|
||||||||
I don't know if this is a m0n0wall issue or just something i'm doing stupidly with my network/VPN setup. I've got two subnets and three interfaces setup on my m0n0wall. one is the WAN, one is LAN, and the final is a separate interface for my pair of wireless accesspoints (they're actually routers, but i'm plugged into switch ports and DHCP is off, so they're just wireless bridges here). LAN is 192.168.1/24, wireless subnet is 192.168.2/24. In the m0n0wall, I have a series of rules that denies all access from the wireless interface to the LAN interface. I then selectively have a few holes punched - DNS, HTTPS and RDP (3389) to my W2k3 domain controller. I already have the PPTP page on the m0n0 set to redirect requests to the server (192.168.1.2). I checked the rules and saw that they added the appropriate firewall rules for me. (I just had to add NAT rules for my WAN interface.) Just in case, I tried manually adding rules for GRE and 1723 (PPTP), but this didn't help. I can successfully connect to the Win2k3 server for a PPTP connection. It authenticates fine, and my machine gets an IP address from the server. The server's main IP is 192.168.1.2. However, when I setup PPTP/Routing & Remote access on Win2k3, it also gave itself another IP - 192.168.1.59. When the PPTP client connects, it calls that the "server address", rather than .1.2. However, in a netstat, I see the connection on 1723 between my laptop's wireless IP and the server's main IP. (.2.42 -> .1.2.) My understanding of PPTP is that IP packets get encrypted and tunneled within a different stream of TCP packets. Correct? So my laptop (.2.42) should tunnel packets inside of a stream going from .2.42 to .1.2 (the VPN server). Those packets should be between .1.5x (VPN-assigned address for laptop) and .1.59 (VPN server internal address) -- but any router between the two subnets shouldn't care, because that traffic is TUNNELED... Either the Windows VPN implementation is weird, or the m0n0wall is too smart for its own good. I see entries like this in my log: Act Time If Source Destination Proto 3 22:30:36.838517 Wireless LAN 192.168.1.52, port 137 192.168.1.2, port 137 UDP 2 22:30:35.386921 Wireless LAN 192.168.1.52, port 137 192.168.1.2, port 137 UDP 2 22:30:33.886640 Wireless LAN 192.168.1.52, port 137 192.168.1.2, port 137 UDP Note that somehow the m0n0wall sees data originating from .1.5x (VPN client IP) coming from the wireless LAN interface (Opt1). Why would this happen? I thought it was supposed to TUNNEL inside of packets from that other subnet?? Also, I'm able to ping addresses in the 1.x subnet while connected to the VPN, but I can't pass other traffic to those hosts. (I have direct pings from 2.x -> 1.x disabled, only echo REPLIES are allowed across normally.) Is all of this happening because both the source and destination are in private IP ranges? For what it's worth, I can connect to the VPN from outside (another internet host) and everything behaves as expected. I can move files, connect to anything on the .1.x subnet, everything works as expected. It's only across the two "internal" interfaces that I'm having issues. I'm really confused here, because it's not behaving the way I thought PPTP should behave... I'm going to include relevent rules below. Thanks in advance... #----------------------------------------------------------------------- ---- # group head 300 - opt1 interface #----------------------------------------------------------------------- ---- block in log quick on sis2 all head 300 # let out anything from the firewall host itself and decrypted IPsec traffic pass out quick on sis2 all keep state # make sure the user cannot lock himself out of the webGUI pass in quick from 192.168.1.0/24 to 192.168.1.1 keep state group 100 # PPTP rules pass in quick proto gre from any to 192.168.1.2 keep state group 200 pass in quick proto tcp from any to 192.168.1.2 port = 1723 keep state group 200 # User-defined rules follow pass in quick proto tcp from any to 192.168.1.2 port = 25 keep state group 200 pass in quick proto tcp from any to 192.168.1.2 port = 443 keep state group 200 pass in quick proto tcp/udp from any to 192.168.1.2 port = 3389 keep state group 200 pass in quick proto tcp from any to 192.168.1.2 port 6880 >< 7000 keep state group 200 pass in quick proto tcp/udp from 192.168.2.0/24 to 192.168.1.2 port = 53 keep state group 300 pass in quick proto tcp from 192.168.2.0/24 to 192.168.1.2 port = 443 keep state group 300 pass in quick proto tcp/udp from 192.168.2.0/24 to 192.168.1.2 port = 3389 keep state group 300 pass in quick proto udp from 192.168.2.0/24 to 192.168.1.2 port = 69 keep state group 300 pass in quick proto icmp from 192.168.1.0/24 to 192.168.2.0/24 icmp-type echo keep state group 300 pass in quick proto icmp from 192.168.2.0/24 to 192.168.1.0/24 icmp-type echorep keep state group 300 block return-rst in quick proto tcp from 192.168.2.0/24 to 192.168.1.0/24 flags S/SA group 300 block return-icmp in quick proto udp from 192.168.2.0/24 to 192.168.1.0/24 group 300 block in quick proto icmp from 192.168.2.0/24 to 192.168.1.0/24 group 300 pass in quick from 192.168.2.0/24 to any keep state group 300 pass in quick from 192.168.1.0/24 to any keep state group 100 |