| Newsgroups |
gmane.network.freeswan.user |
| Message-ID |
<[email protected]> |
Hi,
here is my output from ipsec barf.
Greetings,
Kai
--------- BARF OUTPUT ---------
mngateway
Mon Aug 9 08:56:31 CEST 2004
+ _________________________ version
+ ipsec --version
Linux FreeS/WAN U2.04/K(no kernel code presently loaded)
See `ipsec --copyright' for copyright information.
X.509-1.5.3 distributed by Andreas Steffen <[email protected]>
+ _________________________ proc/version
+ cat /proc/version
Linux version 2.6.5-7.95-default (geeko@buildhost) (gcc version 3.3.3 (SuSE Linux)) #1 Thu Jul 1 15:23:45 UTC 2004
+ _________________________ ipsec_verify
+ ipsec verify --nocolour
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux FreeS/WAN U2.04/K(no kernel code presently loaded)
Checking for KLIPS support in kernel [FAILED]
Checking for RSA private key (/etc/ipsec.secrets) [FAILED]
ipsec showhostkey: no default key in "/etc/ipsec.secrets"
Checking that pluto is running [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing
Opportunistic Encryption DNS checks:
Looking for TXT in forward map: mngateway [MISSING]
Does the machine have at least one non-private address? [OK]
Looking for TXT in reverse map: 12.2.6.192.in-addr.arpa. [MISSING]
Looking for TXT in reverse map: 226.191.130.80.in-addr.arpa. [MISSING]
+ _________________________ proc/net/ipsec_eroute
+ sort -sg +3 /proc/net/ipsec_eroute
sort: open failed: /proc/net/ipsec_eroute: No such file or directory
+ cat /proc/net/ipsec_eroute
cat: /proc/net/ipsec_eroute: No such file or directory
+ _________________________ netstat-rn
+ netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
217.5.98.30 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0
192.6.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 217.5.98.30 0.0.0.0 UG 0 0 0 ppp0
+ _________________________ proc/net/ipsec_spi
+ cat /proc/net/ipsec_spi
cat: /proc/net/ipsec_spi: No such file or directory
+ _________________________ proc/net/ipsec_spigrp
+ cat /proc/net/ipsec_spigrp
cat: /proc/net/ipsec_spigrp: No such file or directory
+ _________________________ proc/net/ipsec_tncfg
+ cat /proc/net/ipsec_tncfg
cat: /proc/net/ipsec_tncfg: No such file or directory
+ _________________________ proc/net/pf_key
+ cat /proc/net/pf_key
cat: /proc/net/pf_key: No such file or directory
+ _________________________ proc/net/pf_key-star
+ cd /proc/net
+ egrep '^' 'pf_key_*'
grep: pf_key_*: No such file or directory
+ _________________________ proc/sys/net/ipsec-star
+ cd /proc/sys/net/ipsec
/usr/lib/ipsec/barf: line 168: cd: /proc/sys/net/ipsec: No such file or directory
+ _________________________ ipsec/status
+ ipsec auto --status
000 interface lo/lo ::1
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 192.6.2.12
000 interface ppp0/ppp0 80.130.191.226
000 %myid = (none)
000 debug none
000
000 "L2TP-CERT": 80.130.191.226[C=DE, O=Multinova GmbH, CN=Multinova CA]:17/1701---217.5.98.30...%any[C=DE, O=Multinova GmbH, OU=VPN, CN=VPNCA]:17/1701; unrouted; eroute owner: #0
000 "L2TP-CERT": CAs: 'C=DE, O=Multinova GmbH, CN=Multinova CA'...'%any'
000 "L2TP-CERT": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3
000 "L2TP-CERT": policy: RSASIG+ENCRYPT+TUNNEL+DONTREKEY; prio: 32,32; interface: ppp0;
000 "L2TP-CERT": newest ISAKMP SA: #0; newest IPsec SA: #0;
000
000
+ _________________________ ifconfig-a
+ ifconfig -a
eth0 Link encap:Ethernet HWaddr 00:0D:88:7E:BB:5C
inet addr:192.6.2.12 Bcast:192.6.2.255 Mask:255.255.255.0
inet6 addr: fe80::20d:88ff:fe7e:bb5c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:36118 errors:0 dropped:0 overruns:0 frame:0
TX packets:37397 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5085416 (4.8 Mb) TX bytes:18517723 (17.6 Mb)
Interrupt:9 Base address:0xd800
eth1 Link encap:Ethernet HWaddr 00:50:BA:2C:4C:B9
inet6 addr: fe80::250:baff:fe2c:4cb9/64 Scope:Link
UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1
RX packets:38142 errors:0 dropped:0 overruns:0 frame:1
TX packets:36462 errors:0 dropped:0 overruns:0 carrier:0
collisions:99 txqueuelen:1000
RX bytes:18877041 (18.0 Mb) TX bytes:5380745 (5.1 Mb)
Interrupt:10 Base address:0xd400
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:96 errors:0 dropped:0 overruns:0 frame:0
TX packets:96 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:6192 (6.0 Kb) TX bytes:6192 (6.0 Kb)
ppp0 Link encap:Point-to-Point Protocol
inet addr:80.130.191.226 P-t-P:217.5.98.30 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:37790 errors:0 dropped:0 overruns:0 frame:0
TX packets:35945 errors:0 dropped:1 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:18024451 (17.1 Mb) TX bytes:4481451 (4.2 Mb)
sit0 Link encap:IPv6-in-IPv4
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
+ _________________________ mii-tool
+ '[' -x /sbin/mii-tool ']'
+ /sbin/mii-tool -v
SIOCGMIIPHY on 'eth0' failed: Operation not supported
SIOCGMIIPHY on 'eth1' failed: Operation not supported
no MII interfaces found
+ _________________________ ipsec/directory
+ ipsec --directory
/usr/lib/ipsec
+ _________________________ hostname/fqdn
+ hostname --fqdn
mngateway.local
+ _________________________ hostname/ipaddress
+ hostname --ip-address
192.6.2.12
+ _________________________ uptime
+ uptime
8:56am up 2:54, 2 users, load average: 0.18, 0.77, 1.02
+ _________________________ ps
+ ps alxwf
+ egrep -i 'ppid|pluto|ipsec|klips'
F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND
4 0 9398 8210 25 0 2576 1224 wait4 S+ pts/2 0:00 \_ /bin/sh /usr/lib/ipsec/barf
4 0 9487 9398 25 0 2172 512 - R+ pts/2 0:00 \_ /bin/sh /usr/bin/egrep -i ppid|pluto|ipsec|klips
5 0 9211 1 21 0 2576 1180 wait4 S pts/2 0:00 /bin/sh /usr/lib/ipsec/_plutorun --debug --uniqueids no --nocrsend --strictcrlpolicy --nat_traversal --keep_alive --force_keepalive --disable_port_floating --virtual_private --crlcheckinterval 0 --ocspuri --dump --opts --stderrlog --wait no --pre --post --log daemon.error --pid /var/run/pluto.pid
5 0 9212 9211 25 0 2576 1196 wait4 S pts/2 0:00 \_ /bin/sh /usr/lib/ipsec/_plutorun --debug --uniqueids no --nocrsend --strictcrlpolicy --nat_traversal --keep_alive --force_keepalive --disable_port_floating --virtual_private --crlcheckinterval 0 --ocspuri --dump --opts --stderrlog --wait no --pre --post --log daemon.error --pid /var/run/pluto.pid
4 0 9213 9212 17 0 3608 1376 schedu S pts/2 0:00 | \_ /usr/lib/ipsec/pluto --nofork --secretsfile /etc/ipsec.secrets --policygroupsdir /etc/ipsec.d/policies
4 0 9245 9213 18 0 1304 272 schedu S pts/2 0:00 | \_ _pluto_adns
4 0 9214 9211 17 0 2572 1156 pipe_w S pts/2 0:00 \_ /bin/sh /usr/lib/ipsec/_plutoload --wait no --post
4 0 9215 1 25 0 1624 472 pipe_w S pts/2 0:00 logger -s -p daemon.error -t ipsec__plutorun
+ _________________________ ipsec/showdefaults
+ ipsec showdefaults
routephys=ppp0
routevirt=ipsec0
routeaddr=80.130.191.226
routenexthop=217.5.98.30
+ _________________________ ipsec/conf
+ ipsec _keycensor
+ ipsec _include /etc/ipsec.conf
#< /etc/ipsec.conf 1
# /etc/ipsec.conf - FreeS/WAN IPsec configuration file
# RCSID $Id: ipsec.conf.in,v 1.11 2003/06/13 23:28:41 sam Exp $
# This file: /usr/share/doc/packages/freeswan/ipsec.conf-sample
#
# Manual: ipsec.conf.5
#
# Help:
# http://www.strongsec.com/freeswan/install.htm
version 2.0 # conforms to second version of ipsec.conf specification
config setup
interfaces="%defaultroute"
uniqueids=no
conn %default
left=%defaultroute
leftcert=mnvpngw-cert.pem
auto=add
authby=rsasig
rekey=no
keyingtries=5
rightrsasigkey=%cert
conn L2TP-CERT
authby=rsasig
pfs=no
leftrsasigkey=%cert
leftprotoport=17/1701
right=%any
rightid="C=DE, O=Multinova GmbH, OU=VPN, CN=VPNCA"
rightprotoport=17/1701
auto=add
keyingtries=3
conn block
auto=ignore
conn clear
auto=ignore
conn private
auto=ignore
conn private-or-clear
auto=ignore
conn clear-or-private
auto=ignore
conn packetdefault
auto=ignore
+ _________________________ ipsec/secrets
+ ipsec _include /etc/ipsec.secrets
+ ipsec _secretcensor
+ _________________________ ipsec/listall
+ ipsec auto --listall
000
000 List of Public Keys:
000
000 Aug 09 08:54:43 2004, 2048 RSA Key AwEAAcRDN, until May 04 09:34:26 2007 ok
000 ID_DER_ASN1_DN 'C=DE, O=Multinova GmbH, CN=Multinova CA'
000 Issuer 'C=DE, O=Multinova GmbH, CN=Multinova CA'
000
000 List of X.509 End Certificates:
000
000 Aug 09 08:54:43 2004, count: 1
000 subject: 'C=DE, O=Multinova GmbH, CN=Multinova CA'
000 issuer: 'C=DE, O=Multinova GmbH, CN=Multinova CA'
000 serial: 01
000 pubkey: 2048 RSA Key AwEAAcRDN
000 validity: not before Aug 07 09:34:26 2004 ok
000 not after May 04 09:34:26 2007 ok
000 subjkey: 95:69:34:87:11:8c:13:ca:44:db:3b:1b:4e:e3:fc:1e:0e:2e:61:5c
000 authkey: 0a:f9:ce:f7:f4:fc:19:8a:e3:f9:6e:9e:f0:ec:23:d8:6f:5c:c0:24
000 aserial: 00
000
000 List of X.509 CA Certificates:
000
000 Aug 09 08:54:42 2004, count: 1
000 subject: 'C=DE, O=Multinova GmbH, CN=Multinova CA'
000 issuer: 'C=DE, O=Multinova GmbH, CN=Multinova CA'
000 serial: 00
000 pubkey: 2048 RSA Key AwEAAeYoP
000 validity: not before Aug 07 09:22:08 2004 ok
000 not after Sep 15 09:22:08 2008 ok
000 subjkey: 0a:f9:ce:f7:f4:fc:19:8a:e3:f9:6e:9e:f0:ec:23:d8:6f:5c:c0:24
000 authkey: 0a:f9:ce:f7:f4:fc:19:8a:e3:f9:6e:9e:f0:ec:23:d8:6f:5c:c0:24
000 aserial: 00
+ '[' /etc/ipsec.d/policies ']'
++ basename /etc/ipsec.d/policies/block
+ base=block
+ _________________________ ipsec/policies/block
+ cat /etc/ipsec.d/policies/block
# This file defines the set of CIDRs (network/mask-length) to which
# communication should never be allowed.
#
# See /usr/share/doc/packages/freeswan/policygroups.html for details.
#
# $Id: block.in,v 1.4 2003/02/17 02:22:15 mcr Exp $
#
++ basename /etc/ipsec.d/policies/clear
+ base=clear
+ _________________________ ipsec/policies/clear
+ cat /etc/ipsec.d/policies/clear
# This file defines the set of CIDRs (network/mask-length) to which
# communication should always be in the clear.
#
# See /usr/share/doc/packages/freeswan/policygroups.html for details.
#
# $Id: clear.in,v 1.4 2003/02/17 02:22:15 mcr Exp $
#
++ basename /etc/ipsec.d/policies/clear-or-private
+ base=clear-or-private
+ _________________________ ipsec/policies/clear-or-private
+ cat /etc/ipsec.d/policies/clear-or-private
# This file defines the set of CIDRs (network/mask-length) to which
# we will communicate in the clear, or, if the other side initiates IPSEC,
# using encryption. This behaviour is also called "Opportunistic Responder".
#
# See /usr/share/doc/packages/freeswan/policygroups.html for details.
#
# $Id: clear-or-private.in,v 1.4 2003/02/17 02:22:15 mcr Exp $
#
++ basename /etc/ipsec.d/policies/private
+ base=private
+ _________________________ ipsec/policies/private
+ cat /etc/ipsec.d/policies/private
# This file defines the set of CIDRs (network/mask-length) to which
# communication should always be private (i.e. encrypted).
# See /usr/share/doc/packages/freeswan/policygroups.html for details.
#
# $Id: private.in,v 1.4 2003/02/17 02:22:15 mcr Exp $
#
++ basename /etc/ipsec.d/policies/private-or-clear
+ base=private-or-clear
+ _________________________ ipsec/policies/private-or-clear
+ cat /etc/ipsec.d/policies/private-or-clear
# This file defines the set of CIDRs (network/mask-length) to which
# communication should be private, if possible, but in the clear otherwise.
#
# If the target has a TXT (later IPSECKEY) record that specifies
# authentication material, we will require private (i.e. encrypted)
# communications. If no such record is found, communications will be
# in the clear.
#
# See /usr/share/doc/packages/freeswan/policygroups.html for details.
#
# $Id: private-or-clear.in,v 1.5 2003/02/17 02:22:15 mcr Exp $
#
0.0.0.0/0
+ _________________________ ipsec/ls-libdir
+ ls -l /usr/lib/ipsec
total 1149
-rwxr-xr-x 1 root root 15206 Apr 7 00:25 _confread
-rwxr-xr-x 1 root root 6687 Apr 7 00:25 _copyright
-rwxr-xr-x 1 root root 2379 Apr 7 00:25 _include
-rwxr-xr-x 1 root root 1475 Apr 7 00:25 _keycensor
-rwxr-xr-x 1 root root 10908 Apr 7 00:25 _pluto_adns
-rwxr-xr-x 1 root root 3586 Apr 7 00:25 _plutoload
-rwxr-xr-x 1 root root 6897 Apr 7 00:25 _plutorun
-rwxr-xr-x 1 root root 10350 Apr 7 00:25 _realsetup
-rwxr-xr-x 1 root root 1975 Apr 7 00:25 _secretcensor
-rwxr-xr-x 1 root root 8069 Apr 7 00:25 _startklips
-rwxr-xr-x 1 root root 7959 Apr 7 00:25 _updown
-rwxr-xr-x 1 root root 11992 Apr 7 00:25 _updown_x509
-rwxr-xr-x 1 root root 16591 Apr 7 00:25 auto
-rwxr-xr-x 1 root root 8628 Apr 7 00:25 barf
-rwxr-xr-x 1 root root 816 Apr 7 00:25 calcgoo
-rw-r--r-- 1 root root 75 Apr 7 00:25 distro.txt
-rwxr-xr-x 1 root root 80853 Apr 7 00:25 eroute
-rwxr-xr-x 1 root root 960 Apr 7 00:25 ipsec_1_to_2.pl
-rw-r--r-- 1 root root 1942 Apr 7 00:25 ipsec_pr.template
-rwxr-xr-x 1 root root 59296 Apr 7 00:25 klipsdebug
-rwxr-xr-x 1 root root 2449 Apr 7 00:25 look
-rwxr-xr-x 1 root root 7118 Apr 7 00:25 mailkey
-rwxr-xr-x 1 root root 16188 Apr 7 00:25 manual
-rwxr-xr-x 1 root root 1921 Apr 7 00:25 newhostkey
-rwxr-xr-x 1 root root 53459 Apr 7 00:25 pf_key
-rwxr-xr-x 1 root root 489037 Apr 7 00:25 pluto
-rwxr-xr-x 1 root root 9532 Apr 7 00:25 ranbits
-rwxr-xr-x 1 root root 23511 Apr 7 00:25 rsasigkey
-rwxr-xr-x 1 root root 765 Apr 7 00:25 secrets
-rwxr-xr-x 1 root root 17566 Apr 7 00:25 send-pr
lrwxrwxrwx 1 root root 17 Aug 2 10:30 setup -> /etc/init.d/ipsec
-rwxr-xr-x 1 root root 1048 Apr 7 00:25 showdefaults
-rwxr-xr-x 1 root root 4321 Apr 7 00:25 showhostkey
-rwxr-xr-x 1 root root 89321 Apr 7 00:25 spi
-rwxr-xr-x 1 root root 67842 Apr 7 00:25 spigrp
-rwxr-xr-x 1 root root 12170 Apr 7 00:25 tncfg
-rwxr-xr-x 1 root root 9280 Apr 7 00:25 verify
-rwxr-xr-x 1 root root 40750 Apr 7 00:25 whack
+ _________________________ ipsec/ls-execdir
+ ls -l /usr/lib/ipsec
total 1149
-rwxr-xr-x 1 root root 15206 Apr 7 00:25 _confread
-rwxr-xr-x 1 root root 6687 Apr 7 00:25 _copyright
-rwxr-xr-x 1 root root 2379 Apr 7 00:25 _include
-rwxr-xr-x 1 root root 1475 Apr 7 00:25 _keycensor
-rwxr-xr-x 1 root root 10908 Apr 7 00:25 _pluto_adns
-rwxr-xr-x 1 root root 3586 Apr 7 00:25 _plutoload
-rwxr-xr-x 1 root root 6897 Apr 7 00:25 _plutorun
-rwxr-xr-x 1 root root 10350 Apr 7 00:25 _realsetup
-rwxr-xr-x 1 root root 1975 Apr 7 00:25 _secretcensor
-rwxr-xr-x 1 root root 8069 Apr 7 00:25 _startklips
-rwxr-xr-x 1 root root 7959 Apr 7 00:25 _updown
-rwxr-xr-x 1 root root 11992 Apr 7 00:25 _updown_x509
-rwxr-xr-x 1 root root 16591 Apr 7 00:25 auto
-rwxr-xr-x 1 root root 8628 Apr 7 00:25 barf
-rwxr-xr-x 1 root root 816 Apr 7 00:25 calcgoo
-rw-r--r-- 1 root root 75 Apr 7 00:25 distro.txt
-rwxr-xr-x 1 root root 80853 Apr 7 00:25 eroute
-rwxr-xr-x 1 root root 960 Apr 7 00:25 ipsec_1_to_2.pl
-rw-r--r-- 1 root root 1942 Apr 7 00:25 ipsec_pr.template
-rwxr-xr-x 1 root root 59296 Apr 7 00:25 klipsdebug
-rwxr-xr-x 1 root root 2449 Apr 7 00:25 look
-rwxr-xr-x 1 root root 7118 Apr 7 00:25 mailkey
-rwxr-xr-x 1 root root 16188 Apr 7 00:25 manual
-rwxr-xr-x 1 root root 1921 Apr 7 00:25 newhostkey
-rwxr-xr-x 1 root root 53459 Apr 7 00:25 pf_key
-rwxr-xr-x 1 root root 489037 Apr 7 00:25 pluto
-rwxr-xr-x 1 root root 9532 Apr 7 00:25 ranbits
-rwxr-xr-x 1 root root 23511 Apr 7 00:25 rsasigkey
-rwxr-xr-x 1 root root 765 Apr 7 00:25 secrets
-rwxr-xr-x 1 root root 17566 Apr 7 00:25 send-pr
lrwxrwxrwx 1 root root 17 Aug 2 10:30 setup -> /etc/init.d/ipsec
-rwxr-xr-x 1 root root 1048 Apr 7 00:25 showdefaults
-rwxr-xr-x 1 root root 4321 Apr 7 00:25 showhostkey
-rwxr-xr-x 1 root root 89321 Apr 7 00:25 spi
-rwxr-xr-x 1 root root 67842 Apr 7 00:25 spigrp
-rwxr-xr-x 1 root root 12170 Apr 7 00:25 tncfg
-rwxr-xr-x 1 root root 9280 Apr 7 00:25 verify
-rwxr-xr-x 1 root root 40750 Apr 7 00:25 whack
+ _________________________ ipsec/updowns
++ ls /usr/lib/ipsec
++ egrep updown
+ cat /usr/lib/ipsec/_updown
#! /bin/sh
# iproute2 version, default updown script
# Copyright (C) 2002. Michael Richardson
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
#
# RCSID $Id: _updown.ip2.in,v 1.2 2003/08/18 16:34:29 mcr Exp $
# CAUTION: Installing a new version of FreeS/WAN will install a new
# copy of this script, wiping out any custom changes you make. If
# you need changes, make a copy of this under another name, and customize
# that, and use the (left/right)updown parameters in ipsec.conf to make
# FreeS/WAN use yours instead of this default one.
# things that this script gets (from ipsec_pluto(8) man page)
#
#
# PLUTO_VERSION
# indicates what version of this interface is being
# used. This document describes version 1.1. This
# is upwardly compatible with version 1.0.
#
# PLUTO_VERB
# specifies the name of the operation to be performed
# (prepare-host,r prepare-client, up-host, up-client,
# down-host, or down-client). If the address family
# for security gateway to security gateway communica
# tions is IPv6, then a suffix of -v6 is added to the
# verb.
#
# PLUTO_CONNECTION
# is the name of the connection for which we are
# routing.
#
# PLUTO_NEXT_HOP
# is the next hop to which packets bound for the peer
# must be sent.
#
# PLUTO_INTERFACE
# is the name of the ipsec interface to be used.
#
# PLUTO_ME
# is the IP address of our host.
#
# PLUTO_MY_CLIENT
# is the IP address / count of our client subnet. If
# the client is just the host, this will be the
# host's own IP address / max (where max is 32 for
# IPv4 and 128 for IPv6).
#
# PLUTO_MY_CLIENT_NET
# is the IP address of our client net. If the client
# is just the host, this will be the host's own IP
# address.
#
# PLUTO_MY_CLIENT_MASK
# is the mask for our client net. If the client is
# just the host, this will be 255.255.255.255.
#
# PLUTO_PEER
# is the IP address of our peer.
#
# PLUTO_PEER_CLIENT
# is the IP address / count of the peer's client sub
# net. If the client is just the peer, this will be
# the peer's own IP address / max (where max is 32
# for IPv4 and 128 for IPv6).
#
# PLUTO_PEER_CLIENT_NET
# is the IP address of the peer's client net. If the
# client is just the peer, this will be the peer's
# own IP address.
#
# PLUTO_PEER_CLIENT_MASK
# is the mask for the peer's client net. If the
# client is just the peer, this will be
# 255.255.255.255.
#
# PLUTO_PEER_SOURCEIP
# PLUTO_CONNECTION_TYPE
#
# check interface version
case "$PLUTO_VERSION" in
1.[0]) # Older Pluto?!? Play it safe, script may be using new features.
echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
echo "$0: called by obsolete Pluto?" >&2
exit 2
;;
1.*) ;;
*) echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2
exit 2
;;
esac
# check parameter(s)
case "$1:$*" in
':') # no parameters
;;
ipfwadm:ipfwadm) # due to (left/right)firewall; for default script only
;;
custom:*) # custom parameters (see above CAUTION comment)
;;
*) echo "$0: unknown parameters \`$*'" >&2
exit 2
;;
esac
# utility functions for route manipulation
# Meddling with this stuff should not be necessary and requires great care.
uproute() {
doroute add
}
downroute() {
doroute del
}
doroute() {
parms="$PLUTO_PEER_CLIENT"
parms2=""
if [ -n "$PLUTO_NEXT_HOP" ]
then
parms2="via $PLUTO_NEXT_HOP"
fi
parms2="$parms2 dev $PLUTO_INTERFACE"
if [ -z "$PLUTO_PEER_SOURCEIP" ]
then
if [ -f /etc/sysconfig/defaultsource ]
then
. /etc/sysconfig/defaultsource
if [ -n "$DEFAULTSOURCE" ]
then
PLUTO_PEER_SOURCEIP=$DEFAULTSOURCE
fi
fi
fi
if [ -n "$PLUTO_PEER_SOURCEIP" ]
then
parms2="$parms2 src $DEFAULTSOURCE"
fi
case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
"0.0.0.0/0.0.0.0")
# need to provide route that eclipses default, without
# replacing it.
it="ip route $1 0.0.0.0/1 $parms2 &&"
it="$it ip route $1 128.0.0.0/1 $parms2"
ip route $1 0.0.0.0/1 $parms2 &&
ip route $1 128.0.0.0/1 $parms2
;;
*) it="ip route $1 $parms $parms2"
ip route $1 $parms $parms2
;;
esac
st=$?
if test $st -ne 0
then
# route has already given its own cryptic message
echo "$0: \`$it' failed" >&2
if test " $1 $st" = " add 7"
then
# another totally undocumented interface -- 7 and
# "SIOCADDRT: Network is unreachable" means that
# the gateway isn't reachable.
echo "$0: (incorrect or missing nexthop setting??)" >&2
fi
fi
return $st
}
# the big choice
case "$PLUTO_VERB:$1" in
prepare-host:*|prepare-client:*)
# delete possibly-existing route (preliminary to adding a route)
case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
"0.0.0.0/0.0.0.0")
# need to provide route that eclipses default, without
# replacing it.
parms1="0.0.0.0/1"
parms2="128.0.0.0/1"
it="ip route del $parms1 2>&1 ; ip route del $parms2 2>&1"
oops="`ip route del $parms1 2>&1 ; ip route del $parms2 2>&1`"
;;
*)
parms="$PLUTO_PEER_CLIENT"
it="ip route del $parms 2>&1"
oops="`ip route del $parms 2>&1`"
;;
esac
status="$?"
if test " $oops" = " " -a " $status" != " 0"
then
oops="silent error, exit status $status"
fi
case "$oops" in
'RTNETLINK answers: No such process'*)
# This is what route (currently -- not documented!) gives
# for "could not find such a route".
oops=
status=0
;;
esac
if test " $oops" != " " -o " $status" != " 0"
then
echo "$0: \`$it' failed ($oops)" >&2
fi
exit $status
;;
route-host:*|route-client:*)
# connection to me or my client subnet being routed
uproute
;;
unroute-host:*|unroute-client:*)
# connection to me or my client subnet being unrouted
downroute
;;
up-host:*)
# connection to me coming up
# If you are doing a custom version, firewall commands go here.
;;
down-host:*)
# connection to me going down
# If you are doing a custom version, firewall commands go here.
;;
up-client:)
# connection to my client subnet coming up
# If you are doing a custom version, firewall commands go here.
;;
down-client:)
# connection to my client subnet going down
# If you are doing a custom version, firewall commands go here.
;;
up-client:ipfwadm)
# connection to client subnet, with (left/right)firewall=yes, coming up
# This is used only by the default updown script, not by your custom
# ones, so do not mess with it; see CAUTION comment up at top.
ipfwadm -F -i accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
-D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
;;
down-client:ipfwadm)
# connection to client subnet, with (left/right)firewall=yes, going down
# This is used only by the default updown script, not by your custom
# ones, so do not mess with it; see CAUTION comment up at top.
ipfwadm -F -d accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
-D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
;;
*) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
exit 1
;;
esac
+ cat /usr/lib/ipsec/_updown_x509
#! /bin/sh
# iproute2 version, default updown script
# Copyright (C) 2002. Michael Richardson
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
#
# RCSID $Id: _updown.ip2.in,v 1.2 2003/08/18 16:34:29 mcr Exp $
# CAUTION: Installing a new version of FreeS/WAN will install a new
# copy of this script, wiping out any custom changes you make. If
# you need changes, make a copy of this under another name, and customize
# that, and use the (left/right)updown parameters in ipsec.conf to make
# FreeS/WAN use yours instead of this default one.
# things that this script gets (from ipsec_pluto(8) man page)
#
#
# PLUTO_VERSION
# indicates what version of this interface is being
# used. This document describes version 1.1. This
# is upwardly compatible with version 1.0.
#
# PLUTO_VERB
# specifies the name of the operation to be performed
# (prepare-host,r prepare-client, up-host, up-client,
# down-host, or down-client). If the address family
# for security gateway to security gateway communica
# tions is IPv6, then a suffix of -v6 is added to the
# verb.
#
# PLUTO_CONNECTION
# is the name of the connection for which we are
# routing.
#
# PLUTO_NEXT_HOP
# is the next hop to which packets bound for the peer
# must be sent.
#
# PLUTO_INTERFACE
# is the name of the ipsec interface to be used.
#
# PLUTO_ME
# is the IP address of our host.
#
# PLUTO_MY_ID
# is the ID of our host.
#
# PLUTO_MY_CLIENT
# is the IP address / count of our client subnet. If
# the client is just the host, this will be the
# host's own IP address / max (where max is 32 for
# IPv4 and 128 for IPv6).
#
# PLUTO_MY_CLIENT_NET
# is the IP address of our client net. If the client
# is just the host, this will be the host's own IP
# address.
#
# PLUTO_MY_CLIENT_MASK
# is the mask for our client net. If the client is
# just the host, this will be 255.255.255.255.
#
# PLUTO_MY_PROTOCOL
# is the IP protocol that will be transported.
#
# PLUTO_MY_PORT
# is the UDP/TCP port to which the IPsec SA is
# restricted on our side.
#
# PLUTO_PEER
# is the IP address of our peer.
#
# PLUTO_PEER_ID
# is the ID of our peer.
#
# PLUTO_PEER_CA
# is the CA which issued the cert of our peer.
#
# PLUTO_PEER_CLIENT
# is the IP address / count of the peer's client sub
# net. If the client is just the peer, this will be
# the peer's own IP address / max (where max is 32
# for IPv4 and 128 for IPv6).
#
# PLUTO_PEER_CLIENT_NET
# is the IP address of the peer's client net. If the
# client is just the peer, this will be the peer's
# own IP address.
#
# PLUTO_PEER_CLIENT_MASK
# is the mask for the peer's client net. If the
# client is just the peer, this will be
# 255.255.255.255.
#
# PLUTO_PEER_PROTOCOL
# is the IP protocol that will be transported.
#
# PLUTO_PEER_PORT
# is the UDP/TCP port to which the IPsec SA is
# restricted on the peer side.
#
# PLUTO_PEER_SOURCEIP
# PLUTO_CONNECTION_TYPE
#
# logging of VPN connections
#
# tag put in front of each log entry:
TAG=vpn
#
# syslog facility and priority used:
FAC_PRIO=local0.notice
#
# to create a special vpn logging file, put the following line into
# the syslog configuration file /etc/syslog.conf:
#
# local0.notice -/var/log/vpn
#
# check interface version
case "$PLUTO_VERSION" in
1.[0]) # Older Pluto?!? Play it safe, script may be using new features.
echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
echo "$0: called by obsolete Pluto?" >&2
exit 2
;;
1.*) ;;
*) echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2
exit 2
;;
esac
# check parameter(s)
case "$1:$*" in
':') # no parameters
;;
ipfwadm:ipfwadm) # due to (left/right)firewall; for default script only
;;
custom:*) # custom parameters (see above CAUTION comment)
;;
*) echo "$0: unknown parameters \`$*'" >&2
exit 2
;;
esac
# utility functions for route manipulation
# Meddling with this stuff should not be necessary and requires great care.
uproute() {
doroute add
}
downroute() {
doroute del
}
doroute() {
parms="$PLUTO_PEER_CLIENT"
parms2=""
if [ -n "$PLUTO_NEXT_HOP" ]
then
parms2="via $PLUTO_NEXT_HOP"
fi
parms2="$parms2 dev $PLUTO_INTERFACE"
if [ -z "$PLUTO_PEER_SOURCEIP" ]
then
if [ -f /etc/sysconfig/defaultsource ]
then
. /etc/sysconfig/defaultsource
if [ -n "$DEFAULTSOURCE" ]
then
PLUTO_PEER_SOURCEIP=$DEFAULTSOURCE
fi
fi
fi
if [ -n "$PLUTO_PEER_SOURCEIP" ]
then
parms2="$parms2 src $DEFAULTSOURCE"
fi
case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
"0.0.0.0/0.0.0.0")
# need to provide route that eclipses default, without
# replacing it.
it="ip route $1 0.0.0.0/1 $parms2 &&"
it="$it ip route $1 128.0.0.0/1 $parms2"
ip route $1 0.0.0.0/1 $parms2 &&
ip route $1 128.0.0.0/1 $parms2
;;
*) it="ip route $1 $parms $parms2"
ip route $1 $parms $parms2
;;
esac
st=$?
if test $st -ne 0
then
# route has already given its own cryptic message
echo "$0: \`$it' failed" >&2
if test " $1 $st" = " add 7"
then
# another totally undocumented interface -- 7 and
# "SIOCADDRT: Network is unreachable" means that
# the gateway isn't reachable.
echo "$0: (incorrect or missing nexthop setting??)" >&2
fi
fi
return $st
}
# are there port numbers?
if [ "$PLUTO_MY_PORT" != 0 ]
then
S_MY_PORT="--sport $PLUTO_MY_PORT"
D_MY_PORT="--dport $PLUTO_MY_PORT"
fi
if [ "$PLUTO_PEER_PORT" != 0 ]
then
S_PEER_PORT="--sport $PLUTO_PEER_PORT"
D_PEER_PORT="--dport $PLUTO_PEER_PORT"
fi
# the big choice
case "$PLUTO_VERB:$1" in
prepare-host:*|prepare-client:*)
# delete possibly-existing route (preliminary to adding a route)
case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
"0.0.0.0/0.0.0.0")
# need to provide route that eclipses default, without
# replacing it.
parms1="0.0.0.0/1"
parms2="128.0.0.0/1"
it="ip route del $parms1 2>&1 ; ip route del $parms2 2>&1"
oops="`ip route del $parms1 2>&1 ; ip route del $parms2 2>&1`"
;;
*)
parms="$PLUTO_PEER_CLIENT"
it="ip route del $parms 2>&1"
oops="`ip route del $parms 2>&1`"
;;
esac
status="$?"
if test " $oops" = " " -a " $status" != " 0"
then
oops="silent error, exit status $status"
fi
case "$oops" in
'RTNETLINK answers: No such process'*)
# This is what route (currently -- not documented!) gives
# for "could not find such a route".
oops=
status=0
;;
esac
if test " $oops" != " " -o " $status" != " 0"
then
echo "$0: \`$it' failed ($oops)" >&2
fi
exit $status
;;
route-host:*|route-client:*)
# connection to me or my client subnet being routed
uproute
;;
unroute-host:*|unroute-client:*)
# connection to me or my client subnet being unrouted
downroute
;;
up-host:*)
# connection to me coming up
# If you are doing a custom version, firewall commands go here.
iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \
-d $PLUTO_ME $D_MY_PORT -j ACCEPT
iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-s $PLUTO_ME $S_MY_PORT \
-d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT
#
if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
then
logger -t $TAG -p $FAC_PRIO \
"+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME"
else
logger -t $TAG -p $FAC_PRIO \
"+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
fi
;;
down-host:*)
# connection to me going down
# If you are doing a custom version, firewall commands go here.
# connection to me going down
# If you are doing a custom version, firewall commands go here.
iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \
-d $PLUTO_ME $D_MY_PORT -j ACCEPT
iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-s $PLUTO_ME $S_MY_PORT \
-d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT
#
if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
then
logger -t $TAG -p $FAC_PRIO -- \
"- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME"
else
logger -t $TAG -p $FAC_PRIO -- \
"- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
fi
;;
up-client:)
# connection to my client subnet coming up
# If you are doing a custom version, firewall commands go here.
iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $S_MY_PORT \
-d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT
iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \
-d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $D_MY_PORT -j ACCEPT
#
if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
then
logger -t $TAG -p $FAC_PRIO \
"+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
else
logger -t $TAG -p $FAC_PRIO \
"+ `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
fi
;;
down-client:)
# connection to my client subnet going down
# If you are doing a custom version, firewall commands go here.
iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $S_MY_PORT \
-d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $D_PEER_PORT -j ACCEPT
iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK $S_PEER_PORT \
-d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK $D_MY_PORT -j ACCEPT
#
if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
then
logger -t $TAG -p $FAC_PRIO -- \
"- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
else
logger -t $TAG -p $FAC_PRIO -- \
"- `echo -e $PLUTO_PEER_ID` $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
fi
;;
up-client:ipfwadm)
# connection to client subnet, with (left/right)firewall=yes, coming up
# This is used only by the default updown script, not by your custom
# ones, so do not mess with it; see CAUTION comment up at top.
ipfwadm -F -i accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
-D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
;;
down-client:ipfwadm)
# connection to client subnet, with (left/right)firewall=yes, going down
# This is used only by the default updown script, not by your custom
# ones, so do not mess with it; see CAUTION comment up at top.
ipfwadm -F -d accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
-D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
;;
*) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
exit 1
;;
esac
+ _________________________ proc/net/dev
+ cat /proc/net/dev
Inter-| Receive | Transmit
face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed
lo: 6192 96 0 0 0 0 0 0 6192 96 0 0 0 0 0 0
sit0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
eth0: 5085416 36118 0 0 0 0 0 0 18517723 37397 0 0 0 0 0 0
eth1:18877041 38142 0 0 0 1 0 0 5380745 36462 0 0 0 99 0 0
ppp0:18024451 37790 0 0 0 0 0 0 4481451 35945 0 1 0 0 0 0
+ _________________________ proc/net/route
+ cat /proc/net/route
Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT
ppp0 1E6205D9 00000000 0005 0 0 0 FFFFFFFF 0 0 0
eth0 000206C0 00000000 0001 0 0 0 00FFFFFF 0 0 0
eth0 0000FEA9 00000000 0001 0 0 0 0000FFFF 0 0 0
lo 0000007F 00000000 0001 0 0 0 000000FF 0 0 0
ppp0 00000000 1E6205D9 0003 0 0 0 00000000 0 0 0
+ _________________________ proc/sys/net/ipv4/ip_forward
+ cat /proc/sys/net/ipv4/ip_forward
1
+ _________________________ proc/sys/net/ipv4/conf/star-rp_filter
+ cd /proc/sys/net/ipv4/conf
+ egrep '^' all/rp_filter default/rp_filter eth0/rp_filter lo/rp_filter ppp0/rp_filter
all/rp_filter:1
default/rp_filter:1
eth0/rp_filter:1
lo/rp_filter:1
ppp0/rp_filter:1
+ _________________________ uname-a
+ uname -a
Linux mngateway 2.6.5-7.95-default #1 Thu Jul 1 15:23:45 UTC 2004 i686 athlon i386 GNU/Linux
+ _________________________ redhat-release
+ test -r /etc/redhat-release
+ _________________________ proc/net/ipsec_version
+ cat /proc/net/ipsec_version
cat: /proc/net/ipsec_version: No such file or directory
+ _________________________ iptables/list
+ iptables -L -v -n
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
92 5980 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- ppp0 * 0.0.0.0/0 255.255.255.255
0 0 input_int all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x1701d
657 40844 input_ext all -- ppp0 * 0.0.0.0/0 0.0.0.0/0
64 17402 input_int all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- eth0 * 0.0.0.0/0 80.130.191.226 LOG flags 6 level 4 prefix `SFW2-IN-ACC_DENIED_INT '
0 0 DROP all -- eth0 * 0.0.0.0/0 80.130.191.226
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SFW2-IN-ILL-TARGET '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
8862 524K TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
0 0 ACCEPT all -- eth0 eth0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- ppp0 ppp0 0.0.0.0/0 0.0.0.0/0
37130 18M forward_ext all -- ppp0 * 0.0.0.0/0 0.0.0.0/0
35791 4471K forward_int all -- eth0 * 0.0.0.0/0 0.0.0.0/0
1 60 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SFW2-FWD-ILL-ROUTING '
1 60 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SFW2-FORWARD-ERROR '
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
92 5980 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11 LOG flags 6 level 4 prefix `SFW2-OUT-TRACERT-ATTEMPT '
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11
5 959 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 4
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 9
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 10
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 13
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3
169 13456 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SFW2-OUTPUT-ERROR '
Chain forward_dmz (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 192.6.2.12 LOG flags 6 level 4 prefix `SFW2-FWDdmz-DROP-CIRCUMV '
0 0 DROP all -- * * 0.0.0.0/0 192.6.2.12
0 0 LOG all -- * * 0.0.0.0/0 80.130.191.226 LOG flags 6 level 4 prefix `SFW2-FWDdmz-DROP-CIRCUMV '
0 0 DROP all -- * * 0.0.0.0/0 80.130.191.226
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED icmp type 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0
0 0 ACCEPT all -- * ppp0 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
0 0 ACCEPT all -- ppp0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-FWDdmz-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SFW2-FWDdmz-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SFW2-FWDdmz-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SFW2-FWDdmz-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SFW2-FWDdmz-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SFW2-FWDdmz-DROP-DEFLT '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SFW2-FWDdmz-DROP-DEFLT '
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SFW2-FWDdmz-DROP-DEFLT-INV '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain forward_ext (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 192.6.2.12 LOG flags 6 level 4 prefix `SFW2-FWDext-DROP-CIRCUMV '
0 0 DROP all -- * * 0.0.0.0/0 192.6.2.12
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED icmp type 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0
0 0 ACCEPT all -- * ppp0 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
37130 18M ACCEPT all -- ppp0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-FWDext-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SFW2-FWDext-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SFW2-FWDext-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SFW2-FWDext-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SFW2-FWDext-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SFW2-FWDext-DROP-DEFLT '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SFW2-FWDext-DROP-DEFLT '
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SFW2-FWDext-DROP-DEFLT-INV '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain forward_int (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 80.130.191.226 LOG flags 6 level 4 prefix `SFW2-FWDint-DROP-CIRCUMV '
0 0 DROP all -- * * 0.0.0.0/0 80.130.191.226
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED icmp type 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0
35790 4471K ACCEPT all -- * ppp0 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
0 0 ACCEPT all -- ppp0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-FWDint-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SFW2-FWDint-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SFW2-FWDint-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SFW2-FWDint-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SFW2-FWDint-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SFW2-FWDint-DROP-DEFLT '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SFW2-FWDint-DROP-DEFLT '
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SFW2-FWDint-DROP-DEFLT-INV '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain input_dmz (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 11
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 12
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 14
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 18
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 2 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-ICMP-CRIT '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 reject_func tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:111 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:111 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:631 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:631 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:10000 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:10000 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INdmz-ACC-HiTCP '
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:22 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:68 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:111 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:111 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:631 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:631 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1026 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:10000 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:10000 state NEW
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW udp dpts:1024:65535
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-DEFLT '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-DEFLT '
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SFW2-INdmz-DROP-DEFLT-INV '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain input_ext (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SFW2-INext-ACC-SOURCEQUENCH '
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4
4 208 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 11
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 12
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 14
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 18
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SFW2-INext-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SFW2-INext-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SFW2-INext-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SFW2-INext-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 2 LOG flags 6 level 4 prefix `SFW2-INext-DROP-ICMP-CRIT '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:50 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP '
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:50
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:500 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP '
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:500
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP '
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:53
6 288 reject_func tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INext-DROP '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:111 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INext-DROP '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:111 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:631 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INext-DROP '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:631 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:10000 flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INext-DROP '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:10000 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-HiTCP '
84 8464 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:500
32 3666 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:22 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:68 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:111 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:111 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:631 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:631 state NEW
1 836 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1026 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:10000 state NEW
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:10000 state NEW
4 964 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW udp dpts:1024:65535
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED udp dpts:61000:65095
509 25300 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT '
9 702 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT '
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT-INV '
526 26418 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain input_int (2 references)
pkts bytes target prot opt in out source destination
64 17402 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 11
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 12
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 14
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 18
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SFW2-INint-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SFW2-INint-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SFW2-INint-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SFW2-INint-DROP-ICMP-CRIT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 2 LOG flags 6 level 4 prefix `SFW2-INint-DROP-ICMP-CRIT '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT esp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
0 0 reject_func tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 flags:0x16/0x02
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INint-ACC-HiTCP '
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:1024
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:1025
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW udp dpts:1024:65535
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SFW2-INint-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SFW2-INint-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SFW2-INint-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SFW2-INint-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SFW2-INint-DROP-DEFLT '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SFW2-INint-DROP-DEFLT '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SFW2-INint-DROP-DEFLT '
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SFW2-INint-DROP-DEFLT-INV '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain reject_func (3 references)
pkts bytes target prot opt in out source destination
6 288 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset
0 0 REJECT udp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-proto-unreachable
+ _________________________ ipchains/list
+ ipchains -L -v -n
/usr/lib/ipsec/barf: line 238: ipchains: command not found
+ _________________________ ipfwadm/forward
+ ipfwadm -F -l -n -e
/usr/lib/ipsec/barf: line 240: ipfwadm: command not found
+ _________________________ ipfwadm/input
+ ipfwadm -I -l -n -e
/usr/lib/ipsec/barf: line 242: ipfwadm: command not found
+ _________________________ ipfwadm/output
+ ipfwadm -O -l -n -e
/usr/lib/ipsec/barf: line 244: ipfwadm: command not found
+ _________________________ iptables/nat
+ iptables -t nat -L -v -n
Chain PREROUTING (policy ACCEPT 5062 packets, 323K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 12 packets, 684 bytes)
pkts bytes target prot opt in out source destination
4525 289K MASQUERADE all -- * ppp0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
+ _________________________ ipchains/masq
+ ipchains -M -L -v -n
/usr/lib/ipsec/barf: line 248: ipchains: command not found
+ _________________________ ipfwadm/masq
+ ipfwadm -M -l -n -e
/usr/lib/ipsec/barf: line 250: ipfwadm: command not found
+ _________________________ iptables/mangle
+ iptables -t mangle -L -v -n
Chain PREROUTING (policy ACCEPT 73743 packets, 23M bytes)
pkts bytes target prot opt in out source destination
0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:20 TOS set 0x08
0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:20 TOS set 0x08
27114 16M TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:80 TOS set 0x08
26284 3798K TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:80 TOS set 0x08
0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:53 TOS set 0x10
578 36906 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:53 TOS set 0x10
0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:161 TOS set 0x04
0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:162 TOS set 0x04
0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:514 TOS set 0x04
Chain INPUT (policy ACCEPT 818 packets, 64667 bytes)
pkts bytes target prot opt in out source destination
0 0 MARK esp -- * * 0.0.0.0/0 0.0.0.0/0 MARK set 0x1701d
Chain FORWARD (policy ACCEPT 72925 packets, 22M bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 270 packets, 20607 bytes)
pkts bytes target prot opt in out source destination
0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:20 TOS set 0x08
0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:20 TOS set 0x08
0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:80 TOS set 0x08
102 7108 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:80 TOS set 0x08
0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:53 TOS set 0x10
33 2092 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:53 TOS set 0x10
0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:161 TOS set 0x04
0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:162 TOS set 0x04
0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:514 TOS set 0x04
Chain POSTROUTING (policy ACCEPT 73192 packets, 22M bytes)
pkts bytes target prot opt in out source destination
+ _________________________ proc/modules
+ cat /proc/modules
pppoe 13760 2 - Live 0xd2947000
pppox 3720 1 pppoe, Live 0xd280e000
usbserial 29040 0 - Live 0xd2e9c000
parport_pc 35520 1 - Live 0xd2e92000
lp 11044 0 - Live 0xd2e3f000
parport 37832 2 parport_pc,lp, Live 0xd2e87000
edd 9368 0 - Live 0xd2e3b000
joydev 10304 0 - Live 0xd2d08000
sg 35616 0 - Live 0xd2e53000
st 39068 0 - Live 0xd2e48000
sd_mod 20224 0 - Live 0xd2e1f000
sr_mod 16292 0 - Live 0xd2e1a000
scsi_mod 108748 4 sg,st,sd_mod,sr_mod, Live 0xd2e5e000
ide_cd 36740 0 - Live 0xd2e31000
cdrom 36764 2 sr_mod,ide_cd, Live 0xd2e27000
nvram 8456 0 - Live 0xd2dc8000
deflate 3968 0 - Live 0xd2c37000
zlib_deflate 22808 1 deflate, Live 0xd2e06000
twofish 42624 0 - Live 0xd2e0e000
serpent 17408 0 - Live 0xd2df9000
aes 30528 0 - Live 0xd2df0000
blowfish 10496 0 - Live 0xd2da8000
sha256 10240 0 - Live 0xd2d9b000
sha1 8960 0 - Live 0xd2d6c000
crypto_null 2560 0 - Live 0xd2926000
xfrm_user 13828 0 - Live 0xd2d53000
ipcomp 7424 0 - Live 0xd2d0c000
esp4 10368 0 - Live 0xd2d01000
ah4 7808 0 - Live 0xd2d05000
af_key 31376 0 - Live 0xd2de7000
snd_seq_oss 31232 0 - Live 0xd2dde000
snd_pcm_oss 57512 0 - Live 0xd2dce000
snd_mixer_oss 18944 1 snd_pcm_oss, Live 0xd2da2000
snd_seq_midi 9120 0 - Live 0xd2d68000
snd_seq_midi_event 7680 2 snd_seq_oss,snd_seq_midi, Live 0xd2cfc000
snd_seq 54928 7 snd_seq_oss,snd_seq_midi,snd_seq_midi_event, Live 0xd2dad000
speedstep_lib 3712 0 - Live 0xd2c35000
snd_ens1371 23140 8 - Live 0xd2d79000
snd_rawmidi 25508 2 snd_seq_midi,snd_ens1371, Live 0xd2d71000
snd_seq_device 8456 4 snd_seq_oss,snd_seq_midi,snd_seq,snd_rawmidi, Live 0xd2d64000
snd_pcm 97032 2 snd_pcm_oss,snd_ens1371, Live 0xd2d82000
snd_page_alloc 11528 1 snd_pcm, Live 0xd2d58000
snd_timer 25860 2 snd_seq,snd_pcm, Live 0xd2d5c000
snd_ac97_codec 62468 1 snd_ens1371, Live 0xd2d31000
freq_table 4612 0 - Live 0xd2d1c000
snd 61444 30 snd_seq_oss,snd_pcm_oss,snd_mixer_oss,snd_seq_midi,snd_seq_midi_event,snd_seq,snd_ens1371,snd_rawmidi,snd_seq_device,snd_pcm,snd_timer,snd_ac97_codec, Live 0xd2d42000
soundcore 9056 1 snd, Live 0xd2d2a000
gameport 4736 1 snd_ens1371, Live 0xd2d19000
ipt_MASQUERADE 3840 1 - Live 0xd2d17000
ppp_generic 29332 6 pppoe,pppox, Live 0xd2d21000
slhc 7552 1 ppp_generic, Live 0xd2cf9000
af_packet 20872 4 - Live 0xd2d10000
ohci_hcd 19332 0 - Live 0xd2cca000
amd_k7_agp 7820 1 - Live 0xd2928000
agpgart 30888 1 amd_k7_agp, Live 0xd2cdb000
evdev 9856 0 - Live 0xd2ca5000
via_rhine 20104 0 - Live 0xd2c9a000
mii 5248 1 via_rhine, Live 0xd2c90000
usbcore 103516 4 usbserial,ohci_hcd, Live 0xd2caf000
ipt_TCPMSS 4480 1 - Live 0xd2c89000
ipt_TOS 2688 18 - Live 0xd2c3e000
ipt_state 2176 95 - Live 0xd2c39000
ipt_LOG 5760 89 - Live 0xd2c8d000
ipt_MARK 2304 1 - Live 0xd2c84000
ipt_mark 1920 1 - Live 0xd2c40000
ip6t_LOG 5632 2 - Live 0xd2c81000
ip6t_REJECT 7296 3 - Live 0xd2c42000
ip6table_mangle 2816 0 - Live 0xd282e000
ipt_REJECT 6656 3 - Live 0xd2c3b000
iptable_mangle 3072 1 - Live 0xd283c000
iptable_filter 2944 1 - Live 0xd2830000
ip_nat_ftp 4848 0 - Live 0xd2c30000
iptable_nat 22060 3 ipt_MASQUERADE,ip_nat_ftp, Live 0xd2c29000
ip_conntrack_ftp 72112 1 ip_nat_ftp, Live 0xd2c16000
ip_conntrack 31280 5 ipt_MASQUERADE,ipt_state,ip_nat_ftp,iptable_nat,ip_conntrack_ftp, Live 0xd2c0d000
ip_tables 17280 11 ipt_MASQUERADE,ipt_TCPMSS,ipt_TOS,ipt_state,ipt_LOG,ipt_MARK,ipt_mark,ipt_REJECT,iptable_mangle,iptable_filter,iptable_nat, Live 0xd2920000
ip6table_filter 2816 1 - Live 0xd2835000
ip6_tables 18576 4 ip6t_LOG,ip6t_REJECT,ip6table_mangle,ip6table_filter, Live 0xd284c000
ipv6 237440 24 ip6t_REJECT, Live 0xd2c46000
subfs 7424 3 - Live 0xd2832000
dm_mod 50300 0 - Live 0xd283e000
reiserfs 241360 1 - Live 0xd2853000
+ _________________________ proc/meminfo
+ cat /proc/meminfo
MemTotal: 256656 kB
MemFree: 7176 kB
Buffers: 28732 kB
Cached: 65280 kB
SwapCached: 0 kB
Active: 196704 kB
Inactive: 21480 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 256656 kB
LowFree: 7176 kB
SwapTotal: 512024 kB
SwapFree: 512012 kB
Dirty: 276 kB
Writeback: 0 kB
Mapped: 159584 kB
Slab: 23248 kB
Committed_AS: 242048 kB
PageTables: 2192 kB
VmallocTotal: 770040 kB
VmallocUsed: 36864 kB
VmallocChunk: 730468 kB
HugePages_Total: 0
HugePages_Free: 0
Hugepagesize: 4096 kB
+ _________________________ dev/ipsec-ls
+ ls -l '/dev/ipsec*'
ls: /dev/ipsec*: No such file or directory
+ _________________________ proc/net/ipsec-ls
+ ls -l '/proc/net/ipsec_*'
ls: /proc/net/ipsec_*: No such file or directory
+ _________________________ usr/src/linux/.config
+ test -f /usr/src/linux/.config
+ _________________________ etc/syslog.conf
+ cat /etc/syslog.conf
# /etc/syslog.conf - Configuration file for syslogd(8)
#
# For info about the format of this file, see "man syslog.conf".
#
#
#
# print most on tty10 and on the xconsole pipe
#
kern.warning;*.err;authpriv.none /dev/tty10
kern.warning;*.err;authpriv.none |/dev/xconsole
*.emerg *
# enable this, if you want that root is informed
# immediately, e.g. of logins
#*.alert root
#
# all email-messages in one file
#
mail.* -/var/log/mail
mail.info -/var/log/mail.info
mail.warning -/var/log/mail.warn
mail.err /var/log/mail.err
#
# all news-messages
#
# these files are rotated and examined by "news.daily"
news.crit -/var/log/news/news.crit
news.err -/var/log/news/news.err
news.notice -/var/log/news/news.notice
# enable this, if you want to keep all news messages
# in one file
#news.* -/var/log/news.all
#
# Warnings in one file
#
*.=warning;*.=err -/var/log/warn
*.crit /var/log/warn
#
# save the rest in one file
#
*.*;mail.none;news.none -/var/log/messages
#
# enable this, if you want to keep all messages
# in one file
#*.* -/var/log/allmessages
#
# Some foreign boot scripts require local7
#
local0,local1.* -/var/log/localmessages
local2,local3.* -/var/log/localmessages
local4,local5.* -/var/log/localmessages
local6,local7.* -/var/log/localmessages
authpriv.* /var/log/security
authpriv.none /var/log/messages
+ _________________________ etc/resolv.conf
+ cat /etc/resolv.conf
### BEGIN INFO
#
# Modified_by: smpppd-ifcfg
# Backup: /etc/resolv.conf.saved.by.smpppd-ifcfg
# Process: smpppd-ifcfg
# Process_id: 4157
# Script: /usr/sbin/smpppd-ifcfg
# Saveto:
# Info: This is a temporary resolv.conf created by service
# smpppd-ifcfg. The previous file has been saved and will be
# restored later.
#
# If you don't like your resolv.conf to be changed, you
# can set MODIFY_{RESOLV,NAMED}_CONF_DYNAMICALLY=no. This
# variables are placed in /etc/sysconfig/network/config.
#
# You can also configure service smpppd-ifcfg not to
# modify it.
#
# If you do not want the smpppd to change your nameserver
# settings
# set MODIFYDNS=no in the config file for this provider in
# /etc/sysconfig/network/providers/.
#
### END INFO
nameserver 217.237.149.161
nameserver 194.25.2.129
+ _________________________ lib/modules-ls
+ ls -ltr /lib/modules
total 0
drwxr-xr-x 3 root root 104 Jul 1 19:18 scripts
drwxr-xr-x 2 root root 48 Jul 1 19:18 2.6.5-override-default
drwxr-xr-x 3 root root 88 Jul 26 20:14 precompiled
drwxr-xr-x 4 root root 448 Jul 26 20:24 2.6.5-7.95-default
+ _________________________ proc/ksyms-netif_rx
+ egrep netif_rx /proc/ksyms
grep: /proc/ksyms: No such file or directory
+ _________________________ lib/modules-netif_rx
+ modulegoo kernel/net/ipv4/ipip.o netif_rx
+ set +x
2.6.5-7.95-default:
2.6.5-override-default:
precompiled:
scripts:
+ _________________________ kern.debug
+ test -f /var/log/kern.debug
+ _________________________ klog
+ sed -n '8587,$p' /var/log/messages
+ egrep -i 'ipsec|klips|pluto'
+ cat
Aug 9 08:54:42 mngateway ipsec_setup: Starting FreeS/WAN IPsec 2.04...
Aug 9 08:54:42 mngateway ipsec_setup: KLIPS ipsec0 on ppp0 80.130.191.226/255.255.255.255 pointopoint 217.5.98.30
Aug 9 08:54:42 mngateway ipsec__plutorun: Starting Pluto subsystem...
Aug 9 08:54:42 mngateway ipsec_setup: ...FreeS/WAN IPsec started
Aug 9 08:54:42 mngateway pluto[9213]: Starting Pluto (FreeS/WAN Version 2.04 X.509-1.5.3 LIBCURL PLUTO_USES_KEYRR)
Aug 9 08:54:42 mngateway pluto[9213]: including NAT-Traversal patch (Version 0.6) [disabled]
Aug 9 08:54:42 mngateway pluto[9213]: Using Linux 2.6 IPsec interface code
Aug 9 08:54:42 mngateway pluto[9213]: Changing to directory '/etc/ipsec.d/cacerts'
Aug 9 08:54:42 mngateway pluto[9213]: loaded CA cert file 'MultinovaCA-cert.pem' (1294 bytes)
Aug 9 08:54:42 mngateway pluto[9213]: Changing to directory '/etc/ipsec.d/aacerts'
Aug 9 08:54:42 mngateway pluto[9213]: Changing to directory '/etc/ipsec.d/ocspcerts'
Aug 9 08:54:42 mngateway pluto[9213]: Changing to directory '/etc/ipsec.d/crls'
Aug 9 08:54:43 mngateway pluto[9213]: loaded host cert file '/etc/ipsec.d/certs/mnvpngw-cert.pem' (4507 bytes)
Aug 9 08:54:43 mngateway pluto[9213]: added connection description "L2TP-CERT"
Aug 9 08:54:43 mngateway pluto[9213]: listening for IKE messages
Aug 9 08:54:43 mngateway pluto[9213]: adding interface ppp0/ppp0 80.130.191.226
Aug 9 08:54:43 mngateway pluto[9213]: adding interface eth0/eth0 192.6.2.12
Aug 9 08:54:43 mngateway pluto[9213]: adding interface lo/lo 127.0.0.1
Aug 9 08:54:43 mngateway pluto[9213]: adding interface lo/lo ::1
Aug 9 08:54:43 mngateway pluto[9213]: loading secrets from "/etc/ipsec.secrets"
Aug 9 08:55:24 mngateway pluto[9213]: loading secrets from "/etc/ipsec.secrets"
+ _________________________ plog
+ sed -n '8589,$p' /var/log/messages
+ egrep -i pluto
+ cat
Aug 9 08:54:42 mngateway ipsec__plutorun: Starting Pluto subsystem...
Aug 9 08:54:42 mngateway pluto[9213]: Starting Pluto (FreeS/WAN Version 2.04 X.509-1.5.3 LIBCURL PLUTO_USES_KEYRR)
Aug 9 08:54:42 mngateway pluto[9213]: including NAT-Traversal patch (Version 0.6) [disabled]
Aug 9 08:54:42 mngateway pluto[9213]: Using Linux 2.6 IPsec interface code
Aug 9 08:54:42 mngateway pluto[9213]: Changing to directory '/etc/ipsec.d/cacerts'
Aug 9 08:54:42 mngateway pluto[9213]: loaded CA cert file 'MultinovaCA-cert.pem' (1294 bytes)
Aug 9 08:54:42 mngateway pluto[9213]: Changing to directory '/etc/ipsec.d/aacerts'
Aug 9 08:54:42 mngateway pluto[9213]: Changing to directory '/etc/ipsec.d/ocspcerts'
Aug 9 08:54:42 mngateway pluto[9213]: Changing to directory '/etc/ipsec.d/crls'
Aug 9 08:54:43 mngateway pluto[9213]: loaded host cert file '/etc/ipsec.d/certs/mnvpngw-cert.pem' (4507 bytes)
Aug 9 08:54:43 mngateway pluto[9213]: added connection description "L2TP-CERT"
Aug 9 08:54:43 mngateway pluto[9213]: listening for IKE messages
Aug 9 08:54:43 mngateway pluto[9213]: adding interface ppp0/ppp0 80.130.191.226
Aug 9 08:54:43 mngateway pluto[9213]: adding interface eth0/eth0 192.6.2.12
Aug 9 08:54:43 mngateway pluto[9213]: adding interface lo/lo 127.0.0.1
Aug 9 08:54:43 mngateway pluto[9213]: adding interface lo/lo ::1
Aug 9 08:54:43 mngateway pluto[9213]: loading secrets from "/etc/ipsec.secrets"
Aug 9 08:55:24 mngateway pluto[9213]: loading secrets from "/etc/ipsec.secrets"
+ _________________________ date
+ date
Mon Aug 9 08:56:33 CEST 2004
-------- Original Message --------
Subject: Re-3: [Users] VPN not working ... (09-Aug-2004 8:41)
From: [email protected]
To: [email protected]
> At 08:34 09.08.2004, [email protected] wrote:
> >Hi,
> >
> >no, the Peer ID is still unknown to Pluto. The error message is still the
> >same. I can't figure out why, as both DN's (the DN delivered by the
> >Roadwarrior and the DN written to my ipsec.conf) are the same.
>
> Post the barf output and your config files, maybe something is visible
> there
>
> Erich
>
>
> THINK
> Püntenstrasse 39
> 8143 Stallikon
> mailto:[email protected]
> PGP Fingerprint: BC9A 25BC 3954 3BC8 C024 8D8A B7D4 FF9D 05B8 0A16
>
> _______________________________________________
> FreeS/WAN Users mailing list
> [email protected]
> https://mj2.freeswan.org/cgi-bin/mj_wwwusr
>
To: [email protected]
[email protected]
[email protected]