0

How do I troubleshoot a VPN connection that won't forward DNS requests?

My network configuration without the VPN running works as desired. I have a Centos front-end NAT'ing outbound requests via IPTables. The internal router (Cisco 2600) is configured to

router-2600#show ip route
Codes: -snipped-
Gateway of last resort is 192.168.1.1 to network 0.0.0.0

 192.168.200.0/26 is subnetted, 1 subnets                                   

C 192.168.200.0 is directly connected, FastEthernet0/0
S 192.168.1.0/24 [1/0] via 192.168.200.2
C 192.168.3.0/24 is directly connected, FastEthernet1/0
S* 0.0.0.0/0 [1/0] via 192.168.1.1

Internet                                                                     
               192.168.200.0                192.168.3.0                  
 +----------+                +-----------+                 +------------+
 |          |.2            .1|           |.1             .3|            |
 |          +----------------+           +-----------------+            |
 | IPTables |                |     Cisco |                 |     Laptop |
 | NAT/Masq |                |      2600 |                 |            |
 +----------+                +-----------+                 +------------+

This setup works exactly as expected and desired.

But, when I run vpnc on the 192.168.200.2 host UDP-based functions seem to fail. Specifically, I cannot do DNS requests against a DNS server that resides in the VPN'd name space although I can ping that host.

eth0      Link encap:Ethernet  HWaddr 00:E0:4C:77:4B:32  
          inet addr:192.168.200.2  Bcast:192.168.200.63  Mask:255.255.255.192
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:256616278 errors:0 dropped:0 overruns:0 frame:0
          TX packets:428976874 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1941010246 (1.8 GiB)  TX bytes:1236389787 (1.1 GiB)
          Interrupt:169 Base address:0x8400 

eth1     -snipped-

eth2      Link encap:Ethernet  HWaddr 00:14:D1:2B:86:9F  
          inet addr:192.168.100.252  Bcast:192.168.100.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:546051427 errors:0 dropped:0 overruns:0 frame:0
          TX packets:318999693 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1296057751 (1.2 GiB)  TX bytes:3330532283 (3.1 GiB)
          Interrupt:193 Base address:0xac00 

lo       -snipped-

tunvpn    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:172.31.252.222  P-t-P:172.31.252.222  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1412  Metric:1
          RX packets:162 errors:0 dropped:0 overruns:0 frame:0
          TX packets:249 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:13756 (13.4 KiB)  TX bytes:14324 (13.9 KiB)

VPN Config Script:

#!/bin/bash

IPT="/sbin/iptables"
ROUTE="/sbin/route"
INSIDE="eth0"
OUTSIDE="eth2"

SCRIPT_HOME=/opt/vpn-scripts
PIDFILE=${SCRIPT_HOME}/vpn.pid


if [ -e ${PIDFILE} ] && pgrep vpnc | grep $(cat ${PIDFILE}) ; then
        echo vpnc is already running.  Killing process. >> ${SCRIPT_HOME}/vpn.log
        kill $(cat ${PIDFILE})
        sleep 3
fi

cp /etc/resolv.conf ${SCRIPT_HOME}/resolv.conf.bak

/sbin/vpnc --debug 3 --pid-file ${PIDFILE} vpn 2>&1 >> ${SCRIPT_HOME}/vpn.log

cp ${SCRIPT_HOME}/resolv.conf.bak /etc/resolv.conf

$ROUTE del default dev tunvpn
$ROUTE add -net 172.31.252.0 netmask 255.255.255.0 dev tunvpn metric 50

echo "Deleting routes - clear previous entries"
$IPT -t nat -D POSTROUTING -o tunvpn -j MASQUERADE
$IPT -D FORWARD -i tunvpn -o $INSIDE -j ACCEPT
$IPT -D FORWARD -i $INSIDE -o tunvpn -j ACCEPT

echo "Creating routes"
$IPT -t nat -A POSTROUTING -o tunvpn -j MASQUERADE
$IPT -A FORWARD -i tunvpn -o $INSIDE -j ACCEPT
$IPT -A FORWARD -i $INSIDE -o tunvpn -j ACCEPT

TCP Dump running on the Centos server shows requests coming to it destined for the target DNS server, but no responses ever returning.

Also, from the Centos router, I can query the internal DNS and get a response.

When I query the DNS server from the Cisco 2600 though, it times out. (When the router attempts the query, TCPDump on the Centos server shows:

[root@localhost:~] sudo tcpdump src 172.31.252.11 or dst 172.31.252.11
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
15:35:39.861291 IP 192.168.200.1.50242 > 172.31.252.11.domain:  46+ X25? internal.lab. (28)
15:35:42.862844 IP 192.168.200.1.55077 > 172.31.252.11.domain:  47+ A? internal.lab. (28)
15:35:45.861379 IP 192.168.200.1.55077 > 172.31.252.11.domain:  47+ A? internal.lab. (28)
15:35:48.861533 IP 192.168.200.1.55077 > 172.31.252.11.domain:  47+ A? internal.lab. (28)

)

0

I tend to tcpdump the bejesus out of anything I can get my hands on; that usually ties the problem down to either a firewall or a network link. I don't run devices I can't run tcpdump on, though, so if that Cisco turns out to be involved, you might be in trouble there.

If it's a network link that's the problem, I usually just start swapping out components one-by-one, trying to isolate the cause. For firewall problems, there's nothing better than a good iptables -t raw -I OUTPUT -j TRACE to show you exactly what your firewall is doing -- and, hence, what it's doing wrong.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.