Re: Routing

From: Kevin Buhr (buhr_at_telus.net)
Date: 09/06/03

  • Next message: Katipo: "Re: Suggestions for Modem" 
    To: "Mark Maas" <mark@menem.mine.nu>
Date: 05 Sep 2003 15:10:09 -0700

    "Mark Maas" <mark@menem.mine.nu> writes:
    >
    > When I use the MS pptp client and login to the pptpd server on this machine
    > i can ping all networks from the client, but cannot reach the internet.
    > Pinging google.nl results in the name beeing resolved to the ip adress of
    > google.nl but the request don't ever reach google.nl...

    Oh boy...

    We're getting to the stage where you may have to explain what it is
    you're trying to accomplish and give a lot more detail about your
    network topology.

    Why are you setting up this PPTP tunnel? Are you using it as an
    (expensive) way to connect a single machine on the intranet to the
    Internet through the ADSL (??) on the Linux box? Or are you
    eventually aiming to have a Windows machine out on the big, bad
    Internet connect to your intranet through the secure PPTP tunnel and
    have access to all intranet machines and also the rest of the
    Internet?

    Besides the ADSL on your Linux box, are there any other connections
    from the intranet to the Internet? Are other machines forwarding
    traffic through your Linux box right now? Or are they even able to
    connect to the Internet? Do you have a single external IP address or
    a block of them?

    In a nutshell, what's probably going wrong is that your Windows
    machine, whatever its original IP address was, reconfigured itself
    when you started up its PPTP client. It's now using its original IP
    address only to shuttle packets across the PPTP tunnel to and from the
    Linux box. For all other purposes, it's using the IP address assigned
    by the copy of "pppd" running on the Linux box (in the "remote IP
    address" line in your log). This is presumably some address on the
    192.168.8.x network, say 192.168.8.123.

    When you ping, say, the intranet gateway "192.168.8.4", from the
    Windows box, the packet goes out with source IP 192.168.8.123 and
    destination 192.168.8.4 across the PPTP tunnel. The Linux box
    forwards the packet out to the "eth0" interface where 192.168.8.4
    picks it up and generates a reply. The reply needs to go to
    192.168.8.123, and that's fine---the Linux box has configured itself
    to do proxy ARP for 192.168.8.123, so packets destined for that
    address go to your Linux box which recognizes that it's destined for
    the Windows machine and shuttles the packet back across the PPTP
    tunnel and you get your reply.

    Unfortunately, when you ping "google.nl", the packet goes out with
    source IP 192.168.8.123 across the PPTP tunnel. The Linux box
    forwards the packet out to the "eth1" interface (becaause its
    destination matches the default route), and it goes out to "google.nl"
    with an internal source IP. It either gets filtered at your or
    "google.nl"'s ISP perimeter (when the firewalls notice that its source
    IP is an unroutable address) or "google.nl" actually gets the packet,
    formulates a reply, and discovers it can't deliver it.

    If you really want things to work this way, you need to do source NAT
    on behalf of the Windows machine (or any other internal machine that's
    trying to send packets to the Internet through your Linux machine) so
    packets that hit the Internet can find there way back to your Linux
    machine through its public (ADSL) IP address. 

    -- 
Kevin <buhr@telus.net>
-- 
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
  • Next message: Katipo: "Re: Suggestions for Modem"

    Relevant Pages

    • Re: Routing problem
      ... Im am using PPTP because i cant reach mi office router from the internet. ... I have done this previously with a linux box in each side and it works fine ... So you need you home router to work as a pptp client to the linux box too. ...
      (microsoft.public.windowsxp.general)
    • RE: Missing web services configuration pane
      ... Please contact the ISP to confirm what the exact connection type is. ... If it's a VPN type, you should have the VPN server side address. ... 825763 How to configure Internet access in Windows Small Business Server ... 241252 VPN Tunnels - PPTP Protocol Packet Description and Use ...
      (microsoft.public.windows.server.sbs)
    • Re: [SLE] Roadwarriors, VPN or pptp?
      ... > I'm using PPTP for some of our remote users, but that's because I have Win ... > poptop on a SnapGear firewall, though I'm planning to start moving to ipsec ... pptp is not as secure of a vpn ... Also recommended for consideration is Astaro Secure Linux. ...
      (SuSE)
    • Re: Routing problem
      ... So you need you home router to work as a pptp client to the linux box too. ... The network at the office is not conected to internet, ...
      (microsoft.public.windowsxp.general)
    • Re: A great PPTP stumper!
      ... They are using PPTP connections over ... > connecting via cable Internet or DSL links 384K and under. ... When I try the PPTP connection to the same SBS Server(that the ... > RAS server and captured some logs of the user that are not having problems ...
      (microsoft.public.windows.server.networking)