Menu
▾
▴
Re: [sweetspot-users] Problem with TCP sessions resetting for UAM client
|
From: Robert L. <dar...@gm...> - 2009-09-29 13:16:46
|
ilya, Your observations were correct! It does appear that we were having our packets processed twice! We were able to resolve the issue by using a different IP for our SNAT address and our Outside interface, as you suggested. Thanks! As for your question about doing NAT on the sweetspot, our firewall exists off the sweetspot server, we cannot use internet routable IP's until that hop. I have another question that I was saving until we were able to truly route through the sweetspot daemon. When trying to compile version 0.0.18 the SweetAuth Perl Libraries I get a error during make: hbsvsl04:/usr/src/sweetspot-0.0.18/perl/SweetAuth # perl Makefile.PL Warning: -L../../src changed to -L/usr/src/sweetspot-0.0.18/perl/SweetAuth/../../src Writing Makefile for SweetAuth hbsvsl04:/usr/src/sweetspot-0.0.18/perl/SweetAuth # make cc -c -I../../src -D_REENTRANT -D_GNU_SOURCE -DPERL_USE_SAFE_PUTENV -DDEBUGGING -fno-strict-aliasing -pipe -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -march=i586 -mtune=i686 -fmessage-length=0 -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -g -Wall -pipe -DVERSION=\"0.01\" -DXS_VERSION=\"0.01\" -fPIC "-I/usr/lib/perl5/5.10.0/i586-linux-thread-multi/CORE" SweetAuth.c In file included from SweetAuth.xs:5: ppport.h:3042:1: warning: "PERL_UNUSED_DECL" redefined In file included from SweetAuth.xs:2: /usr/lib/perl5/5.10.0/i586-linux-thread-multi/CORE/perl.h:299:1: warning: this is the location of the previous definition SweetAuth.c: In function âXS_SweetAuth_constantâ: const-xs.inc:5: warning: unused variable âtargâ SweetAuth.c:37: warning: unused variable âPerl___notusedâ SweetAuth.xs: In function âXS_SweetAuth_sweetauthâ: SweetAuth.xs:25: error: âSW_UAM_ARG_VECTOR_SIZEâ undeclared (first use in this function) SweetAuth.xs:25: error: (Each undeclared identifier is reported only once SweetAuth.xs:25: error: for each function it appears in.) SweetAuth.xs:40: warning: implicit declaration of function âsw_config_loadâ SweetAuth.xs:25: warning: unused variable âsw_argvâ SweetAuth.c:157: warning: unused variable âtargâ SweetAuth.c:156: warning: unused variable âRETVALâ SweetAuth.c:148: warning: unused variable âPerl___notusedâ SweetAuth.c: In function âboot_SweetAuthâ: SweetAuth.c:218: warning: unused variable âPerl___notusedâ make: *** [SweetAuth.o] Error 1 I was hoping you would have some insight into the cause of this problem. We are running 0.0.18 due to a bug in the source for 0.0.19 that I believe you are already addressing. Thank you for your help, and a BIG thank for this software! Robert Lupinek On Fri, Sep 25, 2009 at 1:02 PM, Ilya Etingof <il...@gl...> wrote: > > My immediate impression is that you are having an IP address conflict > between eth1's own address and NAT network configured to the sweetspot. > > Every packet destined to 172.16.10.10 would be received, and potentially > processed, by both Linux kernel and sweetspot daemon. That may cause > mess and glitches. Therefore your interface IPs and NAT IPs should never > overlap. > > BTW, do you really need sweetspot doing source NAT given you seem to have > a firewall doing NAT as well? Maybe you could do NAT at either of these > NAT devices? > > -ilya > > > We are currently running sweetspot version 0.0.18, and we are having > > problems with TCP sessions being reset when we route through the > sweetspot > > server. All connectionless protocols complete without error. Pings and > DNS > > lookups work just fine. > > > > I am sorry if this is information overload! I just see you asking for > these > > things in your other trouble shooting mails. > > > > When ever we try to ftp on port 21 or surf on port 80 we drop > connection. > > * > > > > Here is an excerpt from our firewall:* > > > > Index Date/Time Device Event > > 91 2009/09/24 16:00:55.976 CEST 172.16.75.1 Sep 24 2009 > 10:00:55: > > %PIX-6-302013: Built outbound TCP connection 105790010 for outside: > > 66.96.134.57/21 (66.96.134.57/21) to DMZ10-chilli-outside: > 172.16.10.10/12646( <http://172.16.10.10/12646%28> > > 208.50.251.136/12646) > > 92 2009/09/24 16:00:56.070 CEST 172.16.75.1 Sep 24 2009 > 10:00:55: > > %PIX-6-302014: Teardown TCP connection 105790010 for > > outside:66.96.134.57/21to DMZ10-chilli-outside: > > 172.16.10.10/12646 duration 0:00:00 bytes 0 TCP Reset-I > > 93 2009/09/24 16:00:56.070 CEST 172.16.75.1 Sep 24 2009 > 10:00:55: > > %PIX-6-106015: Deny TCP (no connection) from 172.16.10.10/12646 to > > 66.96.134.57/21 flags ACK on interface DMZ10-chilli-outside > > > > Message 91: The sweetspot has forwarded a ftp-packet from a client. That > > initiates a session in the firewall. > > Message 92: The sweetspot sends a TCP-reset packet which causes the > firewall > > to drop the session built before > > Message 93: The answer-packet from the ftp-server could not be forwarded, > > because the session has been terminated. > > > > > > We are releasing the IP of the client that connects. We aren't yet ready > to > > test authentication until we can get a client to route all the way > through. > > > > *sweetuam UP 172.31.18.4* > > Thu Sep 24 10:14:01 2009 [21196] uamsrv.c:310 resolution OK 172.31.18.4 > > Thu Sep 24 10:14:01 2009 [21196] uammsg.c:86 encoding UAM message > > Thu Sep 24 10:14:01 2009 [21196] uammsg.c:97 UAM arg #0: OK > > Thu Sep 24 10:14:01 2009 [21196] uammsg.c:97 UAM arg #1: 172.31.18.4 > > Thu Sep 24 10:14:01 2009 [21196] uammsg.c:37 encrypted UAM msg: 15 octets > > Thu Sep 24 10:14:01 2009 [21196] uamsrv.c:330 sent UAM msg: 15 octets > > > > > > > > > > I've included our configuration files and server setup to give you a > better > > idea of what I am talking about: > > > > *sweetspot.conf* > > # Sweetspot daemon configuration > > # inner interface name (which is close to users) > > inner-interface eth0 > > # outer interface name (which is close to Internet) > > outer-interface eth1 > > # user IP CIDR (addresses anyhow assigned to user computers) > > #user-networks 127.0.0.0 > > user-networks 172.31.18.0/27 > > # SNAT public networks > > snat-public-networks 172.16.10.10/32 > > # authentication server address > > uam-server-address 127.0.0.1 > > # authentication server port > > uam-server-port 3993 > > # authentication server shared secret (auth client must have the same) > > #uam-secret n0m0n3yn0hun3y > > # report UAM errors back to client (obsolete) > > #uam-report-errors 1 > > # Detail file accounting > > acct-detail-file /var/sweetspot/detail > > # Interim accounting interval (in secs) > > #acct-interim-interval 300 > > # NAS-IP-Address to report in acct detail file > > acct-nas-ip-address 127.0.0.1 > > # Packet filters directory > > filter-dir /usr/local/etc/sweetspot/filters > > # Captive filter > > #filter-anonymous anonymous > > > > *sweetuam.conf* > > # Sweetspot UAM client configuration > > # authentication server group (comma-separated list) > > uam-server-group 127.0.0.1:3993 > > # originate client message from this address > > #uam-client-address 0.0.0.0 > > # UAM client receive timeout > > #uam-client-timeout 1 > > # authentication client shared secret (auth server must have the same) > > #uam-secret n0m0n3yn0hun3y > > > > *Interfaces* > > eth0 inet addr:172.16.11.10 Bcast:0.0.0.0 Mask:255.255.255.255 <-- > > Inside > > eth1 inet addr:172.16.10.10 Bcast:172.16.10.255 Mask:255.255.255.0 > <-- > > Outside > > > > ***Kernel IP routing table* > > Destination Gateway Genmask Flags Metric Ref Use > > Iface > > 172.16.10.0 * 255.255.255.0 U 0 0 0 > eth1 > > 172.31.0.0 * 255.255.0.0 U 0 0 0 > > eth0 <--Route back to wireless clients > > link-local * 255.255.0.0 U 0 0 0 > eth0 > > loopback * 255.0.0.0 U 0 0 0 > lo > > default 172.16.10.1 0.0.0.0 UG 0 0 0 > eth1 > > > ------------------------------------------------------------------------------ > Come build with us! The BlackBerry® Developer Conference in SF, CA > is the only developer event you need to attend this year. Jumpstart your > developing skills, take BlackBerry mobile applications to market and stay > ahead of the curve. Join us from November 9-12, 2009. Register now! > http://p.sf.net/sfu/devconf > _______________________________________________ > sweetspot-users mailing list > swe...@li... > https://lists.sourceforge.net/lists/listinfo/sweetspot-users > > |
