LINUX.ORG.RU
решено ФорумAdmin

pptpd server 619 ошибка


0

0

некоторых клиентов соединяет некоторых отпускает с 619 ошибкой

вэтом соединении все нормально
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x2312d2b1> <pcomp> <accomp>] 
rcvd [LCP ConfReq id=0x0 <mru 1400> <magic 0x60bc2e17> <pcomp> <accomp> <callback CBCP>] 
sent [LCP ConfRej id=0x0 <callback CBCP>] 
rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x2312d2b1> <pcomp> <accomp>] 
rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x60bc2e17> <pcomp> <accomp>] 
sent [LCP ConfAck id=0x1 <mru 1400> <magic 0x60bc2e17> <pcomp> <accomp>] 
sent [LCP EchoReq id=0x0 magic=0x2312d2b1] 
sent [CHAP Challenge id=0xda <f2e0e8f38e16254e70e41081ad679192>, name = "pptpd"] 
rcvd [LCP Ident id=0x2 magic=0x60bc2e17 "MSRASV5.10"] 
rcvd [LCP Ident id=0x3 magic=0x60bc2e17 "MSRAS-0-NINA-F01A3B5297"] 
rcvd [LCP EchoRep id=0x0 magic=0x60bc2e17] 
rcvd [CHAP Response id=0xda <e3a706e3ec817f6609fd1aeea04dd353000000000000000008409de35f169fd23aac8dc1af9ae595e856bb8155c2366d00>, name = "pretty409"] 
Peer pretty409 failed CHAP authentication 
sent [CHAP Failure id=0xda ""] 
sent [LCP TermReq id=0x2 "Authentication failed"] 
rcvd [CHAP Response id=0xda <e3a706e3ec817f6609fd1aeea04dd353000000000000000008409de35f169fd23aac8dc1af9ae595e856bb8155c2366d00>, name = "pretty409"] 
Discarded non-LCP packet when LCP not open 
rcvd [LCP TermAck id=0x2 "Authentication failed"] 
Connection terminated. 
RADATTR plugin removed file /var/run/radattr.ppp8. 
Traffic limit reached. Limit: 2146435072 Used: 2146481974 
pptpd-logwtmp.so ip-down ppp3 
Connect time 707.0 minutes. 
Sent 2084943133 bytes, received 61538841 bytes. 
Script /etc/ppp/ip-down started (pid 30578) 
MPPE disabled 
sent [LCP TermReq id=0x2 "MPPE disabled"] 
sent [LCP TermReq id=0x3 "MPPE disabled"] 
rcvd [LCP TermAck id=0x2 "MPPE disabled"] 
Connection terminated. 
Waiting for 1 child processes... 
  script /etc/ppp/ip-down, pid 30578 
Script /etc/ppp/ip-down finished (pid 30578), status = 0x0 
RADATTR plugin removed file /var/run/radattr.ppp3. 
Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded. 
pptpd-logwtmp: $Version$ 
в этом соединении проблемы
using channel 552 
Using interface ppp3 
Connect: ppp3 <--> /dev/pts/4 
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xf4f5f3af> <pcomp> <accomp>] 
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xf4f5f3af> <pcomp> <accomp>] 
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xf4f5f3af> <pcomp> <accomp>] 
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xf4f5f3af> <pcomp> <accomp>] 
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xf4f5f3af> <pcomp> <accomp>] 
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xf4f5f3af> <pcomp> <accomp>] 
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xf4f5f3af> <pcomp> <accomp>] 
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xf4f5f3af> <pcomp> <accomp>] 
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xf4f5f3af> <pcomp> <accomp>] 
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xf4f5f3af> <pcomp> <accomp>] 
LCP: timeout sending Config-Requests 
Connection terminated. 
Modem hangup 
RADATTR plugin removed file /var/run/radattr.ppp3. 
Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded. 
pptpd-logwtmp: $Version$ 
в этом соединении все нормально
using channel 553 
Using interface ppp3 
Connect: ppp3 <--> /dev/pts/4 
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x6756ef61> <pcomp> <accomp>] 
rcvd [LCP ConfReq id=0x0 <mru 1400> <magic 0x6f4b0375> <pcomp> <accomp> <callback CBCP>] 
sent [LCP ConfRej id=0x0 <callback CBCP>] 
rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x6756ef61> <pcomp> <accomp>] 
rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x6f4b0375> <pcomp> <accomp>] 
sent [LCP ConfAck id=0x1 <mru 1400> <magic 0x6f4b0375> <pcomp> <accomp>] 
sent [LCP EchoReq id=0x0 magic=0x6756ef61] 
sent [CHAP Challenge id=0x2f <1d5975746246b5d49fab3f723b1f6e9a>, name = "pptpd"] 
rcvd [LCP Ident id=0x2 magic=0x6f4b0375 "MSRASV5.10"] 
rcvd [LCP Ident id=0x3 magic=0x6f4b0375 "MSRAS-0-RAF"] 
rcvd [LCP EchoRep id=0x0 magic=0x6f4b0375] 
rcvd [CHAP Response id=0x2f <c406abb47b4e0368031bc96e79d369c80000000000000000e8d5e5b5431023609601d59066b4bb8d2b367725264fd4c900>, name = "madrus1307"] 
RADATTR plugin wrote 13 line(s) to file /var/run/radattr.ppp3. 
sent [CHAP Success id=0x2f "S=CE10A5D681F4E4E396E317CCE8C7A46080FE8ED8"] 
sent [CCP ConfReq id=0x1 <mppe +H -M +S -L -D -C>] 
rcvd [CCP ConfReq id=0x4 <mppe +H +M +S +L -D +C>] 
sent [CCP ConfNak id=0x4 <mppe +H -M +S -L -D -C>] 
rcvd [IPCP ConfReq id=0x5 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-wins 0.0.0.0> <ms-dns2 0.0.0.0> <ms-wins 0.0.0.0>] 
sent [IPCP TermAck id=0x5] 
rcvd [CCP ConfAck id=0x1 <mppe +H -M +S -L -D -C>] 
rcvd [CCP ConfReq id=0x6 <mppe +H -M +S -L -D -C>] 
sent [CCP ConfAck id=0x6 <mppe +H -M +S -L -D -C>] 
MPPE 128-bit stateless compression enabled 
sent [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr 172.16.0.1>] 
rcvd [IPCP ConfRej id=0x1 <compress VJ 0f 01>] 
sent [IPCP ConfReq id=0x2 <addr 172.16.0.1>] 
rcvd [IPCP ConfAck id=0x2 <addr 172.16.0.1>] 
rcvd [IPCP ConfReq id=0x7 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-wins 0.0.0.0> <ms-dns2 0.0.0.0> <ms-wins 0.0.0.0>] 
sent [IPCP ConfRej id=0x7 <ms-wins 0.0.0.0> <ms-wins 0.0.0.0>] 
rcvd [IPCP ConfReq id=0x8 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>] 
sent [IPCP ConfNak id=0x8 <addr 172.16.1.73> <ms-dns1 172.16.0.1> <ms-dns2 192.168.8.6>] 
rcvd [IPCP ConfReq id=0x9 <addr 172.16.1.73> <ms-dns1 172.16.0.1> <ms-dns2 192.168.8.6>] 
sent [IPCP ConfAck id=0x9 <addr 172.16.1.73> <ms-dns1 172.16.0.1> <ms-dns2 192.168.8.6>] 
Script /etc/ppp/ip-pre-up started (pid 30694) 
Script /etc/ppp/ip-pre-up finished (pid 30694), status = 0x0 
Cannot determine ethernet address for proxy ARP 
local IP address 172.16.0.1 
remote IP address 172.16.1.73 
pptpd-logwtmp.so ip-up ppp3 madrus1307 192.168.8.200 
Script /etc/ppp/ip-up started (pid 30710) 
Script /etc/ppp/ip-up finished (pid 30710), status = 0x0

Клиенты на винде? 619-я, если мне не изменяет память, какая-то хитрая глюка в форточках и лечится только перезагрузкой (винды, не сервера).

AngryElf ★★★★★
()

Добавь в конфиг к серверу (pppd) noproxyarp. Если не поможет, снимай дамп tcpdump -ом, там сразу видно будет почему разрывается соединение.

m0xf
()

>в этом соединении проблемы

Там нет ответов от клиента на LCP ConfReq от сервера. Возможно, что пакеты режутся iptables или портятся NAT'ом (если загружен модуль, делающий NAT для pptp-протокола).

mky ★★★★★
()
Ответ на: комментарий от mky
# iptables-save
# Generated by iptables-save v1.4.0 on Sat May  1 18:12:07 2010
*nat
:PREROUTING ACCEPT [90901:7337590]
:POSTROUTING ACCEPT [31984:2010790]
:OUTPUT ACCEPT [32563:2083250]
-A PREROUTING -s 172.16.0.0/16 -i ppp+ -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129
-A POSTROUTING -s 192.168.0.0/16 -j MASQUERADE
-A POSTROUTING -s 172.16.0.0/16 -j MASQUERADE
-A POSTROUTING -d 192.168.0.0/16 -j SNAT --to-source 192.168.8.6
COMMIT
# Completed on Sat May  1 18:12:07 2010
# Generated by iptables-save v1.4.0 on Sat May  1 18:12:07 2010
*mangle
:PREROUTING ACCEPT [2526905:1192158222]
:INPUT ACCEPT [169610:54070140]
:FORWARD ACCEPT [2347221:1136708618]
:OUTPUT ACCEPT [132117:14408078]
:POSTROUTING ACCEPT [2479434:1151139076]
-A FORWARD -o ppp600 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Sat May  1 18:12:07 2010
# Generated by iptables-save v1.4.0 on Sat May  1 18:12:07 2010
*filter
:INPUT ACCEPT [78824:40425744]
:FORWARD ACCEPT [2347221:1136708618]
:OUTPUT ACCEPT [132117:14408078]
-A INPUT -i ppp600 -p tcp -m tcp --dport 9443 -j ACCEPT
-A INPUT -i ppp600 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i ppp600 -p tcp -m tcp --dport 100 -j ACCEPT
-A INPUT -i ppp600 -p tcp -m tcp --dport 101 -j ACCEPT
-A INPUT -i ppp600 -p udp -m udp --dport 101 -j ACCEPT
-A INPUT -i ppp600 -p tcp -m tcp --dport 88 -j ACCEPT
-A INPUT -i ppp600 -p tcp -m tcp --dport 85 -j ACCEPT
-A INPUT -i ppp600 -p tcp -m tcp --dport 81 -j ACCEPT
-A INPUT -i ppp600 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i ppp600 -p tcp -m tcp --tcp-flags FIN,SYN,ACK SYN -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i ppp600 -p udp -j DROP
-A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --tcp-flags FIN,SYN,ACK SYN -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i eth1 -p udp -j DROP
COMMIT
# Completed on Sat May  1 18:12:07 2010 
veliarfl
() автор топика
Ответ на: комментарий от mky
# lsmod | grep nat
iptable_nat            13448  1
ip_tables              19600  3 iptable_nat,iptable_mangle,iptable_filter
x_tables               22916  8 ipt_REJECT,ipt_MASQUERADE,ipt_REDIRECT,iptable_nat,xt_TCPMSS,xt_tcpmss,xt_tcpudp,ip_tables
nf_nat_ftp             10880  0
nf_conntrack_ftp       15652  1 nf_nat_ftp
nf_nat_pptp            11136  0
nf_conntrack_pptp      14084  1 nf_nat_pptp
nf_nat_proto_gre       10372  1 nf_nat_pptp
nf_nat                 25368  6 ipt_MASQUERADE,ipt_REDIRECT,iptable_nat,nf_nat_ftp,nf_nat_pptp,nf_nat_proto_gre
nf_conntrack_ipv4      21900  3 iptable_nat,nf_nat
nf_conntrack           72032  9 ipt_MASQUERADE,iptable_nat,nf_nat_ftp,nf_conntrack_ftp,nf_nat_pptp,nf_conntrack_pptp,nf_conntrack_proto_gre,nf_nat,nf_conntrack_ipv4
veliarfl
() автор топика
Ответ на: комментарий от AngryElf

не глюка

перезагрузкой не лечится что то стало не то с сервером но никак не могу понять, что именно

veliarfl
() автор топика
Ответ на: комментарий от veliarfl

А он вам нужен, conntrack и nat для pptp протокола? То есть у вас делается SNAT/DNAT poptop соединений или нет? И делается ли у вас state=RELATED для GRE соединений.

Если не нужен, уберите эти модули. Когда я давно игрался с ними, они глючили, главным образом из-за того, что запись о GRE сессии оставалась в conntrack'е в течении 5 мин.

mky ★★★★★
()
Ответ на: комментарий от m0xf
# tcpdump -i eth0 src 192.168.8.200
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
12:30:27.011378 IP host-192-168-8-200.starnet.ru > IGMP.MCAST.NET: igmp v3 report, 1 group record(s)
12:30:27.011447 IP host-192-168-8-200.starnet.ru > IGMP.MCAST.NET: igmp v3 report, 1 group record(s)
12:30:27.020923 arp who-has host-192-168-8-24.starnet.ru tell host-192-168-8-200.starnet.ru
12:30:27.021122 IP host-192-168-8-200.starnet.ru.3552 > 239.255.255.250.1900: UDP, length 133
12:30:27.057872 arp who-has star001.starnet.ru tell host-192-168-8-200.starnet.ru
12:30:27.910382 IP host-192-168-8-200.starnet.ru > IGMP.MCAST.NET: igmp v3 report, 1 group record(s)
12:30:29.684604 arp who-has host-192-168-8-6.starnet.ru tell host-192-168-8-200.starnet.ru
12:30:29.685013 IP host-192-168-8-200.starnet.ru.3560 > host-192-168-8-6.starnet.ru.1723: S 2859177125:2859177125(0) win 65535 <mss 1460,nop,nop,sackOK>
12:30:29.685644 IP host-192-168-8-200.starnet.ru.3560 > host-192-168-8-6.starnet.ru.1723: P 2859177126:2859177282(156) ack 1969400449 win 65535: pptp CTRL_MSGTYPE=SCCRQ PROTO_VER(1.0) FRAME_CAP(A) BEARER_CAP(A) MAX_CHAN(0) FIRM_REV(2600) [|pptp]
12:30:29.689089 IP host-192-168-8-200.starnet.ru.3560 > host-192-168-8-6.starnet.ru.1723: P 156:324(168) ack 157 win 65379: pptp CTRL_MSGTYPE=OCRQ CALL_ID(0) CALL_SER_NUM(58756) MIN_BPS(300) MAX_BPS(100000000) BEARER_TYPE(Any) FRAME_TYPE(E) RECV_WIN(64) PROC_DELAY(0) PHONE_NO_LEN(0) [|pptp]
12:30:29.699005 IP host-192-168-8-200.starnet.ru.3560 > host-192-168-8-6.starnet.ru.1723: P 324:348(24) ack 189 win 65347: pptp CTRL_MSGTYPE=SLI PEER_CALL_ID(47488) SEND_ACCM(0xffffffff) RECV_ACCM(0xffffffff)
12:30:29.701967 IP host-192-168-8-200.starnet.ru > host-192-168-8-6.starnet.ru: GREv1, call 47488, seq 0, length 37: LCP, Conf-Request (0x01), id 0, length 23
12:30:30.021289 IP host-192-168-8-200.starnet.ru.3552 > 239.255.255.250.1900: UDP, length 133
12:30:30.835024 arp who-has host-192-168-8-18.starnet.ru tell host-192-168-8-200.starnet.ru
12:30:31.700734 IP host-192-168-8-200.starnet.ru > host-192-168-8-6.starnet.ru: GREv1, call 47488, seq 1, length 37: LCP, Conf-Request (0x01), id 1, length 23
12:30:33.021509 IP host-192-168-8-200.starnet.ru.3552 > 239.255.255.250.1900: UDP, length 133
12:30:34.705814 IP host-192-168-8-200.starnet.ru > host-192-168-8-6.starnet.ru: GREv1, call 47488, seq 2, length 37: LCP, Conf-Request (0x01), id 2, length 23
12:30:37.716206 arp reply host-192-168-8-200.starnet.ru is-at 00:18:f3:fe:56:7d (oui Unknown)
12:30:38.700632 IP host-192-168-8-200.starnet.ru > host-192-168-8-6.starnet.ru: GREv1, call 47488, seq 3, length 37: LCP, Conf-Request (0x01), id 3, length 23
12:30:42.710986 IP host-192-168-8-200.starnet.ru > host-192-168-8-6.starnet.ru: GREv1, call 47488, seq 4, length 37: LCP, Conf-Request (0x01), id 4, length 23
12:30:46.701336 IP host-192-168-8-200.starnet.ru > host-192-168-8-6.starnet.ru: GREv1, call 47488, seq 5, length 37: LCP, Conf-Request (0x01), id 5, length 23
12:30:50.701505 IP host-192-168-8-200.starnet.ru > host-192-168-8-6.starnet.ru: GREv1, call 47488, seq 6, length 37: LCP, Conf-Request (0x01), id 6, length 23
12:30:54.701773 IP host-192-168-8-200.starnet.ru > host-192-168-8-6.starnet.ru: GREv1, call 47488, seq 7, length 37: LCP, Conf-Request (0x01), id 7, length 23
12:30:57.896886 IP host-192-168-8-200.starnet.ru.3570 > 239.255.255.250.1900: UDP, length 144
12:30:57.897068 IP host-192-168-8-200.starnet.ru.3570 > 239.255.255.250.1900: UDP, length 144
12:30:57.897227 IP host-192-168-8-200.starnet.ru.3570 > 239.255.255.250.1900: UDP, length 144
12:30:58.702089 IP host-192-168-8-200.starnet.ru > host-192-168-8-6.starnet.ru: GREv1, call 47488, seq 8, length 37: LCP, Conf-Request (0x01), id 8, length 23
12:30:59.804569 IP host-192-168-8-200.starnet.ru.3560 > host-192-168-8-6.starnet.ru.1723: F 348:348(0) ack 190 win 65347
^C
28 packets captured
28 packets received by filter
0 packets dropped by kernel
veliarfl
() автор топика
Ответ на: комментарий от veliarfl

Попробуте для начала убрать nf_nat_pptp, если не поможет, то nf_nat_proto_gre, а потом до кучи nf_conntrack_pptp и nf_conntrack_proto_gre.

Если дампить пакеты, то вместо «src 192.168.8.200» делайте «host 192.168.8.200 and \( proto gre or port 1723 \)», и, ИМХО, лучше добавить "-n -nn", чтобы выводились просто ip-адреса, они короче ваших DNS-имён.

mky ★★★★★
()
Вы не можете добавлять комментарии в эту тему. Тема перемещена в архив.