DaemonForums  

Go Back   DaemonForums > OpenBSD > OpenBSD General

OpenBSD General Other questions regarding OpenBSD which do not fit in any of the categories below.

Reply
 
Thread Tools Display Modes
  #1   (View Single Post)  
Old 2nd July 2009
Tritone Tritone is offline
New User
 
Join Date: Jul 2009
Posts: 2
Thanked 0 Times in 0 Posts
Default OpenBSD, vpnc and packets forwarding problems

Hi,
I am building a simple router based on OpenBSD 4.5 installed on VMware Server 2.0.1 which should allow me to connect all my network hosts to a VPN.

Because the VPN is a Cisco VPN I am using vpnc 0.5.3 (which I compiled with OpenSSL support).

The connection to the VPN starts correctly and I receive all the networks present on the Cisco aggregator.

From this point I have several problems:

1) I can not ping the interface tun0 (from OpenBSD), no way, also configuring PF to pass in all and out all.

2) I can not ping hosts in the VPN (from OpenBSD and all clients on my network)

I premise that i have enabled net.inet.ip.forwarding (so set it to 1) and ATM there is no blocking rules on pf.

here is my pf.conf file

Code:
set skip on lo

EXT = "tun0"   # This is the vpnc connection
INT = "vic0"    # This is the VMware network card which is BRIDGED on the host network card
LAN_clients = "192.168.0.0/24"

nat on $EXT from $LAN_clients to any -> ($EXT)

pass in all
pass out all
There is NO firewall setted up on the VMWare Host side.

Does someone knows what wrong?

Thank you for your help
Reply With Quote
  #2   (View Single Post)  
Old 2nd July 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 3,683
Thanked 214 Times in 189 Posts
Default

Because security/vpnc is a userland implementation of IPSec, you must disable either one or two sysctls, per the installation message:
Code:
In order for vpnc to actually get any received IPsec packet, you have
to disable ESP in your kernel like this:

    sysctl net.inet.esp.enable=0

If you are behind a NAT gateway, you have to disable UDP encapsulation
as well:

    sysctl net.inet.esp.udpencap=0
This port has been discussed on the ports@ mailing list several times over the last five years:

http://marc.info/?l=openbsd-ports&w=2&r=1&s=vpnc&q=b
Reply With Quote
  #3   (View Single Post)  
Old 2nd July 2009
Tritone Tritone is offline
New User
 
Join Date: Jul 2009
Posts: 2
Thanked 0 Times in 0 Posts
Default

Thank you for your help jggimi,
I already did this and from the sysctl.conf file (so from the boot), it was my fault to not tell it on my previous post, sorry.

If I do ifvonfig after vpnc get connected I see that:

Code:
tun0: flags=51<UP,POINTTOPOINT,RUNNING> mtu 1412
          priority: 0
          groups: tun
          inet 192.168.20.75 --> 192.168.20.75 netmask 0xffffffff
And that's all, no packets received or transmitted (apparently), I also launched vpnc with Debug 99 option and I saw it is parsing all the packets that comes from the Cisco aggregator.

All sounds good, but once connected... nothing works
Reply With Quote
  #4   (View Single Post)  
Old 2nd July 2009
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 3,683
Thanked 214 Times in 189 Posts
Default

I've never used vpnc, sorry. I'm not sure if anyone *else* here has. If you don't get help within the next day or two, consider posting your question to ports@.

For that mailing list, or here, you should consider posting more information: your vpnc.conf, with any private information redacted, as well as the contents of your complete NIC configuration ($ ifconfig) and the contents of your routing table ($ route -n show -inet). Symptoms without configuration information is not necessarily helpful.

From what you've posted, all I can see is a tun0 device, configured in point-to-point mode, with both ends of the connection having the same IP address. That doesn't seem correct to me, but a quick Google of vpnc howto's shows thats the way vpnc is intended to use the tun(4) device.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
x11 forwarding over ssh not working kasse OpenBSD General 14 23rd December 2008 02:21 PM
port forwarding ikevmowe OpenBSD Security 13 21st November 2008 06:03 PM
VNC port forwarding help revzalot OpenBSD Security 3 10th September 2008 06:59 AM
Redirecting ESP packets ales OpenBSD Security 2 15th June 2008 09:13 PM
IPF: Packets Out Of Window bram85 FreeBSD Security 9 2nd June 2008 04:09 PM


All times are GMT. The time now is 12:58 AM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick