Instance external VPN cant connect PPTP GRE
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Packstack |
New
|
Undecided
|
Unassigned |
Bug Description
How to reproduce:
- Create a tenant with a Windows or Linux instance. ( We use VXLAN )
- Deploy VPN Server like Microsoft RRAS or PPTPD in linux.
- Assign flotating IP to your instance.
- Disable port security at port level for your instance to allow bypass all traffic. (This will remove all your security groups by default)
- Go to Windows, create a VPN adapter and try to connect to your VPN Server.
Result : Error 800 ( Cant establish )
After more than 48 hours checking the issue we found that in the deployment at Network node is missing the next Kernel Modules that cause drops:
nf_conntrack_
ip_conntrack_pptp
ip_nat_pptp
For check if modules are enable in your installation:
lsmod | grep nf_conntrack_
lsmod | grep nf_conntrack_pptp
lsmod | grep nf_nat_pptp
If not enable, enable temporally in your network node with the following commands:
modprobe nf_conntrack_
modprobe ip_conntrack_pptp
modprobe ip_nat_pptp
Also you must check that your IPtables allow input protocol 47 ( GRE) , use iptables -S INPUT
If not allowed you must do it before default reject rule:
iptables -D INPUT -j REJECT --reject-with icmp-host-
iptables -A INPUT -p gre -j ACCEPT
iptables -A INPUT -j REJECT --reject-with icmp-host-
Important note the load of modules will be cleaned in the next reboot you must setup on boot for load modules.
Once this fix is applyed from your computer you will be able to establish a PPTPD with GRE protocol tunnel that allow you to connect from your local computer to instance network.
Hi,
Did you try only applying the iptables rules you described:
iptables -D INPUT -j REJECT --reject-with icmp-host- prohibited prohibited
iptables -A INPUT -p gre -j ACCEPT
iptables -A INPUT -j REJECT --reject-with icmp-host-
but without enabling the kernel modules?
Best regards,
Alfredo