• Home
  • Personal
  • Tech
  • Politics
  • Photography
  • IPSEC VPN problems upgrading to Ubuntu Edgy

    November 2nd, 2006

    I upgraded my home gateway firewall to Edgy today in the hope of fixing some SATA problems I’ve been experiencing. The new Edgy kernel might help – we’ll see.

    Anyway, it went pretty well. Two runs (?) of apt-get dist-upgrade -u, a reboot and there I was.

    Unfortunately I had two problems with my Openswan IPSEC VPNs. I’m not so sure if these count as bugs. I’ll be investigating further and reporting if so. Anyway, techie details follow…
    Read the rest of this entry »

    Tags: dapper, edgy, icmp, ipsec, iptables, kernel, linux, NAT, netfilter, openswan, pmtu, Ubuntu

    Posted in GNU/Linux, Networks and Firewalls, Tech, Ubuntu | 1 Comment »

  • TCP, NAT and 2MSL mismatch

    March 8th, 2006

    We have a client that connects over the NHS internal network to a server hosted at our site. We have lots of clients like this, but these are slightly different because they NAT all their machines to one IP before it gets to us.

    Recently they complained about connection problems and after lots of investigation we managed to get a packet capture of the problem (IPs changed of course):

     1  0.00 192.168.0.1 -> 10.0.0.254 TCP 2268 > 80 [SYN]
     2  0.00 10.0.0.254 -> 192.168.0.1 TCP 80 > 2268 [SYN, ACK]
     3  0.01 192.168.0.1 -> 10.0.0.254 TCP 2268 > 80 [ACK]
     4  0.08 192.168.0.1 -> 10.0.0.254 HTTP POST
     5  0.24 10.0.0.254 -> 192.168.0.1 TCP 80 > 2268 [ACK]
     6  0.23 192.168.0.1 -> 10.0.0.254 HTTP Continuation
     7  0.24 10.0.0.254 -> 192.168.0.1 HTTP HTTP/1.1 200 OK 1365
     8  0.24 10.0.0.254 -> 192.168.0.1 HTTP Continuation
     9  0.24 10.0.0.254 -> 192.168.0.1 TCP 80 > 2268 [FIN, ACK]
    10  0.29 192.168.0.1 -> 10.0.0.254 TCP 2268 > 80 [ACK]
    11  0.31 192.168.0.1 -> 10.0.0.254 TCP 2268 > 80 [FIN, ACK]
    12  0.31 10.0.0.254 -> 192.168.0.1 TCP 80 > 2268 [ACK]
    13  0.34 192.168.0.1 -> 10.0.0.254 TCP 2268 > 80 [ACK]
    14 68.26 192.168.0.1 -> 10.0.0.254 TCP 2268 > 80 [SYN]
    15 71.18 192.168.0.1 -> 10.0.0.254 TCP 2268 > 80 [SYN]
    16 77.13 192.168.0.1 -> 10.0.0.254 TCP 2268 > 80 [SYN]
    17 98.25 192.168.0.1 -> 10.0.0.254 TCP 2268 > 80 [RST, CWR]
    


    Read the rest of this entry »

    Tags: cisco, NAT, network, networking, tcp, tcpip, troubleshooting

    Posted in Networks and Firewalls, Tech | No Comments »

  • John Leach

    • John Leach is a human being living in Leeds, UK.
  • Twitter

    • John is finally sitting down to watch Terminator 2 after @louisa_ insisted we watch 1 first. She, of course, was right to insist. 10 hrs ago
    • More twitter updates →
  • Author Stuff

    • Brightbox Rails Hosting
    • Compost This
    • ELER Web Comic
    • New World Odour
    • News Sniffer
    • Photography
    • Profile and History
    • Recycle This
    • The Gillroyd Parade
    • Things to do today
    • Website
  • Friends

    • Caius Durling
    • Deb Bassett
    • Gianni Tedesco
    • Ian Higgins
    • Louisa Parry
    • Rahoul Baruah
    • Sleepy Kev
    • Tim Waters
    • Tom Hall
  • Stuff

    • ifup
    • Media Lens
    • Mia Bambina
    • News from nowhere
  • Meta

    • Log in
    • Entries RSS
    • Comments RSS
  • Search

Creative Commons License The text of this blog is licensed under the Creative Commons BY-ND license