Re: [sweetspot-users] Problem with TCP sessions resetting for UAM client

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

My immediate impression is that you are having an IP address conflict 
between eth1's own address and NAT network configured to the sweetspot.

Every packet destined to 172.16.10.10 would be received, and potentially 
processed, by both Linux kernel and sweetspot daemon. That may cause
mess and glitches. Therefore your interface IPs and NAT IPs should never
overlap.

BTW, do you really need sweetspot doing source NAT given you seem to have 
a firewall doing NAT as well? Maybe you could do NAT at either of these 
NAT devices?

-ilya

>   We are currently running sweetspot version 0.0.18, and we are having
> problems with TCP sessions being reset when we route through the sweetspot
> server.  All connectionless protocols complete without error.  Pings and DNS
> lookups work just fine.
>
> I am sorry if this is information overload!  I just see you asking for these
> things in your other trouble shooting mails.
>
>  When ever we try to ftp on port 21 or surf on port 80 we drop connection.
> *
>
> Here is an excerpt from our firewall:*
>
> Index    Date/Time            Device        Event
> 91    2009/09/24 16:00:55.976 CEST    172.16.75.1    Sep 24 2009 10:00:55:
> %PIX-6-302013: Built outbound TCP connection 105790010 for outside:
> 66.96.134.57/21 (66.96.134.57/21) to DMZ10-chilli-outside:172.16.10.10/12646(
> 208.50.251.136/12646)
> 92    2009/09/24 16:00:56.070 CEST    172.16.75.1    Sep 24 2009 10:00:55:
> %PIX-6-302014: Teardown TCP connection 105790010 for
> outside:66.96.134.57/21to DMZ10-chilli-outside:
> 172.16.10.10/12646 duration 0:00:00 bytes 0 TCP Reset-I
> 93    2009/09/24 16:00:56.070 CEST    172.16.75.1    Sep 24 2009 10:00:55:
> %PIX-6-106015: Deny TCP (no connection) from 172.16.10.10/12646 to
> 66.96.134.57/21 flags ACK  on interface DMZ10-chilli-outside
>
> Message 91: The sweetspot has forwarded a ftp-packet from a client. That
> initiates a session in the firewall.
> Message 92: The sweetspot sends a TCP-reset packet which causes the firewall
> to drop the session built before
> Message 93: The answer-packet from the ftp-server could not be forwarded,
> because the session has been terminated.
>
>
> We are releasing the IP of the client that connects.  We aren't yet ready to
> test authentication until we can get a client to route all the way through.
>
> *sweetuam UP 172.31.18.4*
> Thu Sep 24 10:14:01 2009 [21196] uamsrv.c:310 resolution OK 172.31.18.4
> Thu Sep 24 10:14:01 2009 [21196] uammsg.c:86 encoding UAM message
> Thu Sep 24 10:14:01 2009 [21196] uammsg.c:97 UAM arg #0: OK
> Thu Sep 24 10:14:01 2009 [21196] uammsg.c:97 UAM arg #1: 172.31.18.4
> Thu Sep 24 10:14:01 2009 [21196] uammsg.c:37 encrypted UAM msg: 15 octets
> Thu Sep 24 10:14:01 2009 [21196] uamsrv.c:330 sent UAM msg: 15 octets
>
>
>
>
> I've included our configuration files and server setup to give you a better
> idea of what I am talking about:
>
> *sweetspot.conf*
> # Sweetspot daemon configuration
> # inner interface name (which is close to users)
> inner-interface eth0
> # outer interface name (which is close to Internet)
> outer-interface eth1
> # user IP CIDR (addresses anyhow assigned to user computers)
> #user-networks 127.0.0.0
> user-networks 172.31.18.0/27
> # SNAT public networks
> snat-public-networks 172.16.10.10/32
> # authentication server address
> uam-server-address 127.0.0.1
> # authentication server port
> uam-server-port 3993
> # authentication server shared secret (auth client must have the same)
> #uam-secret n0m0n3yn0hun3y
> # report UAM errors back to client (obsolete)
> #uam-report-errors 1
> # Detail file accounting
> acct-detail-file /var/sweetspot/detail
> # Interim accounting interval (in secs)
> #acct-interim-interval 300
> # NAS-IP-Address to report in acct detail file
> acct-nas-ip-address 127.0.0.1
> # Packet filters directory
> filter-dir /usr/local/etc/sweetspot/filters
> # Captive filter
> #filter-anonymous anonymous
>
> *sweetuam.conf*
> # Sweetspot UAM client configuration
> # authentication server group (comma-separated list)
> uam-server-group 127.0.0.1:3993
> # originate client message from this address
> #uam-client-address 0.0.0.0
> # UAM client receive timeout
> #uam-client-timeout 1
> # authentication client shared secret (auth server must have the same)
> #uam-secret n0m0n3yn0hun3y
>
> *Interfaces*
> eth0   inet addr:172.16.11.10  Bcast:0.0.0.0  Mask:255.255.255.255  <--
> Inside
> eth1   inet addr:172.16.10.10  Bcast:172.16.10.255  Mask:255.255.255.0  <--
> Outside
>
> ***Kernel IP routing table*
> Destination     Gateway         Genmask         Flags Metric Ref    Use
> Iface
> 172.16.10.0     *               255.255.255.0   U     0      0        0 eth1
> 172.31.0.0      *               255.255.0.0     U     0      0        0
> eth0  <--Route back to wireless clients
> link-local      *               255.255.0.0     U     0      0        0 eth0
> loopback        *               255.0.0.0       U     0      0        0 lo
> default         172.16.10.1     0.0.0.0         UG    0      0        0 eth1