED
DNAT net loc:192.3.3.100 tcp 1723 - 127.0.0.1
DNAT net loc:192.3.3.100 47 - - 127.0.0.1

SECTION RELATED

?SECTION RELATED

SECTION NEW

?SECTION NEW

…

when i restart service shorewall the error is:

Starting shorewall: ERROR: NAT rules are only allowed in the NEW section /etc/shorewall/rules (line 29)
[FAILED]
can u help me please?

Thanks in advance,

Sgolastra.

sgolastra · 2019-01-15 13:52:45 UTC

Opss when i post i celebrate the error and now understand , now i test

sgolastra · 2019-01-15 14:29:32 UTC

Hi @mrmarkuz i just tested in this mode…

Scenario:
green eth0 as ip andress 192.1.1.1 with alias ip 192.3.3.1
red eth1 192.0.0.1
winzoz pptp server test is: 192.3.3.100
external ip: 127.0.0.1

/etc/shorewall/rules :
#ACTION SOURCE DEST PROTO DEST PORT(S)
DNAT net loc:192.3.3.100 tcp 1723
DNAT net loc:192.3.3.100 47

in – etc/shorewall/masq:
#INTERFACE SUBNET ADDRESS PROTO
eth0 192.3.3.0/24 192.0.0.1 47

the service restart correctly, but when i try to connect by pptp vpn client, the error is:

2019-01-15 15:20:50 Using interface ppp0
2019-01-15 15:20:50 Connect: ppp0 <–> socket[34:17]
2019-01-15 15:20:54 PPTP port-mapping for en1, interfaceIndex: 0, Protocol: None, Private Port: 0, Public Address: 0, Public Port: 0, TTL: 0.
2019-01-15 15:20:54 PPTP port-mapping for en1 inconsistent. is Connected: 1, Previous interface: 4, Current interface 0
**19-01-15 15:21:22 LCP: timeout sending Config-Requests
2019-01-15 15:21:22 Connection terminated.
2019-01-15 15:21:22 PPTP disconnecting…
2019-01-15 15:21:22 PPTP clearing port-mapping for en1
2019-01-15 15:21:22 PPTP disconnected

where I wrong?

Thanks,
Regard,

Daniele

mrmarkuz · 2019-01-15 14:42:00 UTC

Is there a typo, you commented out the eth0 line?

~~Could it be that you need a static route on your nethserver for network 192.3.3.0 to your internal pptp server address?~~

Did you mask the addresses to keep them secret? External IP is 127.0.0.1?

sgolastra · 2019-01-15 15:15:57 UTC

Is a typo

i have mask the andress

Thanks for your support @mrmarkuz

regards,

Sgolastra

mrmarkuz · 2019-01-15 15:55:36 UTC

Does it work now?

You may need custom templates to make the changes to shorewall config permanent.

sgolastra · 2019-01-15 16:26:25 UTC

Hi @mrmarkuz no the error is the same in my previous post:
the service restart correctly, but when i try to connect by pptp vpn client, the error is:

2019-01-15 15:20:50 Using interface ppp0
2019-01-15 15:20:50 Connect: ppp0 <–> socket[34:17]
2019-01-15 15:20:54 PPTP port-mapping for en1, interfaceIndex: 0, Protocol: None, Private Port: 0, Public Address: 0, Public Port: 0, TTL: 0.
2019-01-15 15:20:54 PPTP port-mapping for en1 inconsistent. is Connected: 1, Previous interface: 4, Current interface 0
**19-01-15 15:21:22 LCP: timeout sending Config-Requests
2019-01-15 15:21:22 Connection terminated.
2019-01-15 15:21:22 PPTP disconnecting…
2019-01-15 15:21:22 PPTP clearing port-mapping for en1
2019-01-15 15:21:22 PPTP disconnected

Thanks,
regards,
SGOLASTRA

mrmarkuz · 2019-01-15 16:44:25 UTC

Here are some informations for diagnosing the problem, it seems GRE is not handled correctly:

http://pptpclient.sourceforge.net/howto-diagnosis.phtml#lcp_timeout

LayLow · 2019-01-15 18:52:16 UTC

FYI http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/868-cisco-router-gre-ipsec.html

pike · 2019-01-15 18:56:53 UTC

L2TP or OpenVPN could not be used as alternatives for Windows?