<div>Dear all,</div>
<div> </div>
<div> I've been struggling with making work the following config for some roadwarriors (winxp)</div>
<div> openswan 2.4.5rc4</div>
<div> l2tpd-0.69-12jdl.i386.rpm</div>
<div> ppp-2.4.2-6.4.RHEL4</div>
<div> kernel 2.6.9-5.ELsmp</div>
<div> </div>
<div> I can see that the VPN starts:</div>
<div> </div>
<div> Jan 20 03:05:54 cedric pluto[830]: "L2TP-PSK"[6] x.x.x.x #12: STATE_QUICK_R2: IPsec SA established {ESP=>0xa087e7fe <0x4a7ab458 xfrm=3DES_0-HMAC_MD5 NATD=none DPD=none}<br> </div>
<div>But then after a while the client disconnect. It seems that l2tpd is not receiving packets</div>
<div> </div>
<div> </div>
<div>Jan 20 03:06:29 cedric pluto[830]: "L2TP-PSK"[6] x.x.x.x #11: received Delete SA(0xa087e7fe) payload: deleting IPSEC State #12<br>Jan 20 03:06:29 cedric pluto[830]: "L2TP-PSK"[6] x.x.x.x #11: received and ignored informational message
<br>Jan 20 03:06:29 cedric pluto[830]: "L2TP-PSK"[6] x.x.x.x #11: received Delete SA payload: deleting ISAKMP State #11<br>Jan 20 03:06:29 cedric pluto[830]: "L2TP-PSK"[6] x.x.x.x: deleting connection "L2TP-PSK" instance with peer
<a href="http://82.238.30.8"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "82.238.30.8" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 82.238.30.8</a> {isakmp=#0/ipsec=#0}<br>Jan 20 03:06:29 cedric pluto[830]: packet from x.x.x.x:500: received and ignored informational message<br>Jan 20 03:06:32 cedric pluto[830]: ERROR: asynchronous network error report on eth1 (sport=500) for message to
x.x.x.x port 500, complainant x.x.x.z: No route to host [errno 113, origin ICMP type 3 code 1 (not authenticated)]</div>
<div> </div>
<div>my firewall is configured as follow (eth1 unsecure eth2 secure)</div>
<div>
<p>$IPTABLES -N RH-Firewall-1-INPUT<br>$IPTABLES -A INPUT -j RH-Firewall-1-INPUT -i eth1<br>$IPTABLES -A FORWARD -j RH-Firewall-1-INPUT -i eth1<br>$IPTABLES -A INPUT -i lo -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
<br>$IPTABLES -t mangle -A PREROUTING -i eth1 -p esp -j MARK --set-mark 1<br>$IPTABLES -A RH-Firewall-1-INPUT -i eth1 -m mark --mark 1 -j ACCEPT<br>$IPTABLES -A OUTPUT -s public_ext_ip -p udp -m udp --sport 1701 -j ACCEPT
<br>$IPTABLES -A RH-Firewall-1-INPUT -p 50 -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -p 51 -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -p udp --dport 5353 -d <a href="http://224.0.0.251"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "224.0.0.251" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 224.0.0.251</a> -j ACCEPT<br>
$IPTABLES -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -p udp -m udp --dport 53 -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 53 -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
<br>$IPTABLES -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
<br>$IPTABLES -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5432 -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -p udp -m udp --dport 500 -j ACCEPT
<br>$IPTABLES -A RH-Firewall-1-INPUT -p udp -m udp --dport 4500 -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 143 -j ACCEPT<br>$IPTABLES -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 110 -j ACCEPT<br>
$IPTABLES -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited<br>$IPTABLES -A INPUT -i eth2 -j ACCEPT<br>$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT<br>$IPTABLES -A FORWARD -j LOG</p>
<p>echo " Enabling SNAT (MASQUERADE) functionality on $EXTIF"<br>$IPTABLES -t nat -A POSTROUTING -o $EXTIF -d ! <a href="http://10.0.0.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.0.0.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.0.0.0/24</a> -j MASQUERADE<br></p><br>I've tryied different set of rules to forward the packet entering to the l2tpd daemon without success
</div>
<div> </div>
<div>Does anybody have any solution to that ?</div>
<div> </div>
<div>Thanks in anticipation</div>
<div>Cheers,</div>
<div>Christophe.</div>