0

How do I troubleshoot a VPN connection that won't forward DNS requests?

My network configuration without the VPN running works as desired. I have a Centos front-end NAT'ing outbound requests via IPTables. The internal router (Cisco 2600) is configured to

router-2600#show ip route
Codes: -snipped-
Gateway of last resort is 192.168.1.1 to network 0.0.0.0

 192.168.200.0/26 is subnetted, 1 subnets                                   

C 192.168.200.0 is directly connected, FastEthernet0/0
S 192.168.1.0/24 [1/0] via 192.168.200.2
C 192.168.3.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 192.168.1.1

Internet                                                                     
               192.168.200.0                192.168.3.0                  
 +----------+                +-----------+                 +------------+
 |          |.2            .1|           |.1             .3|            |
 |          +----------------+           +-----------------+            |
 | IPTables |                |     Cisco |                 |     Laptop |
 | NAT/Masq |                |      2600 |                 |            |
 +----------+                +-----------+                 +------------+

This setup works exactly as expected and desired.

But, when I run vpnc on the 192.168.200.2 host UDP-based functions seem to fail. Specifically, I cannot do DNS requests against a DNS server that resides in the VPN'd name space although I can ping that host.

eth0      Link encap:Ethernet  HWaddr 00:E0:4C:77:4B:32  
          inet addr:192.168.200.2  Bcast:192.168.200.63  Mask:255.255.255.192
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:256616278 errors:0 dropped:0 overruns:0 frame:0
          TX packets:428976874 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1941010246 (1.8 GiB)  TX bytes:1236389787 (1.1 GiB)
          Interrupt:169 Base address:0x8400 

eth1     -snipped-

eth2      Link encap:Ethernet  HWaddr 00:14:D1:2B:86:9F  
          inet addr:192.168.100.252  Bcast:192.168.100.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:546051427 errors:0 dropped:0 overruns:0 frame:0
          TX packets:318999693 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1296057751 (1.2 GiB)  TX bytes:3330532283 (3.1 GiB)
          Interrupt:193 Base address:0xac00 

lo       -snipped-

tunvpn    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:172.31.252.222  P-t-P:172.31.252.222  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1412  Metric:1
          RX packets:162 errors:0 dropped:0 overruns:0 frame:0
          TX packets:249 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:13756 (13.4 KiB)  TX bytes:14324 (13.9 KiB)

VPN Config Script:

#!/bin/bash

IPT="/sbin/iptables"
ROUTE="/sbin/route"
INSIDE="eth0"
OUTSIDE="eth2"

SCRIPT_HOME=/opt/vpn-scripts
PIDFILE=${SCRIPT_HOME}/vpn.pid


if [ -e ${PIDFILE} ] && pgrep vpnc | grep $(cat ${PIDFILE}) ; then
        echo vpnc is already running.  Killing process. >> ${SCRIPT_HOME}/vpn.log
        kill $(cat ${PIDFILE})
        sleep 3
fi

cp /etc/resolv.conf ${SCRIPT_HOME}/resolv.conf.bak

/sbin/vpnc --debug 3 --pid-file ${PIDFILE} vpn 2>&1 >> ${SCRIPT_HOME}/vpn.log

cp ${SCRIPT_HOME}/resolv.conf.bak /etc/resolv.conf

$ROUTE del default dev tunvpn
$ROUTE add -net 172.31.252.0 netmask 255.255.255.0 dev tunvpn metric 50

echo "Deleting routes - clear previous entries"
$IPT -t nat -D POSTROUTING -o tunvpn -j MASQUERADE
$IPT -D FORWARD -i tunvpn -o $INSIDE -j ACCEPT
$IPT -D FORWARD -i $INSIDE -o tunvpn -j ACCEPT

echo "Creating routes"
$IPT -t nat -A POSTROUTING -o tunvpn -j MASQUERADE
$IPT -A FORWARD -i tunvpn -o $INSIDE -j ACCEPT
$IPT -A FORWARD -i $INSIDE -o tunvpn -j ACCEPT

TCP Dump running on the Centos server shows requests coming to it destined for the target DNS server, but no responses ever returning.

Also, from the Centos router, I can query the internal DNS and get a response.

When I query the DNS server from the Cisco 2600 though, it times out. (When the router attempts the query, TCPDump on the Centos server shows:

[root@localhost:~] sudo tcpdump src 172.31.252.11 or dst 172.31.252.11
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
15:35:39.861291 IP 192.168.200.1.50242 > 172.31.252.11.domain:  46+ X25? internal.lab. (28)
15:35:42.862844 IP 192.168.200.1.55077 > 172.31.252.11.domain:  47+ A? internal.lab. (28)
15:35:45.861379 IP 192.168.200.1.55077 > 172.31.252.11.domain:  47+ A? internal.lab. (28)
15:35:48.861533 IP 192.168.200.1.55077 > 172.31.252.11.domain:  47+ A? internal.lab. (28)

)

1 Answer 1

0

I tend to tcpdump the bejesus out of anything I can get my hands on; that usually ties the problem down to either a firewall or a network link. I don't run devices I can't run tcpdump on, though, so if that Cisco turns out to be involved, you might be in trouble there.

If it's a network link that's the problem, I usually just start swapping out components one-by-one, trying to isolate the cause. For firewall problems, there's nothing better than a good iptables -t raw -I OUTPUT -j TRACE to show you exactly what your firewall is doing -- and, hence, what it's doing wrong.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .