Re: ip_nat_pptp stretch not work

--001a113ac7ae384df7055665ab02
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks for good point - nf_conntrack_helper was disabled by default and it
is difference between jessie and stretch
When I enable it - pptp from local network is working:

echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper

On Thu, Aug 10, 2017 at 2:59 PM, Thierry JAOUEN <[email protected]> wrote:

> Hi,
>
> Maybe you need the "helper" module ?
>
> <https://home.regit.org/netfilter-en/secure-use-of-helpers/>
> <http://www.spinics.net/lists/netfilter/msg11791.html>
>
> ... -m helper --helper pptp ...
>
>
> Bye
>
>
>
> Le 10/08/2017 =C3=A0 12:04, Alexey Kurinnij a =C3=A9crit :
>
>> Hi. I have debian box with nat as gateway.
>> With debbian jessie pptp from local network worked, with loaded kernel
>> module ip_nat_pptp.
>> After upgrade to debian stretch - pptp not working any more, module
>> ip_nat_pptp loaded.
>> Anyone have similar working configuration?
>>
>> # Generated by iptables-save v1.6.0 on Thu Aug 10 13:04:00 2017
>> *filter
>> :INPUT ACCEPT [0:0]
>> :FORWARD ACCEPT [0:0]
>> :OUTPUT ACCEPT [0:0]
>> -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
>> -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
>> -A INPUT -i lo -j ACCEPT
>> -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
>> -A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT
>> -A INPUT -j DROP
>> -A FORWARD -s 192.168.1.0/24 ! -d 192.168.1.0/24 -i eth0 -j ACCEPT
>> -A FORWARD -d 192.168.1.0/24 -i eth1 -j ACCEPT
>> -A FORWARD -j DROP
>> -A OUTPUT -j ACCEPT
>> COMMIT
>> # Completed on Thu Aug 10 13:04:00 2017
>> # Generated by iptables-save v1.6.0 on Thu Aug 10 13:04:00 2017
>> *nat
>> :PREROUTING ACCEPT [8403:561775]
>> :INPUT ACCEPT [4:194]
>> :OUTPUT ACCEPT [295:18031]
>> :POSTROUTING ACCEPT [295:18031]
>> -A PREROUTING -i eth1 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 2=
2
>> -A POSTROUTING -s 192.168.1.0/24 -o eth1 -j MASQUERADE
>> COMMIT
>> # Completed on Thu Aug 10 13:04:00 2017
>>
>>
>

--001a113ac7ae384df7055665ab02
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Thanks for good point - nf_conntrack_helper was disab=
led by default and it is difference between jessie and stretch</div>When I =
enable it - pptp from local network is working:<br><br>echo 1 &gt; /proc/sy=
s/net/netfilter/nf_conntrack_helper<br></div><div class=3D"gmail_extra"><br=
><div class=3D"gmail_quote">On Thu, Aug 10, 2017 at 2:59 PM, Thierry JAOUEN=
 <span dir=3D"ltr">&lt;<a href=3D"mailto:[email protected]" target=3D"_bla=
nk">[email protected]</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_=
quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1=
ex">Hi,<br>
<br>
Maybe you need the &quot;helper&quot; module ?<br>
<br>
&lt;<a href=3D"https://home.regit.org/netfilter-en/secure-use-of-helpers/" =
rel=3D"noreferrer" target=3D"_blank">https://home.regit.org/netfil<wbr>ter-=
en/secure-use-of-helpers/</a>&gt;<br>
&lt;<a href=3D"http://www.spinics.net/lists/netfilter/msg11791.html" rel=3D=
"noreferrer" target=3D"_blank">http://www.spinics.net/lists/<wbr>netfilter/=
msg11791.html</a>&gt;<br>
<br>
... -m helper --helper pptp ...<br>
<br>
<br>
Bye<div class=3D"HOEnZb"><div class=3D"h5"><br>
<br>
<br>
Le 10/08/2017 =C3=A0 12:04, Alexey Kurinnij a =C3=A9crit :<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
Hi. I have debian box with nat as gateway.<br>
With debbian jessie pptp from local network worked, with loaded kernel<br>
module ip_nat_pptp.<br>
After upgrade to debian stretch - pptp not working any more, module<br>
ip_nat_pptp loaded.<br>
Anyone have similar working configuration?<br>
<br>
# Generated by iptables-save v1.6.0 on Thu Aug 10 13:04:00 2017<br>
*filter<br>
:INPUT ACCEPT [0:0]<br>
:FORWARD ACCEPT [0:0]<br>
:OUTPUT ACCEPT [0:0]<br>
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT<br>
-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT<br>
-A INPUT -i lo -j ACCEPT<br>
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT<br>
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT<br=
>
-A INPUT -j DROP<br>
-A FORWARD -s <a href=3D"http://192.168.1.0/24" rel=3D"noreferrer" target=
=3D"_blank">192.168.1.0/24</a> ! -d <a href=3D"http://192.168.1.0/24" rel=
=3D"noreferrer" target=3D"_blank">192.168.1.0/24</a> -i eth0 -j ACCEPT<br>
-A FORWARD -d <a href=3D"http://192.168.1.0/24" rel=3D"noreferrer" target=
=3D"_blank">192.168.1.0/24</a> -i eth1 -j ACCEPT<br>
-A FORWARD -j DROP<br>
-A OUTPUT -j ACCEPT<br>
COMMIT<br>
# Completed on Thu Aug 10 13:04:00 2017<br>
# Generated by iptables-save v1.6.0 on Thu Aug 10 13:04:00 2017<br>
*nat<br>
:PREROUTING ACCEPT [8403:561775]<br>
:INPUT ACCEPT [4:194]<br>
:OUTPUT ACCEPT [295:18031]<br>
:POSTROUTING ACCEPT [295:18031]<br>
-A PREROUTING -i eth1 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 22<b=
r>
-A POSTROUTING -s <a href=3D"http://192.168.1.0/24" rel=3D"noreferrer" targ=
et=3D"_blank">192.168.1.0/24</a> -o eth1 -j MASQUERADE<br>
COMMIT<br>
# Completed on Thu Aug 10 13:04:00 2017<br>
<br>
</blockquote>
<br>
</div></div></blockquote></div><br></div>

--001a113ac7ae384df7055665ab02--