Re: gaining access to webconf from the net does not work (for me !)

Hi

Am 04.07.2022 um 19:57 schrieb Pascale Desbiens:
> Hello Erich, and List...
> 
>> On Jul 4, 2022, at 04:23, Erich Titl <[email protected] 
>> <mailto:[email protected]>> wrote:
>>
>> Hi
>>
...

>>
>> So you are building a ssh tunnel to your external address then 
>> probably avoiding shorewall (as the tunneled traffic probably takes 
>> the lo interface) to access the inner interface with on port 80.
> 
> Right, this is the answer I get from :
> 
> ssh -L8080:192.168.1.254:80 [email protected] <mailto:[email protected]> -vvv
> 
...
> 
> and on the browser:
> 
> The connection was reset
> 
> The connection to the server was reset while the page was loading.

So we can probably assume that the tunnel itself is working correctly.

> 
>      The site could be temporarily unavailable or too busy. Try again in 
> a few moments.
>      If you are unable to load any pages, check your computer’s network 
> connection.
>      If your computer or network is protected by a firewall or proxy, 
> make sure that Firefox is permitted to access the Web.

If I try the same I can see the packets flowing on the lo interface. Now 
my system is running SSL on the web interface, the interesting thing is:

gatekeeper# tcpdump -i lo -vvv
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 
262144 bytes
18:09:50.706335 IP (tos 0x0, ttl 64, id 20382, offset 0, flags [DF], 
proto TCP (6), length 60)
     194.124.158.1.54656 > 194.124.158.1.https: Flags [S], cksum 0xc12a 
(incorrect -> 0x014f), seq 2273832730, win 65495, options [mss 
65495,sackOK,TS val 435889120 ecr 0,nop,wscale 7], length 0
18:09:50.706391 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 
TCP (6), length 60)
     194.124.158.1.https > 194.124.158.1.54656: Flags [S.], cksum 0xc12a 
(incorrect -> 0x7818), seq 1084033721, ack 2273832731, win 65483, 
options [mss 65495,sackOK,TS val 435889120 ecr 435889120,nop,wscale 7], 
length 0
18:09:50.706444 IP (tos 0x0, ttl 64, id 20383, offset 0, flags [DF], 
proto TCP (6), length 52)
     194.124.158.1.54656 > 194.124.158.1.https: Flags [.], cksum 0xc122 
(incorrect -> 0x9ed4), seq 1, ack 1, win 512, options [nop,nop,TS val 
435889120 ecr 435889120], length 0

tcpdump reports, I hope rightly so, incorrect checksum on the syn packet.

This should not come from the https protocol.

I must admit I am not runnig the latest and greatest version, still 
7.1.0 but I can see very similar problems there. As expected I an error 
in the SSL handshake because I have not imported the CA to my browser. 
This proves that the client really talks to the server but if I accept 
the unknown CA then I get a protocol error.

I also have a wireguard tunnel to the firewall which allows me to 
connect to my internal netwok and thus should allow connection to the 
firewall system itself on the internal interface but I see similar issues.

Can't really make sense out of this.

cheers

ET

------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/