1001 тема про VPN (ppp)

Проблемы установки, настройки и работы Правильной Операционной Системы

Модератор: terminus

Правила форума
Убедительная просьба юзать теги [cоde] при оформлении листингов.
Сообщения не оформленные должным образом имеют все шансы быть незамеченными.
votuanr
ефрейтор
Сообщения: 60
Зарегистрирован: 2006-10-31 14:15:36

1001 тема про VPN (ppp)

Непрочитанное сообщение votuanr » 2007-08-06 23:40:35

есть фря 6.2 (на работе), на ней открыт порт vpn. К ней из дома присоединяюсь нормально по vpn из winxp, все работает, все хорошо.

поставил дома шлюз на точно такой же фре (для домашней локалки) при этом перестало коннектиться на работу в офис. выглядит так: соединение открывается, пишет проверка логина/пароля, думает и выпадает в ошибку 619.


в логах на машине к которой коннектимся:

Код: Выделить всё

Aug  7 00:36:46 gw ppp[56573]: Phase: Using interface: tun1
Aug  7 00:36:46 gw ppp[56573]: Phase: deflink: Created in closed state
Aug  7 00:36:46 gw ppp[56573]: Phase: PPP Started (direct mode).
Aug  7 00:36:46 gw ppp[56573]: Phase: bundle: Establish
Aug  7 00:36:46 gw ppp[56573]: Phase: deflink: closed -> opening
Aug  7 00:36:46 gw ppp[56573]: Phase: deflink: Connected!
Aug  7 00:36:46 gw ppp[56573]: Phase: deflink: opening -> carrier
Aug  7 00:36:46 gw ppp[56573]: Phase: deflink: carrier -> lcp

<тут думает секунд 5>

Aug  7 00:37:02 gw ppp[56573]: Phase: deflink: Disconnected!
Aug  7 00:37:02 gw ppp[56573]: Phase: deflink: Connect time: 16 secs: 0 octets in, 295 octets out
Aug  7 00:37:02 gw ppp[56573]: Phase: deflink: 0 packets in, 5 packets out
Aug  7 00:37:02 gw ppp[56573]: Phase:  total 18 bytes/sec, peak 23 bytes/sec on Tue Aug  7 00:36:50 2007
Aug  7 00:37:02 gw ppp[56573]: Phase: deflink: lcp -> closed
Aug  7 00:37:02 gw ppp[56573]: Phase: bundle: Dead
Aug  7 00:37:02 gw ppp[56573]: Phase: PPP Terminated (normal).

firewall домашнго шлюза

gw# ipfw zero

Код: Выделить всё

Accounting cleared.
gw# ipfw show | less
00100  0    0 check-state
00503 15  895 allow log gre from any to any
01300 37 2476 divert 8668 ip from 10.0.0.0/8 to any out via lnc1
01400 45 2792 divert 8668 ip from any to 11.11.11.3 in via lnc1
01500 32 2816 allow log ip from any to any established
03800 33 1968 allow log ip from 11.11.11.3 to any out xmit lnc1
03802  0    0 allow log tcp from 10.10.10.1 to 10.0.0.0/8 out via lnc1
03900 96 5760 allow log icmp from any to any icmptypes 0,8,11
10000  1   48 allow log tcp from 10.10.10.2 to office_ip dst-port 1723
10001  0    0 allow ip from any to any
65000  0    0 deny log ip from any to any
65535  0    0 deny ip from any to any
ядро домашнего шлюза

gw# cat /usr/src/sys/i386/conf/alex2

Код: Выделить всё

#
# GENERIC -- Generic kernel configuration file for FreeBSD/i386
#
# For more information on this file, please read the handbook section on
# Kernel Configuration Files:
#
#    http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/kernelconfig-config.html
#
# The handbook is also available locally in /usr/share/doc/handbook
# if you've installed the doc distribution, otherwise always see the
# FreeBSD World Wide Web server (http://www.FreeBSD.org/) for the
# latest information.
#
# An exhaustive list of options and more detailed explanations of the
# device lines is also present in the ../../conf/NOTES and NOTES files.
# If you are in doubt as to the purpose or necessity of a line, check first
# in NOTES.
#
# $FreeBSD: src/sys/i386/conf/GENERIC,v 1.429.2.3.2.1 2005/10/28 19:22:41 jhb Exp $

machine         i386
cpu             I486_CPU
cpu             I586_CPU
cpu             I686_CPU
ident           ALEX2

# To statically compile in device wiring instead of /boot/device.hints
#hints          "GENERIC.hints"         # Default places to look for devices.

makeoptions     DEBUG=-g                # Build kernel with gdb(1) debug symbols

#options        SCHED_ULE               # ULE scheduler
options         SCHED_4BSD              # 4BSD scheduler
options         PREEMPTION              # Enable kernel thread preemption
options         INET                    # InterNETworking
#options        INET6                   # IPv6 communications protocols
options         FFS                     # Berkeley Fast Filesystem
options         SOFTUPDATES             # Enable FFS soft updates support
options         UFS_ACL                 # Support for access control lists
options         UFS_DIRHASH             # Improve performance on big directories
options         MD_ROOT                 # MD is a potential root device
#options        NFSCLIENT               # Network Filesystem Client
#options        NFSSERVER               # Network Filesystem Server
#options        NFS_ROOT                # NFS usable as /, requires NFSCLIENT
#options        MSDOSFS                 # MSDOS Filesystem
options         CD9660                  # ISO 9660 Filesystem
options         PROCFS                  # Process filesystem (requires PSEUDOFS)
options         PSEUDOFS                # Pseudo-filesystem framework
options         GEOM_GPT                # GUID Partition Tables.
options         COMPAT_43               # Compatible with BSD 4.3 [KEEP THIS!]
options         COMPAT_FREEBSD4         # Compatible with FreeBSD4
options         COMPAT_FREEBSD5         # Compatible with FreeBSD5
#options        SCSI_DELAY=5000         # Delay (in ms) before probing SCSI
options         KTRACE                  # ktrace(1) support
options         SYSVSHM                 # SYSV-style shared memory
options         SYSVMSG                 # SYSV-style message queues
options         SYSVSEM                 # SYSV-style semaphores
options         _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options         KBD_INSTALL_CDEV        # install a CDEV entry in /dev
options         AHC_REG_PRETTY_PRINT    # Print register bitfields in debug
                                        # output.  Adds ~128k to driver.
options         AHD_REG_PRETTY_PRINT    # Print register bitfields in debug
                                        # output.  Adds ~215k to driver.
options         ADAPTIVE_GIANT          # Giant mutex is adaptive.

device          apic                    # I/O APIC

# Bus support.
device          eisa
device          pci

# Floppy drives
device          fdc

# ATA and ATAPI devices
device          ata
device          atadisk         # ATA disk drives
#device         ataraid         # ATA RAID drives
device          atapicd         # ATAPI CDROM drives
#device         atapifd         # ATAPI floppy drives
#device         atapist         # ATAPI tape drives
options         ATA_STATIC_ID   # Static device numbering

# SCSI Controllers
#device         ahb             # EISA AHA1742 family
#device         ahc             # AHA2940 and onboard AIC7xxx devices
#device         ahd             # AHA39320/29320 and onboard AIC79xx devices
#device         amd             # AMD 53C974 (Tekram DC-390(T))
#device         isp             # Qlogic family
#device         ispfw           # Firmware for QLogic HBAs- normally a module
#device         mpt             # LSI-Logic MPT-Fusion
#device         ncr             # NCR/Symbios Logic
#device         sym             # NCR/Symbios Logic (newer chipsets + those of `ncr')
#device         trm             # Tekram DC395U/UW/F DC315U adapters

#device         adv             # Advansys SCSI adapters
#device         adw             # Advansys wide SCSI adapters
#device         aha             # Adaptec 154x SCSI adapters
#device         aic             # Adaptec 15[012]x SCSI adapters, AIC-6[23]60.
#device         bt              # Buslogic/Mylex MultiMaster SCSI adapters#

#device         ncv             # NCR 53C500
#device         nsp             # Workbit Ninja SCSI-3
#device         stg             # TMC 18C30/18C50

# SCSI peripherals
#device         scbus           # SCSI bus (required for SCSI)
#device         ch              # SCSI media changers
#device         da              # Direct Access (disks)
#device         sa              # Sequential Access (tape etc)
#device         cd              # CD
#device         pass            # Passthrough device (direct SCSI access)
#device         ses             # SCSI Environmental Services (and SAF-TE)

# RAID controllers interfaced to the SCSI subsystem
#device         amr             # AMI MegaRAID
#device         arcmsr          # Areca SATA II RAID
#device         asr             # DPT SmartRAID V, VI and Adaptec SCSI RAID
#device         ciss            # Compaq Smart RAID 5*
#device         dpt             # DPT Smartcache III, IV - See NOTES for options
#device         hptmv           # Highpoint RocketRAID 182x
#device         iir             # Intel Integrated RAID
#device         ips             # IBM (Adaptec) ServeRAID
#device         mly             # Mylex AcceleRAID/eXtremeRAID
#device         twa             # 3ware 9000 series PATA/SATA RAID

# RAID controllers
#device         aac             # Adaptec FSA RAID
#device         aacp            # SCSI passthrough for aac (requires CAM)
#device         ida             # Compaq Smart RAID
#device         mlx             # Mylex DAC960 family
#device         pst             # Promise Supertrak SX6000
#device         twe             # 3ware ATA RAID

# atkbdc0 controls both the keyboard and the PS/2 mouse
device          atkbdc          # AT keyboard controller
device          atkbd           # AT keyboard
device          psm             # PS/2 mouse

device          vga             # VGA video card driver

device          splash          # Splash screen and screen saver support

# syscons is the default console driver, resembling an SCO console
device          sc

# Enable this for the pcvt (VT220 compatible) console driver
#device         vt
#options        XSERVER         # support for X server on a vt console
#options        FAT_CURSOR      # start with block cursor

device          agp             # support several AGP chipsets

# Power management support (see NOTES for more options)
#device         apm
# Add suspend/resume support for the i8254.
device          pmtimer

# PCCARD (PCMCIA) support
# PCMCIA and cardbus bridge support
#device         cbb             # cardbus (yenta) bridge
#device         pccard          # PC Card (16-bit) bus
#device         cardbus         # CardBus (32-bit) bus

# Serial (COM) ports
device          sio             # 8250, 16[45]50 based serial ports

# Parallel port
#device         ppc
#device         ppbus           # Parallel port bus (required)
#device         lpt             # Printer
#device         plip            # TCP/IP over parallel
#device         ppi             # Parallel port interface device
#device         vpo             # Requires scbus and da

# If you've got a "dumb" serial or parallel PCI card that is
# supported by the puc(4) glue driver, uncomment the following
# line to enable it (connects to the sio and/or ppc drivers):
#device         puc

# PCI Ethernet NICs.
#device         de              # DEC/Intel DC21x4x (``Tulip'')
#device         em              # Intel PRO/1000 adapter Gigabit Ethernet Card
#device         ixgb            # Intel PRO/10GbE Ethernet Card
#device         txp             # 3Com 3cR990 (``Typhoon'')
#device         vx              # 3Com 3c590, 3c595 (``Vortex'')

# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device          miibus          # MII bus support
#device         bfe             # Broadcom BCM440x 10/100 Ethernet
#device         bge             # Broadcom BCM570xx Gigabit Ethernet
device          dc              # DEC/Intel 21143 and various workalikes
#device         fxp             # Intel EtherExpress PRO/100B (82557, 82558)
#device         lge             # Level 1 LXT1001 gigabit Ethernet
#device         nge             # NatSemi DP83820 gigabit Ethernet
#device         nve             # nVidia nForce MCP on-board Ethernet Networking
#device         pcn             # AMD Am79C97x PCI 10/100(precedence over 'lnc')
#device         re              # RealTek 8139C+/8169/8169S/8110S
#device         rl              # RealTek 8129/8139
#device         sf              # Adaptec AIC-6915 (``Starfire'')
#device         sis             # Silicon Integrated Systems SiS 900/SiS 7016
#device         sk              # SysKonnect SK-984x & SK-982x gigabit Ethernet
#device         ste             # Sundance ST201 (D-Link DFE-550TX)
#device         ti              # Alteon Networks Tigon I/II gigabit Ethernet
#device         tl              # Texas Instruments ThunderLAN
#device         tx              # SMC EtherPower II (83c170 ``EPIC'')
#device         vge             # VIA VT612x gigabit Ethernet
#device         vr              # VIA Rhine, Rhine II
#device         wb              # Winbond W89C840F
#device         xl              # 3Com 3c90x (``Boomerang'', ``Cyclone'')

# ISA Ethernet NICs.  pccard NICs included.
#device         cs              # Crystal Semiconductor CS89x0 NIC
# 'device ed' requires 'device miibus'
#device         ed              # NE[12]000, SMC Ultra, 3c503, DS8390 cards
#device         ex              # Intel EtherExpress Pro/10 and Pro/10+
#device         ep              # Etherlink III based cards
#device         fe              # Fujitsu MB8696x based cards
#device         ie              # EtherExpress 8/16, 3C507, StarLAN 10 etc.
device         lnc             # NE2100, NE32-VL Lance Ethernet cards
#device         sn              # SMC's 9000 series of Ethernet chips
#device         xe              # Xircom pccard Ethernet#

# ISA devices that use the old ISA shims
#device         le

# Wireless NIC cards
#device         wlan            # 802.11 support
#device         an              # Aironet 4500/4800 802.11 wireless NICs.
#device         awi             # BayStack 660 and others
#device         ral             # Ralink Technology RT2500 wireless NICs.
#device         wi              # WaveLAN/Intersil/Symbol 802.11 wireless NICs.
#device         wl              # Older non 802.11 Wavelan wireless NIC.

# Pseudo devices.
device          loop            # Network loopback
device          random          # Entropy device
device          ether           # Ethernet support
#device         sl              # Kernel SLIP
device          ppp             # Kernel PPP
device          tun             # Packet tunnel.
device          pty             # Pseudo-ttys (telnet etc)
device          md              # Memory "disks"
device          gif             # IPv6 and IPv4 tunneling
#device         faith           # IPv6-to-IPv4 relaying (translation)

# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
# Note that 'bpf' is required for DHCP.
device          bpf             # Berkeley packet filter

# USB support
#device         uhci            # UHCI PCI->USB interface
#device         ohci            # OHCI PCI->USB interface
#device         ehci            # EHCI PCI->USB interface (USB 2.0)
#device         usb             # USB Bus (required)
#device         udbp            # USB Double Bulk Pipe devices
#device         ugen            # Generic
#device         uhid            # "Human Interface Devices"
#device         ukbd            # Keyboard
#device         ulpt            # Printer
#device         umass           # Disks/Mass storage - Requires scbus and da
#device         ums             # Mouse
#device         ural            # Ralink Technology RT2500USB wireless NICs
#device         urio            # Diamond Rio 500 MP3 player
#device         uscanner        # Scanners
# USB Ethernet, requires miibus
#device         aue             # ADMtek USB Ethernet
#device         axe             # ASIX Electronics USB Ethernet
#device         cdce            # Generic USB over Ethernet
#device         cue             # CATC USB Ethernet
#device         kue             # Kawasaki LSI USB Ethernet
#device         rue             # RealTek RTL8150 USB Ethernet#

# FireWire support
#device         firewire        # FireWire bus code
#device         sbp             # SCSI over FireWire (Requires scbus and da)
#device         fwe             # Ethernet over FireWire (non-standard!)

options IPFIREWALL
options IPFILTER
options IPFILTER_LOG
options IPFIREWALL_VERBOSE
options TCP_DROP_SYNFIN


options         IPDIVERT
options         DUMMYNET
options         IPFIREWALL_FORWARD
options         NETGRAPH
options         NETGRAPH_BPF
options         NETGRAPH_IFACE
options         NETGRAPH_KSOCKET
options         NETGRAPH_MPPC_ENCRYPTION
options         NETGRAPH_PPP
options         NETGRAPH_PPTPGRE
options         NETGRAPH_SOCKET
options         NETGRAPH_TCPMSS
options         NETGRAPH_VJC

еще раз повторюсь, что напрямую из дома (без домашнего шлюза) в офис все соединяется на ура...

день убил, куда копать? :twisted:

Хостинговая компания Host-Food.ru
Хостинг HostFood.ru
 

Услуги хостинговой компании Host-Food.ru

Хостинг HostFood.ru

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2460 рублей (8 CPU, 8Gb RAM, 2x500Gb HDD, RAID 3ware 9750):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

Аватара пользователя
Alex Keda
стреляли...
Сообщения: 35092
Зарегистрирован: 2004-10-18 14:25:19
Откуда: Made in USSR
Контактная информация:

Re: 1001 тема про VPN (ppp)

Непрочитанное сообщение Alex Keda » 2007-08-07 8:08:15

Код: Выделить всё

00503 15  895 allow log gre from any to any
01300 37 2476 divert 8668 ip from 10.0.0.0/8 to any out via lnc1
01400 45 2792 divert 8668 ip from any to 11.11.11.3 in via lnc1
перенеси с вмвари на нормальную машину и первое праивло сделай последним (в листинге)
Убей их всех! Бог потом рассортирует...

votuanr
ефрейтор
Сообщения: 60
Зарегистрирован: 2006-10-31 14:15:36

Re: 1001 тема про VPN (ppp)

Непрочитанное сообщение votuanr » 2007-08-07 9:28:55

lissyara писал(а):

Код: Выделить всё

00503 15  895 allow log gre from any to any
01300 37 2476 divert 8668 ip from 10.0.0.0/8 to any out via lnc1
01400 45 2792 divert 8668 ip from any to 11.11.11.3 in via lnc1
перенеси с вмвари на нормальную машину и первое праивло сделай последним (в листинге)

на vmware ( :shock: ) собрал тестовый полигон, чтобы дома погонять, но на практике ситуация аналогичная (на физических машинах). правила поменяю, попробую.

votuanr
ефрейтор
Сообщения: 60
Зарегистрирован: 2006-10-31 14:15:36

Re: 1001 тема про VPN (ppp)

Непрочитанное сообщение votuanr » 2007-08-07 10:43:02

блин, Лис, заработало, ёмаё. :P

а про vmwarю как узнал? по lnc интерфейсам и левым адресам?

Аватара пользователя
Alex Keda
стреляли...
Сообщения: 35092
Зарегистрирован: 2004-10-18 14:25:19
Откуда: Made in USSR
Контактная информация:

Re: 1001 тема про VPN (ppp)

Непрочитанное сообщение Alex Keda » 2007-08-07 13:31:35

по интерфейсам разумеется...
я такой карточки живьём в жизни не видел - хотя есть девайс с таким названием, но настока древний и редкий....
Убей их всех! Бог потом рассортирует...