Problem setting up poptop on RHEL5

Hey There,

I have a pretty standard RHEL server with 5 IP addresses which are 
configured via IP aliases.

I am seeing some quite bizzare things after following the howto found at 
http://poptop.sourceforge.net/dox/redhat-howto.phtml

so, I setup my /etc/pptpd.conf file as follows (pretty much default 
except for remote/local ip)

option /etc/ppp/options.pptpd
debug
logwtmp
localip 10.101.0.1
remoteip 10.101.0.2-102


and then the /etc/ppp/options.pptpd

name wibble
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
ms-dns 10.101.0.1
debug
lock
nobsdcomp
novj
novjccomp
nologfd

in my chap-secrets I put something similar to the following

* wibble password *

I also run iptables on this server and so setup the following..

iptables -A INPUT -p 47 -j ACCEPT
iptables -A INPUT -p tcp --destport 1723 -j ACCEPT

I've also setup output rules over and above the --state rules that are 
there currently to allow all outbound GRE

iptables -A OUTPUT -p 47 -j ACCEPT

(I have also tried to make these rules more specific, less specific and 
disabled the firewall completely)

Forwarding rules and IP masq are also setup, and these work as I've 
managed to connect and use openvpn with a windows client and browse the 
net - however, I never manage to establish a connection with poptop.

After this I start the server as pointed out in the howto - this starts 
up and binds to the expected port.

I then configured two VPN clients, one an Android tablet and the other a 
WinXP vpn connection. I get quite different results from these two 
clients depending on the server config but all fail to connect.

With the client connecting to one of the ip-aliased addresses I get the 
following tcpdump

[root@wibble ppp]# tcpdump -i eth0:3 -n proto 47
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0:3, link-type EN10MB (Ethernet), capture size 96 bytes
01:26:43.754157 IP 74.53.155.170 > 143.238.235.209: GREv1, call 45139, 
seq 0, length 36: LCP, Conf-Request (0x01), id 1, length 22
01:26:43.956930 IP 143.238.235.209 > 74.53.155.174: GREv1, call 1536, 
seq 0, length 40: LCP, Conf-Request (0x01), id 1, length 26
01:26:44.180678 IP 143.238.235.209 > 74.53.155.174: GREv1, call 1536, 
seq 1, length 32: LCP, Term-Request (0x05), id 2, length 18
01:26:47.191496 IP 143.238.235.209 > 74.53.155.174: GREv1, call 1536, 
seq 2, length 32: LCP, Term-Request (0x05), id 3, length 18

74.53.155.170 is the primary ip bound to eth0, 74.53.155.174 is eth0:3 
and is what the client is trying to connect to

In the /var/log/messages log, I get ..

Aug 31 01:26:43 wibble pppd[31310]: sent [LCP ConfReq id=0x1 <asyncmap 
0x0> <magic 0xd4d3a867> <pcomp> <accomp>]
Aug 31 01:26:43 wibble pptpd[31309]: GRE: 
read(fd=7,buffer=80515e0,len=8260) from network failed: status = -1 
error = Protocol not available

Which people seem to say means there is a firewall blocking things.
, however, I have disabled any firewalling on the server and the client 
doesn't appear to have firewalling options either (its supposed to 
support l2tp vpns so you would assume that it wont firewall protocol 47)

With the XP box, I seem to get further but then timeouts due to lack of 
response. the tcpdump shows ip communication however, its to/from the 
wrong address (170 as opposed to 174)

(tcpdump)
01:36:30.290844 IP 143.238.235.209 > 74.53.155.174: GREv1, call 1792, 
seq 0, length 37: LCP, Conf-Request (0x01), id 0, length 23
01:36:30.553049 IP 74.53.155.170 > 143.238.235.209: GREv1, call 32768, 
seq 0, length 41: LCP, Conf-Request (0x01), id 1, length 27
01:36:32.291183 IP 143.238.235.209 > 74.53.155.174: GREv1, call 1792, 
seq 1, length 37: LCP, Conf-Request (0x01), id 1, length 23
01:36:33.554106 IP 74.53.155.170 > 143.238.235.209: GREv1, call 32768, 
seq 1, length 41: LCP, Conf-Request (0x01), id 1, length 27
01:36:35.293664 IP 143.238.235.209 > 74.53.155.174: GREv1, call 1792, 
seq 2, length 37: LCP, Conf-Request (0x01), id 2, length 23
01:36:36.554841 IP 74.53.155.170 > 143.238.235.209: GREv1, call 32768, 
seq 2, length 41: LCP, Conf-Request (0x01), id 1, length 27

and then from /var/log/messages

Aug 31 01:36:30 wibble pppd[31753]: sent [LCP ConfReq id=0x1 <asyncmap 
0x0> <auth chap MS-v2> <magic 0x4c17b54c> <pcomp> <accomp>]
Aug 31 01:36:42 wibble last message repeated 4 times
Aug 31 01:36:45 wibble pptpd[31752]: CTRL: Received PPTP Control Message 
(type: 15)
Aug 31 01:36:45 wibble pptpd[31752]: CTRL: Got a SET LINK INFO packet 
with standard ACCMs
Aug 31 01:36:45 wibble pppd[31753]: sent [LCP ConfReq id=0x1 <asyncmap 
0x0> <auth chap MS-v2> <magic 0x4c17b54c> <pcomp> <accomp>]
Aug 31 01:36:48 wibble pppd[31753]: sent [LCP ConfReq id=0x1 <asyncmap 
0x0> <auth chap MS-v2> <magic 0x4c17b54c> <pcomp> <accomp>]
Aug 31 01:36:51 wibble clamd[21636]: SelfCheck: Database status OK.
Aug 31 01:36:51 wibble pppd[31753]: sent [LCP ConfReq id=0x1 <asyncmap 
0x0> <auth chap MS-v2> <magic 0x4c17b54c> <pcomp> <accomp>]
Aug 31 01:36:53 wibble pptpd[31752]: CTRL: Received PPTP Control Message 
(type: 12)
Aug 31 01:36:53 wibble pptpd[31752]: CTRL: Made a CALL DISCONNECT RPLY 
packet
Aug 31 01:36:53 wibble pptpd[31752]: CTRL: Received CALL CLR request 
(closing call)
Aug 31 01:36:53 wibble pptpd[31752]: CTRL: Reaping child PPP[31753]
Aug 31 01:36:53 wibble pppd[31753]: Modem hangup

Then - if I try to connect to the primary IP (170) I end up with.. (and 
this seems to be the same for the tablet)

(tcpdump)
01:40:10.247571 IP 143.238.235.209 > 74.53.155.170: GREv1, call 1920, 
seq 0, length 37: LCP, Conf-Request (0x01), id 0, length 23

(logs)
Aug 31 01:40:10 wibble pppd[31880]: sent [LCP ConfReq id=0x1 <asyncmap 
0x0> <auth chap MS-v2> <magic 0x3affeba9> <pcomp> <accomp>]
Aug 31 01:40:10 wibble pptpd[31879]: GRE: xmit failed from decaps_hdlc: 
Operation not permitted
Aug 31 01:40:10 wibble pptpd[31879]: CTRL: PTY read or GRE write failed 
(pty,gre)=(6,7)

This is the same even if I have iptables set to allow all.

I realise this has been quite long, but I'm pulling my hair out here - 
I've no idea where to go from here and seemed to follow all the 
instructions to the letter.

Thanks in advance.

-- 
Steve.

------------------------------------------------------------------------------
Special Offer -- Download ArcSight Logger for FREE!
Finally, a world-class log management solution at an even better 
price-free! And you'll get a free "Love Thy Logs" t-shirt when you
download Logger. Secure your free ArcSight Logger TODAY!
http://p.sf.net/sfu/arcsisghtdev2dev

_______________________________________________
Poptop-server mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/poptop-server