Dotaz: Nftables - připojení k VPN

[Beetljuice]

Zdravím všechny. Potřeboval bych poradit s pravidly v Nftables. Mám jeden server jako router. Vše mi funguje bez problémů, až na jeden a nevím si s tím už rady. Mám ntb se kterým se odkudkoliv připojuji bez problémů na VPN (pptp) do firmy. Bohužel se mi to nedaří, pokud jsem za tímto serverem (routerem). Tady je konfigurace :

table ip fail2ban {
        chain input {
                type filter hook input priority 100; policy accept;
        }
}
table inet filter {
        chain input {
                type filter hook input priority 0; policy drop;
                ct state { established, related } accept
                ct state invalid drop
                iifname "lo" accept
                iifname "eno2" accept
                iifname "vlan20" accept
                iifname "vlan10" accept
                ip protocol { icmp, tcp, udp, gre } accept
                tcp dport ssh accept comment "SSH in"
                tcp dport { http, https } accept
        }

        chain forward {
                type filter hook forward priority 0; policy accept;
                iifname "eno2" oifname "eno1" accept
                iifname "eno1" oifname "eno2" ct state established,related accept
        }

        chain output {
                type filter hook output priority 0; policy accept;
        }
}
table ip nat {
        chain prerouting {
                type nat hook prerouting priority 0; policy accept;
                iifname "eno1" tcp dport 55222 dnat to 192.168.0.2:ssh comment "Port forwarding to server"
        }

        chain postrouting {
                type nat hook postrouting priority 100; policy accept;
                oifname "eno1" masquerade
        }
}

Dík za nasměrování.

---

---

Odpovědi

[NN]

Na ktere strane "za timto routerem" se nachazis? Roli by mohla hrat ta maskarada, jinak firewall vzhledem k forward politice pres sebe propousti vsechno:

chain forward {
   type filter hook forward priority 0; policy accept;
   ...

Na druhy konec neco dorazi, nebo vubec nic?

[Beetljuice]

No jsem normálně v LAN tj. za eno2. Na druhé straně je Mikrotik, který zahlásí že dorazil požadavek na pptp, ale pak to vypadne na timeout.

[NN]

Mozna chybejici moduly?

modprobe ip_gre
modprobe ip_nat_pptp

Muzes se take podivat do tcpdumup/wireshark co se presne deje spatne..

[Beetljuice]

Pokud ty moduly zavedu ručně, tak to nepomůže. Stávající výpis lsmod (gre):

ip_gre                 32768  0
ip_tunnel              24576  1 ip_gre
gre                    16384  1 ip_gre
nf_nat_proto_gre       16384  1 nf_nat_pptp
nf_conntrack_proto_gre    16384  1 nf_conntrack_pptp
nf_nat                 36864  4 nft_nat,nf_nat_ipv4,nf_nat_pptp,nf_nat_proto_gre
nf_conntrack          163840  9 nf_nat,nft_ct,nf_conntrack_pptp,nft_nat,nf_nat_ipv4,nf_nat_pptp,nf_conntrack_proto_gre,nft_masq,nft_masq_ipv4

Výpis lsmod (pptp) :

nf_nat_pptp            16384  0
nf_nat_proto_gre       16384  1 nf_nat_pptp
nf_conntrack_pptp      16384  1 nf_nat_pptp
nf_conntrack_proto_gre    16384  1 nf_conntrack_pptp
nf_nat                 36864  4 nft_nat,nf_nat_ipv4,nf_nat_pptp,nf_nat_proto_gre
nf_conntrack          163840  9 nf_nat,nft_ct,nf_conntrack_pptp,nft_nat,nf_nat_ipv4,nf_nat_pptp,nf_conntrack_proto_gre,nft_masq,nft_masq_ipv4

TCPDUMP ..... VPN_server_Mikrotik (Mikrotik kde běží VPNka) ... GW_site_NFTABLES (GW přes kterou se chci spojit s VPN na Mikrotiku.

08:49:13.546702 IP VPN_server_Mikrotik.1723 > GW_site_NFTABLES.55050: Flags [S.], seq 669374786, ack 2793065334, win 14480, options [mss 1460,sackOK,TS val 207580746 ecr 1375655355,nop,wscale 4], length 0
08:49:13.556248 IP VPN_server_Mikrotik.1723 > GW_site_NFTABLES.55050: Flags [.], ack 157, win 972, options [nop,nop,TS val 207580747 ecr 1375655365], length 0
08:49:13.571286 IP VPN_server_Mikrotik.1723 > GW_site_NFTABLES.55050: Flags [P.], seq 1:157, ack 157, win 972, options [nop,nop,TS val 207580748 ecr 1375655365], length 156: pptp CTRL_MSGTYPE=SCCRP PROTO_VER(1.0) RESULT_CODE(1) ERR_CODE(0) FRAME_CAP(S) BEARER_CAP() MAX_CHAN(0) FIRM_REV(1) HOSTNAME(GW1_brana) VENDOR(MikroTik)
08:49:14.619668 IP VPN_server_Mikrotik.1723 > GW_site_NFTABLES.55050: Flags [P.], seq 157:189, ack 325, win 1039, options [nop,nop,TS val 207580848 ecr 1375656365], length 32: pptp CTRL_MSGTYPE=OCRP CALL_ID(580) PEER_CALL_ID(65126) RESULT_CODE(1) ERR_CODE(0) CAUSE_CODE(0) CONN_SPEED(100000) RECV_WIN(100) PROC_DELAY(0) PHY_CHAN_ID(0)
08:49:14.630448 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 1, ack 1, length 39: LCP, Conf-Request (0x01), id 1, length 21
08:49:14.630538 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 2, ack 1, length 34: LCP, Conf-Reject (0x04), id 1, length 16
08:49:15.602883 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 3, ack 1, length 39: LCP, Conf-Request (0x01), id 2, length 21
08:49:17.076094 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 4, ack 1, length 39: LCP, Conf-Request (0x01), id 3, length 21
08:49:17.537044 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 5, ack 2, length 34: LCP, Conf-Reject (0x04), id 1, length 16
08:49:19.494988 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 6, ack 2, length 39: LCP, Conf-Request (0x01), id 4, length 21
08:49:20.540825 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 7, ack 3, length 34: LCP, Conf-Reject (0x04), id 1, length 16
08:49:22.715070 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 8, ack 3, length 39: LCP, Conf-Request (0x01), id 5, length 21
08:49:23.583833 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 9, ack 4, length 34: LCP, Conf-Reject (0x04), id 1, length 16
08:49:24.369874 IP VPN_server_Mikrotik.8082 > GW_site_NFTABLES.54818: Flags [.], ack 2755963210, win 377, options [nop,nop,TS val 2075348225 ecr 1375666176], length 0
08:49:24.369928 IP VPN_server_Mikrotik.8082 > GW_site_NFTABLES.54818: Flags [P.], seq 0:148, ack 1, win 377, options [nop,nop,TS val 2075348226 ecr 1375666176], length 148
08:49:26.547201 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 10, ack 5, length 34: LCP, Conf-Reject (0x04), id 1, length 16
08:49:27.977968 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 11, ack 5, length 39: LCP, Conf-Request (0x01), id 6, length 21
08:49:29.550292 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 12, ack 6, length 34: LCP, Conf-Reject (0x04), id 1, length 16
08:49:32.552634 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 13, ack 7, length 34: LCP, Conf-Reject (0x04), id 1, length 16
08:49:35.529001 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 14, ack 7, length 39: LCP, Conf-Request (0x01), id 7, length 21
08:49:35.555017 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 15, ack 8, length 34: LCP, Conf-Reject (0x04), id 1, length 16
08:49:38.561165 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 16, ack 9, length 34: LCP, Conf-Reject (0x04), id 1, length 16
08:49:41.559754 IP VPN_server_Mikrotik > GW_site_NFTABLES: GREv1, call 65126, seq 17, ack 10, length 34: LCP, Conf-Reject (0x04), id 1, length 16
08:49:44.586699 IP VPN_server_Mikrotik.1723 > GW_site_NFTABLES.55050: Flags [F.], seq 189, ack 342, win 1039, options [nop,nop,TS val 207583850 ecr 1375686393], length 0
08:49:54.391335 IP VPN_server_Mikrotik.8082 > GW_site_NFTABLES.54818: Flags [.], ack 236, win 386, options [nop,nop,TS val 2075378238 ecr 1375696188], length 0
08:49:54.391388 IP VPN_server_Mikrotik.8082 > GW_site_NFTABLES.54818: Flags [P.], seq 148:296, ack 236, win 386, options [nop,nop,TS val 2075378238 ecr 1375696188], length 148
08:50:24.401540 IP VPN_server_Mikrotik.8082 > GW_site_NFTABLES.54818: Flags [.], ack 471, win 394, options [nop,nop,TS val 2075408259 ecr 1375726209], length 0
08:50:24.401590 IP VPN_server_Mikrotik.8082 > GW_site_NFTABLES.54818: Flags [P.], seq 296:444, ack 471, win 394, options [nop,nop,TS val 2075408259 ecr 1375726209], length 148

Jen pro zajímavost. Na GW přes kterou se chci spojit jsem nastavil vlastní PPTP VPN server a normálně se do ní spojím a ve vnitřní síti jsem.

[NN]

OK, dve veci. Ten dump je urcite kompletni? Vidim jen komunikaci smerem od Mikrotiku. Zadruhe. Nemas novejsi kernel a nahodou v sysctl.conf:

net.netfilter.nf_conntrack_helper=0

[Beetljuice]

Tak ještě jeden výstup. Nevím jestli bude stačit.

tcpdump -i eno2 -n src host 192.168.2.84 and not dst port 58022 and not dst port 443
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eno2, link-type EN10MB (Ethernet), capture size 262144 bytes
11:14:47.729377 IP 192.168.2.84.55746 > 64.233.184.188.5228: Flags [P.], seq 3908147768:3908147794, ack 1708814053, win 353, options [nop,nop,TS val 1725771756 ecr 1361651298], length 26
11:14:47.751028 IP 192.168.2.84.55746 > 64.233.184.188.5228: Flags [.], ack 27, win 353, options [nop,nop,TS val 1725771778 ecr 1361694390], length 0
11:14:49.196386 IP 192.168.2.84.34914 > VPN_server_Mikrotik.1723: Flags [S], seq 3963576169, win 29200, options [mss 1460,sackOK,TS val 1384391023 ecr 0,nop,wscale 7], length 0
11:14:49.329280 IP 192.168.2.84.34914 > VPN_server_Mikrotik.1723: Flags [.], ack 3722899967, win 229, options [nop,nop,TS val 1384391156 ecr 208454312], length 0
11:14:49.330663 IP 192.168.2.84.34914 > VPN_server_Mikrotik.1723: Flags [P.], seq 0:156, ack 1, win 229, options [nop,nop,TS val 1384391157 ecr 208454312], length 156: pptp CTRL_MSGTYPE=SCCRQ PROTO_VER(1.0) FRAME_CAP(AS) BEARER_CAP(DA) MAX_CHAN(65535) FIRM_REV(1) HOSTNAME(local) VENDOR(cananian)
11:14:49.382114 IP 192.168.2.84.34914 > VPN_server_Mikrotik.1723: Flags [.], ack 157, win 237, options [nop,nop,TS val 1384391209 ecr 208454327], length 0
11:14:50.331167 IP 192.168.2.84.34914 > VPN_server_Mikrotik.1723: Flags [P.], seq 156:324, ack 157, win 237, options [nop,nop,TS val 1384392158 ecr 208454327], length 168: pptp CTRL_MSGTYPE=OCRQ CALL_ID(16644) CALL_SER_NUM(0) MIN_BPS(2400) MAX_BPS(10000000) BEARER_TYPE(Any) FRAME_TYPE(E) RECV_WIN(3) PROC_DELAY(0) PHONE_NO_LEN(0) PHONE_NO() SUB_ADDR()
11:14:50.387243 IP 192.168.2.84.34914 > VPN_server_Mikrotik.1723: Flags [.], ack 189, win 237, options [nop,nop,TS val 1384392214 ecr 208454426], length 0
11:14:50.387630 IP 192.168.2.84 > VPN_server_Mikrotik: GREv1, call 592, seq 1, length 36: LCP, Conf-Request (0x01), id 1, length 22
11:14:53.187257 IP 192.168.2.84 > VPN_server_Mikrotik: GREv1, call 592, seq 2, length 36: LCP, Conf-Request (0x01), id 1, length 22
11:14:56.190430 IP 192.168.2.84 > VPN_server_Mikrotik: GREv1, call 592, seq 3, length 36: LCP, Conf-Request (0x01), id 1, length 22
11:14:59.193610 IP 192.168.2.84 > VPN_server_Mikrotik: GREv1, call 592, seq 4, length 36: LCP, Conf-Request (0x01), id 1, length 22
11:14:59.745499 IP 192.168.2.84.54818 > VPN_server_Mikrotik.8082: Flags [P.], seq 2756031360:2756031555, ack 1076859817, win 1444, options [nop,nop,TS val 1384401572 ecr 2084053587], length 195
11:14:59.745551 IP 192.168.2.84.54818 > VPN_server_Mikrotik.8082: Flags [P.], seq 195:235, ack 1, win 1444, options [nop,nop,TS val 1384401572 ecr 2084053587], length 40
11:14:59.791124 IP 192.168.2.84.54818 > VPN_server_Mikrotik.8082: Flags [.], ack 149, win 1444, options [nop,nop,TS val 1384401618 ecr 2084083613], length 0
11:15:02.196499 IP 192.168.2.84 > VPN_server_Mikrotik: GREv1, call 592, seq 5, length 36: LCP, Conf-Request (0x01), id 1, length 22
11:15:02.567096 IP 192.168.2.84.50748 > 213.227.168.138.5938: Flags [.], ack 1811690470, win 3014, options [nop,nop,TS val 385135408 ecr 1613597226], length 0
11:15:05.199765 IP 192.168.2.84 > VPN_server_Mikrotik: GREv1, call 592, seq 6, length 36: LCP, Conf-Request (0x01), id 1, length 22
11:15:07.567510 IP 192.168.2.84.50748 > 213.227.168.138.5938: Flags [P.], seq 0:24, ack 1, win 3015, options [nop,nop,TS val 385140408 ecr 1613597226], length 24
11:15:08.201878 IP 192.168.2.84 > VPN_server_Mikrotik: GREv1, call 592, seq 7, length 36: LCP, Conf-Request (0x01), id 1, length 22
11:15:11.204971 IP 192.168.2.84 > VPN_server_Mikrotik: GREv1, call 592, seq 8, length 36: LCP, Conf-Request (0x01), id 1, length 22
11:15:14.208057 IP 192.168.2.84 > VPN_server_Mikrotik: GREv1, call 592, seq 9, length 36: LCP, Conf-Request (0x01), id 1, length 22
11:15:17.209695 IP 192.168.2.84 > VPN_server_Mikrotik: GREv1, call 592, seq 10, length 36: LCP, Conf-Request (0x01), id 1, length 22
11:15:20.237757 IP 192.168.2.84.34914 > VPN_server_Mikrotik.1723: Flags [P.], seq 324:340, ack 189, win 237, options [nop,nop,TS val 1384422064 ecr 208454426], length 16: pptp CTRL_MSGTYPE=CCRQ CALL_ID(16644)
11:15:20.237814 IP 192.168.2.84.34914 > VPN_server_Mikrotik.1723: Flags [F.], seq 340, ack 189, win 237, options [nop,nop,TS val 1384422065 ecr 208454426], length 0
11:15:20.263589 IP 192.168.2.84.34914 > VPN_server_Mikrotik.1723: Flags [.], ack 190, win 237, options [nop,nop,TS val 1384422090 ecr 208457416], length 0
11:15:26.231431 IP 192.168.2.84.53467 > 239.255.255.250.1900: UDP, length 172
11:15:27.232340 IP 192.168.2.84.53467 > 239.255.255.250.1900: UDP, length 172
11:15:28.233545 IP 192.168.2.84.53467 > 239.255.255.250.1900: UDP, length 172
11:15:29.233874 IP 192.168.2.84.53467 > 239.255.255.250.1900: UDP, length 172
11:15:29.791294 IP 192.168.2.84.54818 > VPN_server_Mikrotik.8082: Flags [P.], seq 235:430, ack 149, win 1444, options [nop,nop,TS val 1384431618 ecr 2084083613], length 195
11:15:29.791503 IP 192.168.2.84.54818 > VPN_server_Mikrotik.8082: Flags [P.], seq 430:470, ack 149, win 1444, options [nop,nop,TS val 1384431618 ecr 2084083613], length 40
11:15:29.813332 IP 192.168.2.84.54818 > VPN_server_Mikrotik.8082: Flags [.], ack 297, win 1444, options [nop,nop,TS val 1384431640 ecr 2084113657], length 0
11:15:34.749458 IP 192.168.2.84.55746 > 64.233.184.188.5228: Flags [.], ack 27, win 353, options [nop,nop,TS val 1725818776 ecr 1361694390], length 0
11:15:47.571144 IP 192.168.2.84.50748 > 213.227.168.138.5938: Flags [.], ack 139, win 3014, options [nop,nop,TS val 385180412 ecr 1613642229], length 0
11:15:52.571375 IP 192.168.2.84.50748 > 213.227.168.138.5938: Flags [P.], seq 24:48, ack 139, win 3015, options [nop,nop,TS val 385185412 ecr 1613642229], length 24
11:15:59.813747 IP 192.168.2.84.54818 > VPN_server_Mikrotik.8082: Flags [P.], seq 470:665, ack 297, win 1444, options [nop,nop,TS val 1384461640 ecr 2084113657], length 195
11:15:59.813803 IP 192.168.2.84.54818 > VPN_server_Mikrotik.8082: Flags [P.], seq 665:705, ack 297, win 1444, options [nop,nop,TS val 1384461641 ecr 2084113657], length 40
11:15:59.839286 IP 192.168.2.84.54818 > VPN_server_Mikrotik.8082: Flags [.], ack 445, win 1444, options [nop,nop,TS val 1384461666 ecr 2084143696], length 0
11:16:02.912957 IP 192.168.2.84.50748 > 213.227.168.138.5938: Flags [P.], seq 48:135, ack 139, win 3015, options [nop,nop,TS val 385195754 ecr 1613647303], length 87
11:16:02.936944 IP 192.168.2.84.50748 > 213.227.168.138.5938: Flags [.], ack 219, win 3015, options [nop,nop,TS val 385195778 ecr 1613657594], length 0

Nemas novejsi kernel a nahodou v sysctl.conf:

net.netfilter.nf_conntrack_helper=0

To tam nemám. Jádro mám 4.19. OS Debian 10

[NN]

Jen pro kontrolu:

cat /proc/sys/net/netfilter/nf_conntrack_helper

Dump pro obe IP zaroven na vnejsim inteface by mohl vypadat takto:

tcpdump -i eno1 host GW_site_NFTABLES and host VPN_server_Mikrotik and not dst port 58022 and not dst port 443

(analogicky na vnitrnim interface)

Podle:

LCP, Conf-Reject (0x04)

se jim nedari z nejakeho duvodu dohodnout,hm..

[Beetljuice]

Jen pro kontrolu:

cat /proc/sys/net/netfilter/nf_conntrack_helper

Tam je 0

[Beetljuice]

Přidal jsem tedy do sysctl.conf

net.netfilter.nf_conntrack_helper=1

A už to jede. Dík za pomoc.