Sponsored Content
Special Forums IP Networking 3 public servers: middle machine for traffic forwarding Post 303008256 by pedroz on Wednesday 29th of November 2017 10:36:31 AM
Old 11-29-2017
3 public servers: middle machine for traffic forwarding

With the following machines...
Server 1: PPTP client windows; Public IP: 1.1.1.1
Server 3: PPTP server centos6; Public IP: 3.3.3.3
Connecting VPN server3 from server1 works correctly!

Goal is to have a middle server forwarding traffic in both ways
Server 1: PPTP client windows; Public IP: 1.1.1.1
Server 2: Traffic forwarding centos6; Public IP: 2.2.2.2
Server 3: PPTP server centos6; Public IP: 3.3.3.3

Server1 connects with PPTP client to 2.2.2.2 and this server2 redirects to 3.3.3.3 (server3)
Is it possible to have that scenario?


Tried the following setup in Server2
1. Routing enabled
Code:
# echo "1" > /proc/sys/net/ipv4/ip_forward
# nano /etc/sysctl.conf
net.ipv4.ip_forward = 1
# sysctl -p

2. Iptables forward
Code:
# iptables -F -t nat
# iptables -F
# iptables -A FORWARD -d 3.3.3.3 -i eth0 -j ACCEPT
# iptables -t nat -A PREROUTING -i eth0 -d 2.2.2.2 -j DNAT --to-destination 3.3.3.3
# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# iptables save
# iptables reload

When trying to connect with Server1 VPN PPTP client to 2.2.2.2, it redirects correctly to 3.3.3.3.
However, in server3 (3.3.3.3) it does not assign a PPTP client to 2.2.2.2.
Here is the connection log at server3

Code:
# tail -f /var/log/messages
Nov 29 09:53:39 office pptpd[2121]: CTRL: Client 2.2.2.2 control connection started
Nov 29 09:53:39 office pptpd[2121]: CTRL: Starting call (launching pppd, opening GRE)
Nov 29 09:53:39 office pppd[2122]: Plugin /usr/lib64/pptpd/pptpd-logwtmp.so loaded.
Nov 29 09:53:39 office pppd[2122]: pppd 2.4.5 started by root, uid 0
Nov 29 09:53:39 office pppd[2122]: Using interface ppp2
Nov 29 09:53:39 office pppd[2122]: Connect: ppp2 <--> /dev/pts/3
Nov 29 09:54:09 office pppd[2122]: LCP: timeout sending Config-Requests
Nov 29 09:54:09 office pppd[2122]: Connection terminated.
Nov 29 09:54:09 office pppd[2122]: Modem hangup
Nov 29 09:54:09 office pppd[2122]: Exit.
Nov 29 09:54:09 office pptpd[2121]: GRE:  read(fd=6,buffer=6124a0,len=8196) from PTY failed: status = -1 error =  Input/output error, usually caused by unexpected termination of pppd,  check option syntax and pppd logs
Nov 29 09:54:09 office pptpd[2121]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7)
Nov 29 09:54:09 office pptpd[2121]: CTRL: Client 2.2.2.2 control connection finished

Any ideas to setup the server2 working as middle traffic forwarder?
 

9 More Discussions You Might Find Interesting

1. Solaris

Any tool to examine the error or traffic on the machine?

Hello all is there any graphic tool or not graphic tool that lets me examine or monitor the error in the system or data traffic ? Thanks for your help (2 Replies)
Discussion started by: umen
2 Replies

2. Cybersecurity

ssh X-forwarding and remote forwarding behind proxy

Hi, from my workplace we use a proxy to connect to the outside world, including external ssh servers. The problem is that the server is seeing the connection coming from the proxy and knows nothing about the client behind it. The ssh connection itself works fine, but x-forwarding does not work as... (1 Reply)
Discussion started by: vampirodolce
1 Replies

3. Red Hat

To find the LATEST file from a dir on REMOTE machine and SCP to local machine?

Hi All, URGENT - Please help me form a scipt for this: I need the LATEST file from a dir on REMOTE machine to be SCP'd to a dir on local machine. (and I need to execute this from local server) I know that the below cmd is used to find the LATEST file from a dir. But this command is not... (3 Replies)
Discussion started by: me_ub
3 Replies

4. IP Networking

Setting up private and public ip on same machine.

Hi, We have a ftp server which is running on public ip and out side of firewall. Users out side of our network and users of our local network both using the same public ip and doing upload and downloading. Last few days we are facing bandwidth problem as internal network users increased. ... (1 Reply)
Discussion started by: abduljabbar_11
1 Replies

5. SuSE

Regarding accessing multiple servers using single public ip address

Hello, Currently we are having different linux servers (for example: let's assume audio server, video server and text server) to handle requests from outside users. Suppose the outside users in different LAN (Local Area Network), other than the servers. For example user is in 20 series LAN and... (5 Replies)
Discussion started by: navneet_2009
5 Replies

6. UNIX for Advanced & Expert Users

Generate Public key for non ssh enabled servers

I am writing a script that needs to access various servers some of which are not ssh enabled. In order to access the ssh enabled servers I am using the following command to generate the public key : ssh-keygen -t rsa Is there a similar command for the other servers as well. If I try to use... (1 Reply)
Discussion started by: ravneet123
1 Replies

7. Linux

IP Traffic forwarding

Hello All I have the following setup of a network. Client machines sends requests to the server which is (192.168.1.50) running on Ubuntu server 8.04. And this server forwards all incoming traffic from clients to another server (192.168.1.100) when it's available. The availability is checked... (0 Replies)
Discussion started by: Anuradhai4i
0 Replies

8. Shell Programming and Scripting

What are public keys in ssh and how do we create the public keys??

Hi All, I am having knowledge on some basics of ssh and wanted to know what are the public keys and how can we create and implement it in connecting server. Please provide the information for the above, it would be helpful for me. Thanks, Ravindra (1 Reply)
Discussion started by: ravi3cha
1 Replies

9. Cybersecurity

Ssh acces without passwd from unique machine to all servers

hello i want to acces to many machines over LAN network from a unique machine , that allow me to use a SSH directly without password. i ama using redhat enterprise version . i didnt find the right way to realise that. what should i do at first ? (1 Reply)
Discussion started by: wassimpb
1 Replies
vpnd(5) 						      BSD File Formats Manual							   vpnd(5)

NAME
vpnd -- Mac OS X VPN Remote Access Server File DESCRIPTION
This manual page describes the configuration elements contained in the /Library/Preferences/SystemConfiguration/com.apple.RemoteAccessServers.plist file. Should this file not be present on the target OS X Sys- tem, a template file has been provided in this manual page. The user can manipulate the contents of this file using a PLIST file editor (provided with any Mac OS X system), or any text editor. In this case, the user is assumed to have some basic understanding of Property Lists, and how to manipulate them. The goal of this page is to provide documentation on this configuration file's database structure and data fields, to facilitate the configu- ration and deployment of L2TP or PPTP VPN Servers by invoking vpnd without specifying any specific server profile. /ActiveServers Lists the server identifiers that are currently available for use. These servers will be started in the abscense of vpnd -i <server_id> parameter. /Servers Defines the following dictionaries: DNS, IPv4, Interface, PPP, Radius, Server (common); IPSec, L2TP (for L2TP tunnels only) /Servers/<server_id> Indicates a user-defined named VPN profile configuration, identified with the <server_id> parameter defined in vpnd(8) There are 2 default server configurations available: com.apple.ppp.l2tp and com.apple.ppp.pptp /Server/<server_id>/DNS Contains two Arrays of Strings: OfferedSearchDomains - which lets the server specify what DNS domain(s) a VPN client should belong to OfferedServerAddresses - which specify the primary and (optional) secondary DNS servers a VPN client will use to resolve FQDN's. /Servers/<server_id>/IPv4 Contains 4 arrays of Strings, and one String: DestAddressRanges - which specifies the start and end IP addresses range. The Server will give an IP address to a connecting PPP-VPN client after the successful negotiation of IPCP from this range. OfferedRouteAddresses - which lists the network address(es) to each route the Server will serve to any connecting VPN client. OfferedRouteMasks - which lists the network mask(s) to each route the Server will serve to any connecting VPN client. OfferedRouteTypes - which lists the attribute flag(s) to each route the Server will serve to any connecting VPN client. Valid types include: Public - VPN Client will forward traffic destined to VPN subnet to its Public interface. Private - VPN Client will forward traffic destined to VPN subnet to its Private interface. Default value is Public. ConfigMethod - The method through which a VPN IP interface will configure its IP address; default value is "Manual". /Servers/<server_id>/Interface - Specifies the VPN interface's base type: PPP or IPSec and, its subtype: L2TP or PPTP /Server/<server_id>/PPP - Defines Parameters necessary for PPP protocol negotiations for successful VPN functionality. AuthenticatorACLPlugins - Access Control List that determines if a given user accounts has sign-on priviledges to the VPN server. AuthenticatorPlugins - An optional plug-in used to authenticate local users with an account on the target server. Used in conjunction with OpenDirectory/DirectoryServices facilities. AuthenticatorEAPPlugins - User authentication using EAP protocol, with Digital Certificates. L2TP VPN uses Kerberos "EAP-KRB" certificates or RSA "EAP-RSA" SecurID tokens; PPTP VPN uses RSA SecurID tokens only. AuthenticatorProtocol - Protocol(s) in use for carrying out PPP authentication. Valid values are "MSCHAP", "MSCHAPv2", "PAP", "EAP" ACSPEnabled - Enable/Disable ACSP protocol, which passes DHCP-like messages from VPN client to server; used mostly to convey static routes from server to client and DNS domains. DisconnectOnIdle - Enable/Disable flag for PPP Connection Idling. If Enabled, PPP connection will terminate after not seeing any application data going through the VPN interface. DisconnectOnIdleTimer - Time to wait (in seconds) before PPP connection goes down without any data passing through the VPN interface. IPCPCompressionVJ - Enable/Disable IPCP Van-Jacobson Compression Algorithm. Recommended setting is Disable(0). LCPEchoEnabled - Enable/Disable Link Control Protocol (LCP) Echoing feature. LCPEchoFailure - Number of LCP Echo Requests sent without any response from the PPP peer before declaring PPP link failure (and subsequent teardown) LCPEchoInterval - Time interval in seconds elapsed between consecutive LCP Echo Requests sent to the PPP peer. LogFile - VPN log file for PPP VerboseLogging - Enables/Disables extra logging within PPP CCPEnabled (PPTP only) - Enables/Disables CCP negotiation for PPP; default value is true(1) CCPProtocols (PPTP only) - List of protocols supported by CCP layer; default value is "MPPE" MPPEKeySize128 (PPTP only) - Enables/Disables MPPE 128-bit encryption algorithm; default value is true(1) MPPEKeySize40 (PPTP only) - Enables/Disables MPPE 40-bit encryption algorithm; default value is false(0) Note: The previous 2 settings are not necessarily mutually-exclusive! The 2 PPP peers will attempt to negotiate to the strongest encryption policy, whenever possible. /Servers/<server_id>/Radius - Contains an Array with 2 Dictionaries. The entries are Radius servers that a VPN server must authenticate a client user against before completing the PPP negotiation. Each entry indicates the server's IP address, and the shared secret key used for the RADIUS AAA exchange between said server and the VPN server. The first Array entry indicates primary server, the other is secondary server. /Servers/<server_id>/Server - Contains VPN server parameters LogFile - VPN log file for PPP VerboseLogging - Enables/Disables extra logging within PPP MaximumSessions - maximum number of simultaneous VPN tunnel sessions active on the VPN server. This setting is now deprecated; the VPN sub- net determines the maximum number of sessions. LoadBalancingEnabled (L2TP only) - Enable/Disable load balancing feature for L2TP VPN. This feature allows a collection of L2TP VPN servers on a common LAN segment to share a common "virtual" address. A L2TP client can specify this virtual address to connect to the server. The server within the collection that "owns" the virtual address will then redirect the initial L2TP request message to the "least busy" server within the collection (which can include the redirecting VPN server!) LoadBalancingAddress (L2TP only) - L2TP load-balancing virtual IP address /Servers/<server_id>/IPSec - L2TP only; L2TP VPN tunnels are secured using IPSec transport mode, with IKEv1 negotiation. The following parameters configure the ISAKMP Security Association required to run this type of IPSec Security Association. AuthenticationMethod - the method for IKE authentication; default value is "SharedSecret" IdentifierVerification - Used during IKE negotiation; default value set to "NONE" LoadCertificate - X.509/PKI Certificate binary data LocalIdentifier - String identifying the local IPsec entity; not used for L2TP VPN. RemoteIdentifier - String identifying the remote IPsec entity; not used for L2TP VPN. SharedSecret - Shared secret String known between the negotiating L2TP peers. SharedSecretEncryption - Indicates where L2TP secret key information is stored. If set to "Keychain", the SharedSecret key value points to the shared secret key stored in the Keychain. If absent, SharedSecret value is to taken explicitly /Servers/<server_id>/L2TP/Transport - Defines the underlying transport protocol for L2TP; default value is IPSec TEMPLATE CONFIGURATION FILE
To properly extract this file, run the following command: man 5 vpnd | col -b > com.apple.RemoteAccessServers.plist and cut out the non-XML text from the file then copy the file to the proper directory. ---- CUT HERE ---- <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ActiveServers</key> <array> <string>com.apple.ppp.l2tp</string> <string>com.apple.ppp.pptp</string> </array> <key>Servers</key> <dict> <key>com.apple.ppp.l2tp</key> <dict> <key>DNS</key> <dict> <key>OfferedSearchDomains</key> <array> <string>Replace with DNS search domain(s) - remove if not needed</string> </array> <key>OfferedServerAddresses</key> <array> <string>Replace with IPv4 DNS server address(es) - remove if not needed</string> </array> </dict> <key>IPSec</key> <dict> <key>AuthenticationMethod</key> <string>SharedSecret</string> <key>IdentifierVerification</key> <string>None</string> <key>LocalCertificate</key> <data></data> <key>LocalIdentifier</key> <string></string> <key>RemoteIdentifier</key> <string></string> <key>SharedSecret</key> <string>com.apple.ppp.l2tp</string> <key>SharedSecretEncryption</key> <string>Keychain</string> </dict> <key>IPv4</key> <dict> <key>ConfigMethod</key> <string>Manual</string> <key>DestAddressRanges</key> <array> <string>Replace with Starting VPN address - IPv4 address</string> <string>Replace with End VPN address - IPv4 address</string> </array> <key>OfferedRouteAddresses</key> <array> <string>Replace with Offered Routes addresses - remove if not needed</string> </array> <key>OfferedRouteMasks</key> <array> <string>Replace with Offered Route Masks - remove if not needed</string> </array> <key>OfferedRouteTypes</key> <array> <string>Replace with Offered Route Type(s) - remove if not needed</string> </array> </dict> <key>Interface</key> <dict> <key>SubType</key> <string>L2TP</string> <key>Type</key> <string>PPP</string> </dict> <key>L2TP</key> <dict> <key>Transport</key> <string>IPSec</string> </dict> <key>PPP</key> <dict> <key>ACSPEnabled</key> <integer>1</integer> <key>AuthenticatorACLPlugins</key> <array> <string>DSACL</string> </array> <key>AuthenticatorEAPPlugins</key> <array> <string>EAP-KRB</string> </array> <key>AuthenticatorPlugins</key> <array> <string>DSAuth</string> </array> <key>AuthenticatorProtocol</key> <array> <string>MSCHAP2</string> </array> <key>DisconnectOnIdle</key> <integer>1</integer> <key>DisconnectOnIdleTimer</key> <integer>7200</integer> <key>IPCPCompressionVJ</key> <integer>0</integer> <key>LCPEchoEnabled</key> <integer>1</integer> <key>LCPEchoFailure</key> <integer>5</integer> <key>LCPEchoInterval</key> <integer>60</integer> <key>Logfile</key> <string>/var/log/ppp/vpnd.log</string> <key>VerboseLogging</key> <integer>1</integer> </dict> <key>Radius</key> <dict> <key>Servers</key> <array> <dict> <key>Address</key> <string>Replace with Primary Server IPv4 Address</string> <key>SharedSecret</key> <string>Replace with Server Shared Secret string</string> </dict> <dict> <key>Address</key> <string>Replace with Secondary Server IPv4 Address</string> <key>SharedSecret</key> <string>Replace with Secondary Server Shared Secret string</string> </dict> </array> </dict> <key>Server</key> <dict> <key>LoadBalancingAddress</key> <string>Replace with IPv4 address</string> <key>LoadBalancingEnabled</key> <integer>0</integer> <key>Logfile</key> <string>/var/log/ppp/vpnd.log</string> <key>MaximumSessions</key> <integer>128</integer> <key>VerboseLogging</key> <integer>1</integer> </dict> </dict> <key>com.apple.ppp.pptp</key> <dict> <key>DNS</key> <dict> <key>OfferedSearchDomains</key> <array> <string>Replace with DNS search domain(s) - remove if not needed</string> </array> <key>OfferedServerAddresses</key> <array> <string>Replace with IPv4 DNS server address(es) - remove if not needed</string> </array> </dict> <key>IPv4</key> <dict> <key>ConfigMethod</key> <string>Manual</string> <key>DestAddressRanges</key> <array> <string>Replace with Starting VPN address - IPv4 address</string> <string>Replace with End VPN address - IPv4 address</string> </array> <key>OfferedRouteAddresses</key> <array> <string>Replace with Offered Routes addresses - remove if not needed</string> </array> <key>OfferedRouteMasks</key> <array> <string>Replace with Offered Route Masks - remove if not needed</string> </array> <key>OfferedRouteTypes</key> <array> <string>Replace with Offered Route Types - remove if not needed</string> </array> </dict> <key>Interface</key> <dict> <key>SubType</key> <string>PPTP</string> <key>Type</key> <string>PPP</string> </dict> <key>PPP</key> <dict> <key>ACSPEnabled</key> <integer>1</integer> <key>AuthenticatorACLPlugins</key> <array> <string>DSACL</string> </array> <key>AuthenticatorEAPPlugins</key> <array> <string>EAP-RSA</string> </array> <key>AuthenticatorPlugins</key> <array> <string>DSAuth</string> </array> <key>AuthenticatorProtocol</key> <array> <string>MSCHAP2</string> </array> <key>CCPEnabled</key> <integer>1</integer> <key>CCPProtocols</key> <array> <string>MPPE</string> </array> <key>DisconnectOnIdle</key> <integer>1</integer> <key>DisconnectOnIdleTimer</key> <integer>7200</integer> <key>IPCPCompressionVJ</key> <integer>0</integer> <key>LCPEchoEnabled</key> <integer>1</integer> <key>LCPEchoFailure</key> <integer>5</integer> <key>LCPEchoInterval</key> <integer>60</integer> <key>Logfile</key> <string>/var/log/ppp/vpnd.log</string> <key>MPPEKeySize128</key> <integer>1</integer> <key>MPPEKeySize40</key> <integer>0</integer> <key>VerboseLogging</key> <integer>1</integer> </dict> <key>Radius</key> <dict> <key>Servers</key> <array> <dict> <key>Address</key> <string>Replace with Primary Server IPv4 Address</string> <key>SharedSecret</key> <string>Replace with Primary Server Shared Secret string</string> </dict> <dict> <key>Address</key> <string>Replace with Secondary Server IPv4 Address</string> <key>SharedSecret</key> <string>Replace with Secondary Server Shared Secret string</string> </dict> </array> </dict> <key>Server</key> <dict> <key>Logfile</key> <string>/var/log/ppp/vpnd.log</string> <key>MaximumSessions</key> <integer>128</integer> <key>VerboseLogging</key> <integer>1</integer> </dict> </dict> </dict> </dict> </plist> ---- CUT HERE ---- SEE ALSO
vpnd(8) Mac OS X 17 August 2009 Mac OS X
All times are GMT -4. The time now is 11:54 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy