[es] - PPTPD radi samo na jednoj IP adresi

Milan Kragujevic
Software Engineer

Član broj: 231903
Poruke: 2220
*.milankragujevic.com.

Sajt: https://milankragujevic.c..

+201 Profil

PPTPD radi samo na jednoj IP adresi

^{15.04.2020. u 09:03 - pre 48 meseci}

Pozdrav.

Imam problem sa pptpd na Ubuntu 18.04 serveru, koji radi samo na jednoj IP adresi.

Server se nalazi u Telenor data centru i nema nikakva ograničenja pristupa niti filtriranje bilo čega.

Interface eth0 ima dodeljene IP adrese statički u /etc/network/interfaces (isključen je netplan). Prva IP adresa je "glavna", ostale (2-3-5 nije bitno) su "dodatne".

ifconfig eth0 pokazuje samo glavnu IP adresu, dok ip addr pokazuje sve.

Svi servisi koji slušaju na 0.0.0.0 se "vide" sa svih IP adresa jednako (pričam o pristupu iz eksterne mreže).

PPTP server (pptpd, instaliran sa apt, podešen u smislu dodavanja kredencijala, komentovanjem nodisableroute i podešavanjem autorizacije na CHAP) radi samo na prvoj IP adresi.

Dakle, svi klijenti, bez obzira na platformu, povezuju se na prvu IP adresu i uspostavljaju link, dobijaju privatnu IP adresu od PPP, kao što je definisano za PPTP, i imaju pristup servisima
na default gateway, kao i pristup Internetu ukoliko je to prihvaćeno, dodavanjem default rute na samom uređaju preko VPN gateway-a.

Svi klijenti koji se povežu na bilo koju drugu IP adresu uspostave link ali ne dobijaju IP adresu od PPP i samim tim nemaju pristup ničemu. Tunel je povezan, ali nema pristupa.

CHAP secrets fajl je podešen da svima dozvoli pristup sa svih IP adresa i da im random dodeli IP adresu iz pool-a.

Testiram trenutno na primeru MikroTik, isto je i sa pptp-linux klijentom, kao i sa nekim jeftinim ruterima koji imaju "Russian PPTP" klijent.

Log sa servera u trenutku logovanja na drugu IP adresu:

Code:

Apr 13 10:56:18 localhost pptpd[2738]: CTRL: Client [MOJ IP] control connection started
Apr 13 10:56:18 localhost pptpd[2738]: CTRL: Starting call (launching pppd, opening GRE)
Apr 13 10:56:18 localhost pppd[2739]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Apr 13 10:56:18 localhost pppd[2739]: pppd 2.4.7 started by root, uid 0
Apr 13 10:56:18 localhost pppd[2739]: Using interface ppp1
Apr 13 10:56:18 localhost pppd[2739]: Connect: ppp1 <--> /dev/pts/2
Apr 13 10:56:18 localhost systemd-udevd[2735]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable.
Apr 13 10:56:34 localhost pptpd[2738]: CTRL: EOF or bad error reading ctrl packet length.
Apr 13 10:56:34 localhost pptpd[2738]: CTRL: couldn't read packet header (exit)
Apr 13 10:56:34 localhost pptpd[2738]: CTRL: CTRL read failed
Apr 13 10:56:34 localhost pptpd[2738]: CTRL: Reaping child PPP[2739]
Apr 13 10:56:34 localhost pppd[2739]: Modem hangup
Apr 13 10:56:34 localhost pppd[2739]: Connection terminated.
Apr 13 10:56:34 localhost pppd[2739]: Exit.
Apr 13 10:56:34 localhost pptpd[2738]: CTRL: Client [MOJ IP] control connection finished

U trenutku kada ne radi nema povezanih klijenata. Nikakva posebna podešavanja nisu rađena. Situacija je isto bilo da li koristim aliase (eth0:0, eth0:1, ...) ili samo prikačim IP adresu interfejsu eth0.

Da PPTP server sluša na svim IP adresama sam potvrdio sa netstat, ali takođe i tako što klijent uopšte ne može da uspostavi vezu ako pptpd-u dodam argument --listen sa prvom IP adresom.

Odgovor na temu

jovanmal
Jovan Malešević
Sistem administrator
BL, Republika Srpska

Član broj: 6106
Poruke: 204
31.223.156.*

Sajt: flashofobvious.blogspot.c..

+2 Profil

Re: PPTPD radi samo na jednoj IP adresi

^{15.04.2020. u 09:46 - pre 48 meseci}

Moze li output komande ip a, maskiraj adrese ili ih izmjeni. Ostavi podatke o subnetu.

..blinding flash of the obvious..

Odgovor na temu

Milan Kragujevic
Software Engineer

Član broj: 231903
Poruke: 2220
*.dynamic.vipmobile.rs.

Sajt: https://milankragujevic.c..

+201 Profil

Re: PPTPD radi samo na jednoj IP adresi

^{15.04.2020. u 11:33 - pre 48 meseci}

Naravno.

Citat:

root@xxxxxx:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff
inet 185.119.XX.27/24 brd 185.119.XX.255 scope global eth0
valid_lft forever preferred_lft forever
inet 185.119.XX.62/16 brd 185.119.255.255 scope global eth0
valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
link/none
inet 10.8.0.1/24 brd 10.8.0.255 scope global tun0
valid_lft forever preferred_lft forever
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:5b:01:03:bc brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
5: br-c756be35f75c: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:57:58:09:37 brd ff:ff:ff:ff:ff:ff
inet 172.18.0.1/16 brd 172.18.255.255 scope global br-c756be35f75c
valid_lft forever preferred_lft forever
7: vetha2cc6f9@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-c756be35f75c state UP group default
link/ether 5e:af:e7:c1:12:3c brd ff:ff:ff:ff:ff:ff link-netnsid 0
root@xxxxxx:~#

Odgovor na temu

jovanmal
Jovan Malešević
Sistem administrator
BL, Republika Srpska

Član broj: 6106
Poruke: 204
31.223.156.*

Sajt: flashofobvious.blogspot.c..

+2 Profil

Re: PPTPD radi samo na jednoj IP adresi

^{16.04.2020. u 17:34 - pre 48 meseci}

Hm, pomislio sam da je scope za konekcije bio setovan na peer umjesto na global. Imao sam slican slucaj, kod mene je to bilo rjesenje problema.

Ali kod tebe je vec global..

Odazivaju li ti se drugi servisi na tim adresama, ili je problem samo sa pptpd?

..blinding flash of the obvious..

Odgovor na temu

Milan Kragujevic
Software Engineer

Član broj: 231903
Poruke: 2220
77.243.27.*

Sajt: https://milankragujevic.c..

+201 Profil

Re: PPTPD radi samo na jednoj IP adresi

^{16.04.2020. u 17:49 - pre 48 meseci}

Sve se odaziva, čak i pptpd. Odnosno, ako fiksiram da sluša na prvoj adresi, ne mogu da dođem do "link established" stanja uopšte, niti vidim servis na 1723 portu. Ako stavim da sluša na obe adrese ili 0.0.0.0, poveže se do "link established" i tu ostane. Ne puca tunel, tj. ne restartuje se non-stop, ostane na "link established" i to je to. Neće dalje. Obično kad je misconfiguration pptpd puca tunel i ruter pokušava non-stop što se vidi tako što spamuje log. Mislim da je problem na PPP strani, on treba da odradi autorizaciju i dodeli pristup i IP adresu...

Evo config fajlova. Promene su označene crvenim, ostatak je default iz instalacije...

/etc/pptpd.conf

Citat:

###############################################################################
# $Id$
#
# Sample Poptop configuration file /etc/pptpd.conf
#
# Changes are effective when pptpd is restarted.
###############################################################################

# TAG: ppp
# Path to the pppd program, default '/usr/sbin/pppd' on Linux
#
#ppp /usr/sbin/pppd

# TAG: option
# Specifies the location of the PPP options file.
# By default PPP looks in '/etc/ppp/options'
#
option /etc/ppp/pptpd-options

# TAG: debug
# Turns on (more) debugging to syslog
#
#debug

# TAG: stimeout
# Specifies timeout (in seconds) on starting ctrl connection
#
# stimeout 10

# TAG: noipparam
# Suppress the passing of the client's IP address to PPP, which is
# done by default otherwise.
#
#noipparam

# TAG: logwtmp
# Use wtmp(5) to record client connections and disconnections.
#
logwtmp

# TAG: bcrelay <if>
# Turns on broadcast relay to clients from interface <if>
#
#bcrelay eth1

# TAG: delegate
# Delegates the allocation of client IP addresses to pppd.
#
# Without this option, which is the default, pptpd manages the list of
# IP addresses for clients and passes the next free address to pppd.
# With this option, pptpd does not pass an address, and so pppd may use
# radius or chap-secrets to allocate an address.
#
#delegate

# TAG: connections
# Limits the number of client connections that may be accepted.
#
# If pptpd is allocating IP addresses (e.g. delegate is not
# used) then the number of connections is also limited by the
# remoteip option. The default is 100.
#connections 500

# TAG: localip
# TAG: remoteip
# Specifies the local and remote IP address ranges.
#
# These options are ignored if delegate option is set.
#
# Any addresses work as long as the local machine takes care of the
# routing. But if you want to use MS-Windows networking, you should
# use IP addresses out of the LAN address space and use the proxyarp
# option in the pppd options file, or run bcrelay.
#
# You can specify single IP addresses seperated by commas or you can
# specify ranges, or both. For example:
#
# 192.168.0.234,192.168.0.245-249,192.168.0.254
#
# IMPORTANT RESTRICTIONS:
#
# 1. No spaces are permitted between commas or within addresses.
#
# 2. If you give more IP addresses than the value of connections,
# it will start at the beginning of the list and go until it
# gets connections IPs. Others will be ignored.
#
# 3. No shortcuts in ranges! ie. 234-8 does not mean 234 to 238,
# you must type 234-238 if you mean this.
#
# 4. If you give a single localIP, that's ok - all local IPs will
# be set to the given one. You MUST still give at least one remote
# IP for each simultaneous client.
#
# (Recommended)
#localip 192.168.0.1
#remoteip 192.168.0.234-238,192.168.0.245
# or
#localip 192.168.0.234-238,192.168.0.245
#remoteip 192.168.1.234-238,192.168.1.245

localip 10.20.0.1
remoteip 10.20.0.2-254

/etc/ppp/pptpd-options

Citat:

###############################################################################
# $Id$
#
# Sample Poptop PPP options file /etc/ppp/pptpd-options
# Options used by PPP when a connection arrives from a client.
# This file is pointed to by /etc/pptpd.conf option keyword.
# Changes are effective on the next connection. See "man pppd".
#
# You are expected to change this file to suit your system. As
# packaged, it requires PPP 2.4.2 and the kernel MPPE module.
###############################################################################

# Authentication

# Name of the local system for authentication purposes
# (must match the second field in /etc/ppp/chap-secrets entries)
name pptpd

# Optional: domain name to use for authentication
# domain mydomain.net

# Strip the domain prefix from the username before authentication.
# (applies if you use pppd with chapms-strip-domain patch)
#chapms-strip-domain

# Encryption
# (There have been multiple versions of PPP with encryption support,
# choose with of the following sections you will use.)

# BSD licensed ppp-2.4.2 upstream with MPPE only, kernel module ppp_mppe.o
# {{{
refuse-pap
#refuse-chap
refuse-mschap
# Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
# Challenge Handshake Authentication Protocol, Version 2] authentication.
#require-mschap-v2
# Require MPPE 128-bit encryption
# (note that MPPE requires the use of MSCHAP-V2 during authentication)
#require-mppe-128
# }}}

# Network and Routing

# If pppd is acting as a server for Microsoft Windows clients, this
# option allows pppd to supply one or two DNS (Domain Name Server)
# addresses to the clients. The first instance of this option
# specifies the primary DNS address; the second instance (if given)
# specifies the secondary DNS address.
# Attention! This information may not be taken into account by a Windows
# client. See KB311218 in Microsoft's knowledge base for more information.
#ms-dns 10.0.0.1
#ms-dns 10.0.0.2

ms-dns 172.17.0.1
ms-dns 172.17.0.1

# If pppd is acting as a server for Microsoft Windows or "Samba"
# clients, this option allows pppd to supply one or two WINS (Windows
# Internet Name Services) server addresses to the clients. The first
# instance of this option specifies the primary WINS address; the
# second instance (if given) specifies the secondary WINS address.
#ms-wins 10.0.0.3
#ms-wins 10.0.0.4

# Add an entry to this system's ARP [Address Resolution Protocol]
# table with the IP address of the peer and the Ethernet address of this
# system. This will have the effect of making the peer appear to other
# systems to be on the local ethernet.
# (you do not need this if your PPTP server is responsible for routing
# packets to the clients -- James Cameron)
proxyarp

# Normally pptpd passes the IP address to pppd, but if pptpd has been
# given the delegate option in pptpd.conf or the --delegate command line
# option, then pppd will use chap-secrets or radius to allocate the
# client IP address. The default local IP address used at the server
# end is often the same as the address of the server. To override this,
# specify the local IP address here.
# (you must not use this unless you have used the delegate option)
#10.8.0.100

# Debian: do not replace the default route
#nodefaultroute

# Logging

# Enable connection debugging facilities.
# (see your syslog configuration for where pppd sends to)
#debug

# Print out all the option values which have been set.
# (often requested by mailing list to verify options)
#dump

# Miscellaneous

# Create a UUCP-style lock file for the pseudo-tty to ensure exclusive
# access.
lock

# Disable BSD-Compress compression
nobsdcomp

# Disable Van Jacobson compression
# (needed on some networks with Windows 9x/ME/XP clients, see posting to
# poptop-server on 14th April 2005 by Pawel Pokrywka and followups,
# http://marc.theaimsgroup.com/?t=111343175400006&r=1&w=2 )
novj
novjccomp

# turn off logging to stderr, since this may be redirected to pptpd,
# which may trigger a loopback
nologfd

# put plugins here
# (putting them higher up may cause them to sent messages to the pty)

/etc/ppp/chap-secrets

Citat:

# Secrets for authentication using CHAP
# client server secret IP addresses

admin * [password] 10.20.0.200
vpn1 * [password] 10.20.0.100
vpn2 * [password] 10.20.0.101
vpn3 * [password] 10.20.0.102

Odgovor na temu