[ipfw natd bluetoth panu] FreeBSD Win7

[ygor]

Вообщем происходит странная непонятная мне мистика.
В кратце есть ноутбук с б-гмерской win7 на борту с bluetooth, который надо с помощью оного приконектить к интернету.
Шлюз комп с FreeBSD + блютуз.
конектим:

Код: Выделить всё

ifconfig tap0 create 192.168.2.1 netmask 255.255.255.0
btpand -a mbook -d ubt0 -s panu -i tap0

Задаём на винмашине адрес 192.168.2.2. Пингуем, пингуеца всё вроде бы ок.

Делаем nat:

Код: Выделить всё

14:09 ygor /home/ygor $ cat /etc/firewall/fwrules
 # Firewall rules
 # Written by Marc Silver (marcs@draenor.org)
 # http://draenor.org/ipfw
 # Freely distributable


 # Define the firewall command (as in /etc/rc.firewall) for easy
 # reference.  Helps to make it easier to read.
 fwcmd="/sbin/ipfw"

 # Force a flushing of the current rules before we reload.
 $fwcmd -f flush

 # Divert all packets through the tunnel interface.
 $fwcmd add divert natd all from any to any via tun0
 $fwcmd add divert natd all from 192.168.2.2 to any out via tun0
  $fwcmd add divert natd all from any to 10.0.0.0/8 in via tun0


 # Allow all data from my network card and localhost.  Make sure you
 # change your network card (mine was fxp0) before you reboot.  :)
 $fwcmd add allow ip from any to any via lo0
 $fwcmd add allow all from any to any via tap0
 $fwcmd add allow ip from any to any via fxp0
 $fwcmd add allow ip from any to any via vboxnet0

 # Allow all connections that I initiate.
 $fwcmd add allow tcp from any to any out xmit tun0 setup

 # Once connections are made, allow them to stay open.
 $fwcmd add allow tcp from any to any via tun0 established

 
 # This sends a RESET to all ident packets.
 $fwcmd add reset log tcp from any to any 113 in recv tun0

 # Allow outgoing DNS queries ONLY to the specified servers.
 $fwcmd add allow udp from any to any 53 out xmit tun0

 # Allow them back in with the answers...  :)
 $fwcmd add allow udp from any 53 to any in recv tun0

 # Пробуем разрешить ntpdate на 123 порту udp
 $fwcmd add allow udp from any to any 123 out xmit tun0
 $fwcmd add allow udp from any 123 to any in recv tun0


 # Allow ICMP (for ping and traceroute to work).  You may wish to
 # disallow this, but I feel it suits my needs to keep them in.
 $fwcmd add allow icmp from any to any

  $fwcmd add 65435 deny log ip from any to any

Конфиг ядра такой:

Код: Выделить всё

# Добавлено для включения фаера ipfw
options         IPFIREWALL
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_VERBOSE_LIMIT=100
options         IPDIVERT
options         DUMMYNET

Опции в rc.conf такие:

Код: Выделить всё

natd_enable="YES"
natd_flags="-dynamic"
natd_interface="tun0"
gateway_enable="YES"

В итоге на виндовой машине всё резолвица, а tcp не ходят. У кого какие идеи, с чем это мб связано?

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[Electronik]

покажите

Код: Выделить всё

ipfw show

и посмотрите tcpdump'ом

[ygor]

Целый день мутного шаманства с конфигом ipwf привёл вот к чему:

Код: Выделить всё

0:43 root /root # ipfw show
00100    184    14708 allow ip from any to any via lo0
00200   3210   924480 allow ip from any to any via tap0
00300      0        0 allow tcp from any to any in via tap0
00400      0        0 allow tcp from any to any out via tap0
00500      0        0 allow ip from any to any via fxp0
00600      0        0 allow ip from any to any via vboxnet0
00700 112086 14653778 divert 8668 ip from any to any via tun0
00800    440    26164 allow tcp from any to any out xmit tun0 setup
00900      0        0 allow tcp from any to any out xmit tap0 setup
01000  52028  9490114 allow tcp from any to any via tun0 established
01100      0        0 allow tcp from any to any via tap0 established
01200      0        0 reset log logamount 100 tcp from any to any dst-port 113 in recv tun0
01300   1674   109770 allow udp from any to any dst-port 53 out xmit tun0
01400   1665   300609 allow udp from any 53 to any in recv tun0
01500      0        0 allow udp from any to any dst-port 123 out xmit tun0
01600      0        0 allow udp from any 123 to any in recv tun0
01700  56273  4726316 allow icmp from any to any
65435      6      805 deny log logamount 100 ip from any to any
65535     38     7468 deny ip from any to any
0:44 root /root #

Попытка сказать на вендовой машине wget httl://192.168.2.1:631 (там висит купс, и с этого интерфейса можно зайти на него по сети)
приводит к следующему:

Код: Выделить всё

0:47 root /root # tcpdump -i tap0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 96 bytes
00:47:52.534261 IP 192.168.2.2.49378 > 192.168.2.1.ipp: Flags [S], seq 463223769, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
00:47:52.534436 IP 192.168.2.1.ipp > 192.168.2.2.49378: Flags [S.], seq 3325613924, ack 463223770, win 65535, options [mss 1460,nop,wscale 3,sackOK,eol], length 0
00:47:52.671311 IP 192.168.2.2.49378 > 192.168.2.1.ipp: Flags [.], ack 1, win 4380, length 0
00:47:52.675280 IP 192.168.2.2.49378 > 192.168.2.1.ipp: Flags [P.], ack 1, win 4380, length 103
00:47:52.774904 IP 192.168.2.1.ipp > 192.168.2.2.49378: Flags [.], ack 104, win 8199, length 0
00:47:52.853307 IP 192.168.2.1.ipp > 192.168.2.2.49378: Flags [P.], ack 104, win 8212, length 255
00:47:53.166678 IP 192.168.2.2.49378 > 192.168.2.1.ipp: Flags [.], ack 256, win 4316, length 0
00:47:53.166934 IP 192.168.2.1.ipp > 192.168.2.2.49378: Flags [.], ack 104, win 8212, length 1460
00:47:54.308830 IP 192.168.2.1.ipp > 192.168.2.2.49378: Flags [.], ack 104, win 8212, length 1460
00:47:56.392766 IP 192.168.2.1.ipp > 192.168.2.2.49378: Flags [.], ack 104, win 8212, length 1460
00:47:58.132192 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 159
00:47:58.132353 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 159
00:48:00.360628 IP 192.168.2.1.ipp > 192.168.2.2.49378: Flags [.], ack 104, win 8212, length 1460
00:48:08.096374 IP 192.168.2.1.ipp > 192.168.2.2.49378: Flags [.], ack 104, win 8212, length 1460
00:48:19.134006 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 146
00:48:19.134090 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 146
00:48:23.367836 IP 192.168.2.1.ipp > 192.168.2.2.49378: Flags [.], ack 104, win 8212, length 1460
00:48:28.135853 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 159
00:48:28.136007 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 159
00:48:46.159075 IP 192.168.2.1.ipp > 192.168.2.2.49378: Flags [.], ack 104, win 8212, length 1460
00:48:50.137998 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 146
00:48:50.138083 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 146
00:48:59.401440 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 159
00:48:59.401584 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 159
00:49:21.402977 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 146
00:49:21.403059 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 146
00:49:30.404718 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 159
00:49:30.404803 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 159
00:49:31.541623 IP 192.168.2.1.ipp > 192.168.2.2.49378: Flags [.], ack 104, win 8212, length 1460
00:49:52.405996 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 146
00:49:52.406082 IP 192.168.2.1.ipp > 192.168.2.255.ipp: UDP, length 146

Ну и естественно wget ничего не скачивает.

Попытка открыть http://www.ru на винде:

Код: Выделить всё

0:51 root /root # tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type NULL (BSD loopback), capture size 96 bytes
00:51:48.025697 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26387, length 64
00:51:48.262676 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26387, length 64
00:51:48.955998 IP 10.210.97.75.61528 > 10.52.129.36.domain: 8791+ PTR? 8.8.8.8.in-addr.arpa. (38)
00:51:49.026155 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26388, length 64
00:51:49.092534 IP 10.52.129.36.domain > 10.210.97.75.61528: 8791 1/2/2 PTR[|domain]
00:51:49.093326 IP 10.210.97.75.13885 > 10.52.129.36.domain: 8792+ PTR? 75.97.210.10.in-addr.arpa. (43)
00:51:49.252503 IP 10.52.129.36.domain > 10.210.97.75.13885: 8792 NXDomain* 0/1/0 (120)
00:51:49.262506 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26388, length 64
00:51:50.027123 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26389, length 64
00:51:50.252463 IP 10.210.97.75.51877 > 10.52.129.36.domain: 8793+ PTR? 36.129.52.10.in-addr.arpa. (43)
00:51:50.272340 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26389, length 64
00:51:50.362317 IP 10.52.129.36.domain > 10.210.97.75.51877: 8793 NXDomain* 0/1/0 (120)
00:51:51.028109 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26390, length 64
00:51:51.262158 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26390, length 64
00:51:52.029078 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26391, length 64
00:51:52.262054 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26391, length 64
00:51:53.031071 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26392, length 64
00:51:53.262921 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26392, length 64
00:51:54.033055 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26393, length 64
00:51:54.272755 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26393, length 64
00:51:54.433124 IP 10.210.97.75.50379 > google-public-dns-a.google.com.domain: 22727+ A? www.ru. (24)
00:51:54.632670 IP google-public-dns-a.google.com.domain > 10.210.97.75.50379: 22727 1/0/0 A 194.87.0.50 (40)
00:51:54.646035 IP 10.210.97.75.49379 > www.ru.http: Flags [S], seq 463546055, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
00:51:54.822664 IP www.ru.http > 10.210.97.75.49379: Flags [S.], seq 4228446237, ack 463546056, win 5840, options [mss 1448,nop,nop,sackOK,nop,wscale 7], length 0
00:51:54.834078 IP 10.210.97.75.49379 > www.ru.http: Flags [.], ack 1, win 4344, length 0
00:51:54.846005 IP 10.210.97.75.49379 > www.ru.http: Flags [P.], ack 1, win 4344, length 384
00:51:55.038485 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26394, length 64
00:51:55.172600 IP www.ru.http > 10.210.97.75.49379: Flags [.], ack 385, win 54, length 0
00:51:55.195620 IP www.ru.http > 10.210.97.75.49379: Flags [.], ack 385, win 54, length 1448
00:51:55.214622 IP www.ru.http > 10.210.97.75.49379: Flags [.], ack 385, win 54, length 1448
00:51:55.263585 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26394, length 64
00:51:55.362636 IP 10.210.97.75.35815 > 10.52.129.36.domain: 8794+ PTR? 50.0.87.194.in-addr.arpa. (42)
00:51:55.482561 IP 10.52.129.36.domain > 10.210.97.75.35815: 8794 1/3/3 PTR www.ru. (194)
00:51:56.042716 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26395, length 64
00:51:56.292425 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26395, length 64
00:51:56.856866 IP 10.210.97.75.10571 > tortois.yandex.net.5223: Flags [P.], ack 906950200, win 65535, length 37
00:51:56.973305 IP tortois.yandex.net.5223 > 10.210.97.75.10571: Flags [.], ack 37, win 63712, length 0
00:51:57.043973 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26396, length 64
00:51:57.272227 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26396, length 64
00:51:57.483586 IP 10.210.97.75.17597 > 10.52.129.36.domain: 8795+ PTR? 177.57.88.77.in-addr.arpa. (43)
00:51:57.632223 IP 10.52.129.36.domain > 10.210.97.75.17597: 8795 1/2/3 PTR[|domain]
00:51:58.045247 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26397, length 64
00:51:58.195197 IP www.ru.http > 10.210.97.75.49379: Flags [.], ack 385, win 54, length 1448
00:51:58.263302 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26397, length 64
00:51:59.048464 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26398, length 64
00:51:59.263070 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26398, length 64
00:52:00.053596 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26399, length 64
00:52:00.262807 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26399, length 64
00:52:01.058167 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26400, length 64
00:52:01.262589 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26400, length 64
00:52:02.062883 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26401, length 64
00:52:02.320879 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26401, length 64
00:52:02.943233 IP tortois.yandex.net.5223 > 10.210.97.75.10571: Flags [P.], ack 37, win 63712, length 330
00:52:03.042703 IP 10.210.97.75.10571 > tortois.yandex.net.5223: Flags [.], ack 331, win 65535, length 0
00:52:03.065699 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26402, length 64
00:52:03.133191 IP tortois.yandex.net.5223 > 10.210.97.75.10571: Flags [P.], ack 37, win 63712, length 282
00:52:03.232699 IP 10.210.97.75.10571 > tortois.yandex.net.5223: Flags [.], ack 613, win 65535, length 0
00:52:03.312167 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26402, length 64
00:52:04.066674 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26403, length 64
00:52:04.194039 IP www.ru.http > 10.210.97.75.49379: Flags [.], ack 385, win 54, length 1448
00:52:04.313051 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26403, length 64
00:52:05.067649 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26404, length 64
00:52:05.302832 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26404, length 64
00:52:05.969044 IP 10.210.97.75.40752 > 10.52.129.36.domain: 24201+ PTR? 75.97.210.10.in-addr.arpa. (43)
00:52:06.068600 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26405, length 64
00:52:06.142693 IP 10.52.129.36.domain > 10.210.97.75.40752: 24201 NXDomain* 0/1/0 (120)
00:52:06.143448 IP 10.210.97.75.58736 > 10.52.129.36.domain: 24202+ PTR? 1.2.168.192.in-addr.arpa. (42)
00:52:06.282670 IP 10.52.129.36.domain > 10.210.97.75.58736: 24202 NXDomain* 0/1/0 (119)
00:52:06.302653 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26405, length 64
00:52:07.069578 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26406, length 64
00:52:07.302540 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26406, length 64
00:52:08.071562 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26407, length 64
00:52:08.302366 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26407, length 64
00:52:09.073556 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26408, length 64
00:52:09.303197 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26408, length 64
00:52:10.075568 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26409, length 64
00:52:10.303065 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26409, length 64
00:52:11.077529 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26410, length 64
00:52:11.302905 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26410, length 64
00:52:12.078539 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26411, length 64
00:52:12.312786 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26411, length 64
00:52:13.079493 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26412, length 64
00:52:13.312554 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26412, length 64
00:52:14.080465 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26413, length 64
00:52:14.304514 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26413, length 64
00:52:15.081614 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26414, length 64
00:52:15.312330 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26414, length 64
00:52:15.893223 IP tortois.yandex.net.5223 > 10.210.97.75.10571: Flags [P.], ack 37, win 63712, length 330
00:52:15.993425 IP 10.210.97.75.10571 > tortois.yandex.net.5223: Flags [.], ack 943, win 65535, length 0
00:52:16.083408 IP 10.210.97.75 > google-public-dns-a.google.com: ICMP echo request, id 55310, seq 26415, length 64
00:52:16.195246 IP www.ru.http > 10.210.97.75.49379: Flags [.], ack 385, win 54, length 1448
00:52:16.303101 IP google-public-dns-a.google.com > 10.210.97.75: ICMP echo reply, id 55310, seq 26415, length 64
^C
92 packets captured
94 packets received by filter
0 packets dropped by kernel
0:52 root /root #

tun0 наружний интерфейс.
С вендовой машины хосты резолвятся.

[ygor]

В конечном итоге почти решил проблему.

Проблема была в размере пакета: пришлось выставить на интерфейсе tap0 mtu 600.
Мб это ограничение как то связанно с размером bluetooth кадра?

Почти, потому что при работе браузера на винде есть ощущение, что большая часть пакетов теряется в канале. Хотя пинг на виндовой машине, говорит что это не так.

[ygor]

Да было бы совсем неплохо оформить pr, весь вопрос в том, как это сделать.

[ygor]

Почти, потому что при работе браузера на винде есть ощущение, что большая часть пакетов теряется в канале. Хотя пинг на виндовой машине, говорит что это не так.

Сменил mtu на винде на 600, все стало OK.
За методику смены mtu на винде, хочется взять и уебать, взять и уебать.