Menu
▾
▴
[sweetspot-users] Problem with TCP sessions resetting for UAM client
|
From: Robert L. <dar...@gm...> - 2009-09-24 18:33:18
|
Hello, We are currently running sweetspot version 0.0.18, and we are having problems with TCP sessions being reset when we route through the sweetspot server. All connectionless protocols complete without error. Pings and DNS lookups work just fine. I am sorry if this is information overload! I just see you asking for these things in your other trouble shooting mails. When ever we try to ftp on port 21 or surf on port 80 we drop connection. * Here is an excerpt from our firewall:* Index Date/Time Device Event 91 2009/09/24 16:00:55.976 CEST 172.16.75.1 Sep 24 2009 10:00:55: %PIX-6-302013: Built outbound TCP connection 105790010 for outside: 66.96.134.57/21 (66.96.134.57/21) to DMZ10-chilli-outside:172.16.10.10/12646( 208.50.251.136/12646) 92 2009/09/24 16:00:56.070 CEST 172.16.75.1 Sep 24 2009 10:00:55: %PIX-6-302014: Teardown TCP connection 105790010 for outside:66.96.134.57/21to DMZ10-chilli-outside: 172.16.10.10/12646 duration 0:00:00 bytes 0 TCP Reset-I 93 2009/09/24 16:00:56.070 CEST 172.16.75.1 Sep 24 2009 10:00:55: %PIX-6-106015: Deny TCP (no connection) from 172.16.10.10/12646 to 66.96.134.57/21 flags ACK on interface DMZ10-chilli-outside Message 91: The sweetspot has forwarded a ftp-packet from a client. That initiates a session in the firewall. Message 92: The sweetspot sends a TCP-reset packet which causes the firewall to drop the session built before Message 93: The answer-packet from the ftp-server could not be forwarded, because the session has been terminated. We are releasing the IP of the client that connects. We aren't yet ready to test authentication until we can get a client to route all the way through. *sweetuam UP 172.31.18.4* Thu Sep 24 10:14:01 2009 [21196] uamsrv.c:310 resolution OK 172.31.18.4 Thu Sep 24 10:14:01 2009 [21196] uammsg.c:86 encoding UAM message Thu Sep 24 10:14:01 2009 [21196] uammsg.c:97 UAM arg #0: OK Thu Sep 24 10:14:01 2009 [21196] uammsg.c:97 UAM arg #1: 172.31.18.4 Thu Sep 24 10:14:01 2009 [21196] uammsg.c:37 encrypted UAM msg: 15 octets Thu Sep 24 10:14:01 2009 [21196] uamsrv.c:330 sent UAM msg: 15 octets I've included our configuration files and server setup to give you a better idea of what I am talking about: *sweetspot.conf* # Sweetspot daemon configuration # inner interface name (which is close to users) inner-interface eth0 # outer interface name (which is close to Internet) outer-interface eth1 # user IP CIDR (addresses anyhow assigned to user computers) #user-networks 127.0.0.0 user-networks 172.31.18.0/27 # SNAT public networks snat-public-networks 172.16.10.10/32 # authentication server address uam-server-address 127.0.0.1 # authentication server port uam-server-port 3993 # authentication server shared secret (auth client must have the same) #uam-secret n0m0n3yn0hun3y # report UAM errors back to client (obsolete) #uam-report-errors 1 # Detail file accounting acct-detail-file /var/sweetspot/detail # Interim accounting interval (in secs) #acct-interim-interval 300 # NAS-IP-Address to report in acct detail file acct-nas-ip-address 127.0.0.1 # Packet filters directory filter-dir /usr/local/etc/sweetspot/filters # Captive filter #filter-anonymous anonymous *sweetuam.conf* # Sweetspot UAM client configuration # authentication server group (comma-separated list) uam-server-group 127.0.0.1:3993 # originate client message from this address #uam-client-address 0.0.0.0 # UAM client receive timeout #uam-client-timeout 1 # authentication client shared secret (auth server must have the same) #uam-secret n0m0n3yn0hun3y *Interfaces* eth0 inet addr:172.16.11.10 Bcast:0.0.0.0 Mask:255.255.255.255 <-- Inside eth1 inet addr:172.16.10.10 Bcast:172.16.10.255 Mask:255.255.255.0 <-- Outside ***Kernel IP routing table* Destination Gateway Genmask Flags Metric Ref Use Iface 172.16.10.0 * 255.255.255.0 U 0 0 0 eth1 172.31.0.0 * 255.255.0.0 U 0 0 0 eth0 <--Route back to wireless clients link-local * 255.255.0.0 U 0 0 0 eth0 loopback * 255.0.0.0 U 0 0 0 lo default 172.16.10.1 0.0.0.0 UG 0 0 0 eth1 Thank you so much, again! Robert Lupinek |
