Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[Still unresolved] Trouble connecting VPN over WiFi
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Sat Nov 10, 2012 1:36 pm    Post subject: [Still unresolved] Trouble connecting VPN over WiFi Reply with quote

Please someone help me.
I have Gentoo 3.6.6 x86_64 Intel(R) Core(TM) i5-2520M CPU installed on Thinkpad x220. I have Intel Corporation Centrino Advanced-N 6205 (rev 34) wifi adapter with Kernel driver in use: iwlwifi.

I installed Cisco VPN to connect to work network, it connects beautifully with eth0, wifi or hspa connection, but i have no traffic when connecting VPN via WiFi.
Example: i can ssh to servers @work with VPN connected via HSPA or Eth0, but can't when VPN connected via WiFi.

I tried different wifi networks - at home, at work - still no traffic.

Help, i don't understand what's the trick!
Thanks

P.S. i'm not sure is it networking or hardware issue


Last edited by oizzzo on Mon Nov 12, 2012 10:14 am; edited 1 time in total
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 32104
Location: 56N 3W

PostPosted: Sat Nov 10, 2012 3:11 pm    Post subject: Reply with quote

oizzzo,

Welcome to Gentoo.

Tell us about your firewall. CISCO VPN uses udp port 4500 and another, which I forget. You need those ports open.
I have the reverse set up to you. VPN is blocked on my wired network as it can be used to route around the firewall but allowed on Wireless, since Wireless is not permitted to initiate connections to wired.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Sun Nov 11, 2012 8:51 am    Post subject: Reply with quote

Emmm, what firewall?

I have iptables installed, but it is stopped and i am not using it...


Your VPN connection is secure.

VPN tunnel information.
Client address: 192.168.4.2
Server address: xxx.xxx.xxx.xxx
Encryption: 256-bit AES
Authentication: HMAC-SHA
IP Compression: LZS
NAT passthrough is active on port UDP 24733
Local LAN Access is disabled

still not working over wifi
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 32104
Location: 56N 3W

PostPosted: Sun Nov 11, 2012 11:24 am    Post subject: Reply with quote

oizzzo,

Please post your routing table when the VPN is not working. Also the output of
Code:
ifconfig -a


I have a feeling that your physical interfaces (eth0 and wlan0) are both up and both in the same subnet.
The quick test is to stop eth0 and see if the VPN over WiFi works then.
If that breaks other things that depend on the network service, you will need to edit /etc/rc.conf. Its well commented.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Sun Nov 11, 2012 12:10 pm    Post subject: Reply with quote

NeddySeagoon thank you for trying to help me.

I use NetworkManager to manage connections, and at work i can't connect to VPN if i am in corporate LAN, so i need to disconnect eth0 before connecting VPN, it's by design. Also i don't think there are subnet trouble because for test i changed home subnet to 40.40.40.0/24, and still no traffic with VPN.

ip route show
Code:

default via 192.168.99.1 dev wlan0  proto static
10.0.0.0/16 via 192.168.4.108 dev cipsec0  scope link
81.20.145.202 via 192.168.4.108 dev cipsec0  scope link
84.50.150.18 via 192.168.4.108 dev cipsec0  scope link
84.50.150.30 via 192.168.4.108 dev cipsec0  scope link
84.50.150.34 via 192.168.4.108 dev cipsec0  scope link
84.50.150.46 via 192.168.4.108 dev cipsec0  scope link
84.50.150.51 via 192.168.4.108 dev cipsec0  scope link
84.50.150.54 via 192.168.4.108 dev cipsec0  scope link
88.196.5.64/28 via 192.168.4.108 dev cipsec0  scope link
127.0.0.0/8 via 127.0.0.1 dev lo
172.16.3.0/24 via 192.168.4.108 dev cipsec0  scope link
192.168.0.0/16 via 192.168.4.108 dev cipsec0  scope link
192.168.4.0/24 dev cipsec0  proto kernel  scope link  src 192.168.4.108
192.168.99.0/24 dev eth0  scope link
194.126.102.96/27 via 192.168.4.108 dev cipsec0  scope link
194.204.27.128/27 via 192.168.4.108 dev cipsec0  scope link
195.20.151.0/24 via 192.168.4.108 dev cipsec0  scope link
195.20.151.193 via 192.168.99.1 dev wlan0
195.222.25.253 via 192.168.4.108 dev cipsec0  scope link
213.168.6.157 via 192.168.4.108 dev cipsec0  scope link


ifconfig -a
Code:

bond0     Link encap:Ethernet  HWaddr 00:00:00:00:00:00
          UP BROADCAST MASTER MULTICAST  MTU:1500  Metric:1
          RX packets:102 errors:0 dropped:0 overruns:0 frame:0
          TX packets:716 errors:0 dropped:16 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:27548 (26.9 KiB)  TX bytes:56996 (55.6 KiB)

cipsec0   Link encap:Ethernet  HWaddr 00:0b:fc:f8:01:8f
          inet addr:192.168.4.108  Mask:255.255.255.0
          inet6 addr: fe80::20b:fcff:fef8:18f/64 Scope:Link
          UP RUNNING NOARP  MTU:1356  Metric:1
          RX packets:102 errors:0 dropped:0 overruns:0 frame:0
          TX packets:716 errors:0 dropped:16 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:27548 (26.9 KiB)  TX bytes:56996 (55.6 KiB)

dummy0    Link encap:Ethernet  HWaddr 5a:03:a7:6f:99:a1
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:102 errors:0 dropped:0 overruns:0 frame:0
          TX packets:716 errors:0 dropped:16 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:27548 (26.9 KiB)  TX bytes:56996 (55.6 KiB)

eth0      Link encap:Ethernet  HWaddr f0:de:f1:ab:dc:56
          inet6 addr: fe80::f2de:f1ff:feab:dc56/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:102 errors:0 dropped:0 overruns:0 frame:0
          TX packets:716 errors:0 dropped:16 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:27548 (26.9 KiB)  TX bytes:56996 (55.6 KiB)
          Interrupt:20 Memory:f2500000-f2520000

ip_vti0   Link encap:IPIP Tunnel  HWaddr
          NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:2800 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2800 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:276645 (270.1 KiB)  TX bytes:276645 (270.1 KiB)

sit0      Link encap:IPv6-in-IPv4
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wlan0     Link encap:Ethernet  HWaddr 08:11:96:f2:f9:e8
          inet addr:192.168.99.136  Bcast:192.168.99.255  Mask:255.255.255.0
          inet6 addr: fe80::a11:96ff:fef2:f9e8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:102 errors:0 dropped:51 overruns:0 frame:0
          TX packets:716 errors:0 dropped:16 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:27548 (26.9 KiB)  TX bytes:56996 (55.6 KiB)

wwan0     Link encap:Ethernet  HWaddr 02:80:37:ec:02:00
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:102 errors:0 dropped:0 overruns:0 frame:0
          TX packets:716 errors:0 dropped:16 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:27548 (26.9 KiB)  TX bytes:56996 (55.6 KiB)
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 32104
Location: 56N 3W

PostPosted: Sun Nov 11, 2012 2:24 pm    Post subject: Reply with quote

oizzzo,
Code:
192.168.0.0/16 via 192.168.4.108 dev cipsec0  scope link
192.168.4.0/24 dev cipsec0  proto kernel  scope link  src 192.168.4.108
looks odd on a couple of counts.

192.168.4.0/24 is contained within 192.168.0.0/16 but it should work as you expect as routing rules are applied from the bottom up the upward, so default matches anything thats not already routed.

Code:
192.168.0.0/16 via 192.168.4.108 dev cipsec0  scope link
is odd on its own. You would not normally need a route to reach 192.168.4.108 from the 192.168.0.0/16 network.
Again it should work as the usual network routing rules are missing.


ifconfig -a shows
Code:
eth0      Link encap:Ethernet  HWaddr f0:de:f1:ab:dc:56
          inet6 addr: fe80::f2de:f1ff:feab:dc56/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:102 errors:0 dropped:0 overruns:0 frame:0
          TX packets:716 errors:0 dropped:16 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:27548 (26.9 KiB)  TX bytes:56996 (55.6 KiB)
          Interrupt:20 Memory:f2500000-f2520000
so eth0 is not up (it has no IP address) but packets destined for 192.168.99.0/24 dev eth0 scope link are being sent to it. that has to be wrong.

Try deleting the 192.168.99.0/24 dev eth0 route or should that be via wlan0 when wlsn0 replaces eth0?
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Sun Nov 11, 2012 3:04 pm    Post subject: Reply with quote

Ok, now i'm at home, and have here 40.40.40.0/24 subnet, TP-Link router with WiFi.

Now i'm connected with cable, eth0 and VPN is up and running.

Code:

eth0      Link encap:Ethernet  HWaddr f0:de:f1:ab:dc:56 
          inet addr:40.40.40.103  Bcast:40.40.40.255  Mask:255.255.255.0
          inet6 addr: fe80::f2de:f1ff:feab:dc56/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:136 errors:0 dropped:0 overruns:0 frame:0
          TX packets:780 errors:0 dropped:22 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:34552 (33.7 KiB)  TX bytes:61959 (60.5 KiB)
          Interrupt:20 Memory:f2500000-f2520000

wlan0     Link encap:Ethernet  HWaddr 08:11:96:f2:f9:e8 
          inet6 addr: fe80::a11:96ff:fef2:f9e8/64 Scope:Link
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:215956 errors:0 dropped:77 overruns:0 frame:0
          TX packets:118137 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:267820867 (255.4 MiB)  TX bytes:14971348 (14.2 MiB)


Routes

Code:

default via 40.40.40.1 dev eth0  proto static
10.0.0.0/16 via 192.168.4.2 dev cipsec0  scope link
40.40.40.0/24 dev eth0  proto kernel  scope link  src 40.40.40.103
81.20.145.202 via 192.168.4.2 dev cipsec0  scope link
84.50.150.18 via 192.168.4.2 dev cipsec0  scope link
84.50.150.30 via 192.168.4.2 dev cipsec0  scope link
84.50.150.34 via 192.168.4.2 dev cipsec0  scope link
84.50.150.46 via 192.168.4.2 dev cipsec0  scope link
84.50.150.51 via 192.168.4.2 dev cipsec0  scope link
84.50.150.54 via 192.168.4.2 dev cipsec0  scope link
88.196.5.64/28 via 192.168.4.2 dev cipsec0  scope link
127.0.0.0/8 via 127.0.0.1 dev lo
172.16.3.0/24 via 192.168.4.2 dev cipsec0  scope link
192.168.0.0/16 via 192.168.4.2 dev cipsec0  scope link
192.168.4.0/24 dev cipsec0  proto kernel  scope link  src 192.168.4.2
194.126.102.96/27 via 192.168.4.2 dev cipsec0  scope link
194.204.27.128/27 via 192.168.4.2 dev cipsec0  scope link
195.20.151.0/24 via 192.168.4.2 dev cipsec0  scope link
195.20.151.193 via 40.40.40.1 dev eth0
195.222.25.253 via 192.168.4.2 dev cipsec0  scope link
213.168.6.157 via 192.168.4.2 dev cipsec0  scope link


Now, terminating VPN, disconnecting cable and connecting to WiFi

Code:

eth0      Link encap:Ethernet  HWaddr f0:de:f1:ab:dc:56 
          inet6 addr: fe80::f2de:f1ff:feab:dc56/64 Scope:Link
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:255531 errors:0 dropped:0 overruns:0 frame:0
          TX packets:166032 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:82898844 (79.0 MiB)  TX bytes:34363562 (32.7 MiB)
          Interrupt:20 Memory:f2500000-f2520000

wlan0     Link encap:Ethernet  HWaddr 08:11:96:f2:f9:e8 
          inet addr:40.40.40.102  Bcast:40.40.40.255  Mask:255.255.255.0
          inet6 addr: fe80::a11:96ff:fef2:f9e8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:215403 errors:0 dropped:77 overruns:0 frame:0
          TX packets:117774 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:267660132 (255.2 MiB)  TX bytes:14902319 (14.2 MiB)


Routes

Code:

default via 40.40.40.1 dev wlan0  proto static
10.0.0.0/16 via 192.168.4.2 dev cipsec0  scope link
40.40.40.0/24 dev wlan0  proto kernel  scope link  src 40.40.40.102
81.20.145.202 via 192.168.4.2 dev cipsec0  scope link
84.50.150.18 via 192.168.4.2 dev cipsec0  scope link
84.50.150.30 via 192.168.4.2 dev cipsec0  scope link
84.50.150.34 via 192.168.4.2 dev cipsec0  scope link
84.50.150.46 via 192.168.4.2 dev cipsec0  scope link
84.50.150.51 via 192.168.4.2 dev cipsec0  scope link
84.50.150.54 via 192.168.4.2 dev cipsec0  scope link
88.196.5.64/28 via 192.168.4.2 dev cipsec0  scope link
127.0.0.0/8 via 127.0.0.1 dev lo
172.16.3.0/24 via 192.168.4.2 dev cipsec0  scope link
192.168.0.0/16 via 192.168.4.2 dev cipsec0  scope link
192.168.4.0/24 dev cipsec0  proto kernel  scope link  src 192.168.4.2
194.126.102.96/27 via 192.168.4.2 dev cipsec0  scope link
194.204.27.128/27 via 192.168.4.2 dev cipsec0  scope link
195.20.151.0/24 via 192.168.4.2 dev cipsec0  scope link
195.20.151.193 via 40.40.40.1 dev wlan0
195.222.25.253 via 192.168.4.2 dev cipsec0  scope link
213.168.6.157 via 192.168.4.2 dev cipsec0  scope link


As expected, VPN over WiFi don't work

Over wifi when connected to VPN i can't ping work hosts, even can't browse internet or ping google.com

Thanks for your help!
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 32104
Location: 56N 3W

PostPosted: Sun Nov 11, 2012 3:22 pm    Post subject: Reply with quote

oizzzo,

oizzzo wrote:
even can't browse internet or ping google.com


Thats probably far more significant but with VPN in the mix, sometimes eveything goes through the tunnel, sometimes local web browsing does not.
When you are using wlan0 and nothing works, what do you have in /etc/resolv.conf ?

You say you can't ping google.com but what about 173.194.34.69 ?

In /etc/rc.conf what does the line rc_depend_strict show ?
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Sun Nov 11, 2012 3:44 pm    Post subject: Reply with quote

With VPN over eth0 i can ping google.com, but with VPN over WiFi i can't.

In resolv.conf all is ok, after connecting to VPN it pushes there work internal dns servers. Same is with VPN over Eth0 or HSPA

Code:

domain work
nameserver 192.168.2.6
nameserver 192.168.2.10


I can't ping anything, even DNS servers.

Code:

rc.conf
UNICODE="yes"
RC_PARALLEL_STARTUP="yes"
RC_INTERACTIVE="no"
RC_HOTPLUG="yes"
DAEMON_LOCALE="no"
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 32104
Location: 56N 3W

PostPosted: Sun Nov 11, 2012 3:51 pm    Post subject: Reply with quote

oizzzo,

Never mind the VPS for now. wlan0 needs work on its own before it can support a VPN tunnel.
If resolv.conf contains your work DNS servers then name resolution will not work at all until VPS is up.

Has wlan0 ever worked, ever?
With or without VPN?

Lets look at wlan0. What does lspci or lsusb say about it?
Please pastebin you entire dmesg output so I can see wlan0 being started.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Sun Nov 11, 2012 4:10 pm    Post subject: Reply with quote

resolv.conf changes when VPN is connected, it is normal, vpn connection propagates new DNS servers when connected.

When VPN is not active
Code:

aleksei@ask300 ~ $ cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 40.40.40.1


Wlan0 works on it own, i'm now writing this reply in Chromium on X220 connected to internet via Wlan0. I have working eth0, wlan0 and HSPA modem.

lspci -k about WiFi card
Code:

03:00.0 Network controller: Intel Corporation Centrino Advanced-N 6205 (rev 34)
        Subsystem: Intel Corporation Centrino Advanced-N 6205 AGN
        Kernel driver in use: iwlwifi


Wlan0 and Eth0 does not start automatically because they are managed with NetworkManager.
My dmesg is here http://pastebin.com/t5zR5554
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 32104
Location: 56N 3W

PostPosted: Sun Nov 11, 2012 4:34 pm    Post subject: Reply with quote

oizzzo,

Your USB subsysem isn't very happy - dmesg is full of errors. I don't think it affects wlan0 though.

You also have several kernel Ooops ... that a bad sign. It may or may not affect wlan0. An Oops indicates and error condition just short of a kernel panic.
The kernel was able to carry on.

We will not see anything useful in dmesg until the USB errors and kernel Oops are fixed.

Looking at earlier posts, your routing tables are identical, with the exception that wlan0 takes the place of eth0.
With VPN enabled can you pint your gateway?

Set up wilfi but not VPN, in a terminal, run ping 40.40.40.1, which is your local gateway. This should work regardless of VPN or not.
Now start VPN - do the pings stop ?
If so your WiFi went down for some reason. The reason might be in dmesg if you are quick.

In another terminal ping 192.168.4.2, which is your end of the VPN tunnel. If that fails, is cipsec0 with IP 192.168.4.2 in ifconfig ?
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Sun Nov 11, 2012 4:50 pm    Post subject: Reply with quote

I'll try to fix dmesg USB and kernel problems, but you are right, it can't affect.

I can ping my local gw without VPN connected and can ping with VPN connected now, it's much better.

Quote:
Now start VPN - do the pings stop ?


No, it continues. I tried to ping in another window 8.8.8.8 - success.

Quote:
In another terminal ping 192.168.4.2, which is your end of the VPN tunnel. If that fails, is cipsec0 with IP 192.168.4.2 in ifconfig ?

192.168.4.2 is my fixed IP on VPN DHCP scope.
But i can't ping with VPN connected my work DNS servers, 192.168.2.6 and 192.168.2.10.

When VPN is connected via eth0 or HSPA - all great.

Can it be WiFi driver problem?
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 32104
Location: 56N 3W

PostPosted: Sun Nov 11, 2012 5:28 pm    Post subject: Reply with quote

oizzzo,

The WiFi driver has no knowledge of the data it carries, so its unlikely to be a driver issue.
Ping to your own gateway works, so data is getting to your next physical hop.

VPN packets pass through the routing table twice, once to the VPN tunnel, then again after encryption to be sent over the physical link.
The same happens in reverse at the other end.

I wonder if its a packet fragment size problem?
What happens if you set the MTU to 1024 for the VPN links?
This will avoid the network system breaking up packets that are too big to go in one piece following encryption. You can also try 512 but thats getting towards the silly small end for packet size.
Smaller packets mean more overhead, so its important to make the size as big as works reliably.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Sun Nov 11, 2012 5:45 pm    Post subject: Reply with quote

How can i change MTU for VPN traffic and why i need to change it? I mean there is something strange just with WiFi, not VPN connection.
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 32104
Location: 56N 3W

PostPosted: Sun Nov 11, 2012 6:09 pm    Post subject: Reply with quote

oizzzo,

With network manager, I don't know how you set the MTU.

Different transports have different MTU.
Wired ethernet is 1500 bytes
PPPoE is 1492 as its ethernet wrapped in ethernet.
My WiFi claims 1492 as it eventually goes over my PPPoE to the outside world
My USB 3G modem claims 1500

Your
Code:
cipsec0   Link encap:Ethernet  HWaddr 00:0b:fc:f8:01:8f
          inet addr:192.168.4.108  Mask:255.255.255.0
          inet6 addr: fe80::20b:fcff:fef8:18f/64 Scope:Link
          UP RUNNING NOARP  MTU:1356  Metric:1
shows 1356.

Your
Code:
 wlan0     Link encap:Ethernet  HWaddr 08:11:96:f2:f9:e8
          inet addr:192.168.99.136  Bcast:192.168.99.255  Mask:255.255.255.0
          inet6 addr: fe80::a11:96ff:fef2:f9e8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
is 1500

Some things don't work well with packet fragmentation. I don't know that this is occurring but it may be useful to test.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Sun Nov 11, 2012 6:30 pm    Post subject: Reply with quote

Ok, i played with MTU, tried to set 1300, 1492, auto, no change.

Code:

wlan0     Link encap:Ethernet  HWaddr 08:11:96:f2:f9:e8 
          inet addr:40.40.40.102  Bcast:40.40.40.255  Mask:255.255.255.0
          inet6 addr: fe80::a11:96ff:fef2:f9e8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1492  Metric:1
          RX packets:311113 errors:0 dropped:84 overruns:0 frame:0
          TX packets:188844 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:319854383 (305.0 MiB)  TX bytes:26797348 (25.5 MiB)


I set up logging with level 3 on vpn client, here are only errors. With VPN over eth0 or HSPA it's error free

Code:

aleksei@ask300 ~ $ tail -f /var/log/vpn.log

195    20:24:20.530  11/11/2012  Sev=Warning/3  IKE/0xC300002C
ISAKMP header invalid: Invalid version 2.12 found

196    20:24:20.530  11/11/2012  Sev=Warning/3  IKE/0xC3000039
Received an invalid or malformed IKE packet: message id = 0x614138BD

197    20:24:20.531  11/11/2012  Sev=Info/5     IKE/0x4300002F
Received ISAKMP packet: peer = 195.20.151.193

198    20:24:20.531  11/11/2012  Sev=Warning/3  IKE/0xC300002C
ISAKMP header invalid: Invalid version 0.2 found

199    20:24:20.531  11/11/2012  Sev=Warning/3  IKE/0xC3000039
Received an invalid or malformed IKE packet: message id = 0x62F1B450

200    20:24:20.538  11/11/2012  Sev=Info/5     IKE/0x4300002F
Received ISAKMP packet: peer = 195.20.151.193

201    20:24:20.538  11/11/2012  Sev=Warning/3  IKE/0xC300002C
ISAKMP header invalid: Invalid version 1.9 found

202    20:24:20.538  11/11/2012  Sev=Warning/3  IKE/0xC3000039
Received an invalid or malformed IKE packet: message id = 0x06C5A2D7
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 32104
Location: 56N 3W

PostPosted: Sun Nov 11, 2012 6:51 pm    Post subject: Reply with quote

oizzzo,

That shows that something is going backwards and forwards over VPN.
I don't know the details any further, maybe google can help if you search for Received an invalid or malformed IKE packet
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Mon Nov 12, 2012 6:20 am    Post subject: Reply with quote

No, it seems that when i connect VPN over WiFi ipSec module cannot decrypt packets.

Anyone please help!
Back to top
View user's profile Send private message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Tue Nov 13, 2012 7:31 pm    Post subject: Reply with quote

So, i bought Trendnet TEW642UB, added needed kernel drivers for Realtek chipset, rebooted, disabled integrated Intel WiFi card and connected to my home Wifi with Trendnet TEW642UB.

VPN worked, i can ping and ssh to work.

I think there are some strange shit with Intel Next-Gen drivers in kernel.
Back to top
View user's profile Send private message
oizzzo
n00b
n00b


Joined: 10 Nov 2012
Posts: 12

PostPosted: Fri Nov 16, 2012 2:01 pm    Post subject: Resolved, but it's a kernel bug(feature?) Reply with quote

Tried today different kernels, it doesn't worked with stable 3.5.7 but it worked with stable 3.0.17-r2

Should i report bug to kernel list/bugzilla?
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 32104
Location: 56N 3W

PostPosted: Fri Nov 16, 2012 7:55 pm    Post subject: Reply with quote

oizzzo,

Report a bug to bugs.gentoo.org
Before you open a new bug, see if there is already a bug you can contribute to.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum