How do I troubleshoot a VPN connection that won't forward DNS requests?
My network configuration without the VPN running works as desired. I have a Centos front-end NAT'ing outbound requests via IPTables. The internal router (Cisco 2600) is configured to
router-2600#show ip route
Codes: -snipped-
Gateway of last resort is 192.168.1.1 to network 0.0.0.0192.168.200.0/26 is subnetted, 1 subnets
C 192.168.200.0 is directly connected, FastEthernet0/0
S 192.168.1.0/24 [1/0] via 192.168.200.2
C 192.168.3.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 192.168.1.1
Internet
192.168.200.0 192.168.3.0
+----------+ +-----------+ +------------+
| |.2 .1| |.1 .3| |
| +----------------+ +-----------------+ |
| IPTables | | Cisco | | Laptop |
| NAT/Masq | | 2600 | | |
+----------+ +-----------+ +------------+
This setup works exactly as expected and desired.
But, when I run vpnc on the 192.168.200.2 host UDP-based functions seem to fail. Specifically, I cannot do DNS requests against a DNS server that resides in the VPN'd name space although I can ping that host.
eth0 Link encap:Ethernet HWaddr 00:E0:4C:77:4B:32
inet addr:192.168.200.2 Bcast:192.168.200.63 Mask:255.255.255.192
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:256616278 errors:0 dropped:0 overruns:0 frame:0
TX packets:428976874 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1941010246 (1.8 GiB) TX bytes:1236389787 (1.1 GiB)
Interrupt:169 Base address:0x8400
eth1 -snipped-
eth2 Link encap:Ethernet HWaddr 00:14:D1:2B:86:9F
inet addr:192.168.100.252 Bcast:192.168.100.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:546051427 errors:0 dropped:0 overruns:0 frame:0
TX packets:318999693 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1296057751 (1.2 GiB) TX bytes:3330532283 (3.1 GiB)
Interrupt:193 Base address:0xac00
lo -snipped-
tunvpn Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:172.31.252.222 P-t-P:172.31.252.222 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1412 Metric:1
RX packets:162 errors:0 dropped:0 overruns:0 frame:0
TX packets:249 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:13756 (13.4 KiB) TX bytes:14324 (13.9 KiB)
VPN Config Script:
#!/bin/bash
IPT="/sbin/iptables"
ROUTE="/sbin/route"
INSIDE="eth0"
OUTSIDE="eth2"
SCRIPT_HOME=/opt/vpn-scripts
PIDFILE=${SCRIPT_HOME}/vpn.pid
if [ -e ${PIDFILE} ] && pgrep vpnc | grep $(cat ${PIDFILE}) ; then
echo vpnc is already running. Killing process. >> ${SCRIPT_HOME}/vpn.log
kill $(cat ${PIDFILE})
sleep 3
fi
cp /etc/resolv.conf ${SCRIPT_HOME}/resolv.conf.bak
/sbin/vpnc --debug 3 --pid-file ${PIDFILE} vpn 2>&1 >> ${SCRIPT_HOME}/vpn.log
cp ${SCRIPT_HOME}/resolv.conf.bak /etc/resolv.conf
$ROUTE del default dev tunvpn
$ROUTE add -net 172.31.252.0 netmask 255.255.255.0 dev tunvpn metric 50
echo "Deleting routes - clear previous entries"
$IPT -t nat -D POSTROUTING -o tunvpn -j MASQUERADE
$IPT -D FORWARD -i tunvpn -o $INSIDE -j ACCEPT
$IPT -D FORWARD -i $INSIDE -o tunvpn -j ACCEPT
echo "Creating routes"
$IPT -t nat -A POSTROUTING -o tunvpn -j MASQUERADE
$IPT -A FORWARD -i tunvpn -o $INSIDE -j ACCEPT
$IPT -A FORWARD -i $INSIDE -o tunvpn -j ACCEPT
TCP Dump running on the Centos server shows requests coming to it destined for the target DNS server, but no responses ever returning.
Also, from the Centos router, I can query the internal DNS and get a response.
When I query the DNS server from the Cisco 2600 though, it times out. (When the router attempts the query, TCPDump on the Centos server shows:
[root@localhost:~] sudo tcpdump src 172.31.252.11 or dst 172.31.252.11
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
15:35:39.861291 IP 192.168.200.1.50242 > 172.31.252.11.domain: 46+ X25? internal.lab. (28)
15:35:42.862844 IP 192.168.200.1.55077 > 172.31.252.11.domain: 47+ A? internal.lab. (28)
15:35:45.861379 IP 192.168.200.1.55077 > 172.31.252.11.domain: 47+ A? internal.lab. (28)
15:35:48.861533 IP 192.168.200.1.55077 > 172.31.252.11.domain: 47+ A? internal.lab. (28)
)