Date: Thu, 23 Apr 2009 16:37:14 +0200 From: Sebastiaan van Erk <sebster@sebster.com> To: Max Laier <max@love2party.net> Cc: freebsd-pf@freebsd.org Subject: Re: "BAD ICMP" message Message-ID: <49F07D1A.9010302@sebster.com> In-Reply-To: <200904231559.13059.max@love2party.net> References: <49EFF732.3010402@sebster.com> <200904231559.13059.max@love2party.net>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
Hi,
Thanks for the reply.
Actually it is the case that the interface are bridged. Here's a list of
the entire setup:
em0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0
mtu 1500
options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 00:0c:29:61:2a:4b
inet 111.111.111.111 netmask 0xfffffff0 broadcast 212.61.136.79
media: Ethernet autoselect (1000baseTX <full-duplex>)
status: active
em1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0
mtu 1500
options=98<VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 00:0c:29:61:2a:55
inet 10.0.80.77 netmask 0xffffff00 broadcast 10.0.80.255
media: Ethernet autoselect (1000baseTX <full-duplex>)
status: active
em2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0
mtu 1500
options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 00:0c:29:61:2a:5f
inet 10.0.81.77 netmask 0xffffff00 broadcast 10.0.81.255
media: Ethernet autoselect (1000baseTX <full-duplex>)
status: active
em3: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0
mtu 1500
options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 00:0c:29:61:2a:69
inet 10.0.82.77 netmask 0xffffff00 broadcast 10.0.82.255
media: Ethernet autoselect (1000baseTX <full-duplex>)
status: active
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> metric 0
mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
inet6 ::1 prefixlen 128
inet 127.0.0.1 netmask 0xff000000
pfsync0: flags=0<> metric 0 mtu 1460
syncpeer: 224.0.0.240 maxupd: 128
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu
1500
ether f2:f4:c1:45:e7:50
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
member: tap0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 9 priority 128 path cost 2000000
member: em1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 2 priority 128 path cost 20000
tap0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric
0 mtu 1500
ether 00:bd:96:02:00:00
Opened by PID 1310
carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
inet 111.111.111.112 netmask 0xfffffff0
carp: MASTER vhid 1 advbase 1 advskew 0
carp1: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
inet 10.0.80.74 netmask 0xffffff00
carp: MASTER vhid 2 advbase 1 advskew 0
carp2: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
inet 10.0.81.74 netmask 0xffffff00
carp: MASTER vhid 3 advbase 1 advskew 0
carp3: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
inet 10.0.82.74 netmask 0xffffff00
carp: MASTER vhid 4 advbase 1 advskew 0
pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33160
em0 is the external interface, em1 is the vpn interface, and em2 and em3
have production machines on them...
The tap0 is the interface used by openvpn. It is bridged in bridge0 to
the internal em1 network. Since it is bridged, my feeling says that the
two VPN clients (10.0.80.4 and 10.0.80.150) should be able to talk
directly to eachother. I have no idea why my linux box (10.0.80.150)
thinks it can't directly talk to the other vpn client and talks via the
gateway instead. I get a lot of these ICMP redirects on tap0:
# tcpdump -ni tap0 icmp
tcpdump: WARNING: tap0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 96 bytes
16:32:51.719979 IP 10.0.80.77 > 10.0.80.150: ICMP redirect 10.0.80.4 to
host 10.0.80.4, length 60
I'm sure I'm doing something wrong somewhere, but I can't quite figure
it out.
Regards,
Sebastiaan
Max Laier wrote:
> On Thursday 23 April 2009 07:05:54 Sebastiaan van Erk wrote:
>> Apr 23 06:58:38 vpn3 kernel: pf: loose state match: TCP
>> 10.0.80.150:51422 10.0.80.150:51422 10.0.80.4:22 [lo=3150927679
>> high=3150923785 win=692 modulator=0] [lo=0 high=692 win=1 modulator=0]
>> 2:0 A seq=3150927679 (3150927679) ack=0 len=0 ackskew=0 pkts=77:0
>> Apr 23 06:58:38 vpn3 kernel: pf: BAD ICMP 5:1 10.0.80.77 -> 10.0.80.150
> ^
>
> These are ICMP redirect messages. This clearly suggests that something is
> very wrong with your routing. I assume your netmasks are wrong. It looks
> like 10.0.80.77 thinks that 10.0.80.150 can reach 10.0.80.4 directly which is
> not the case - it needs to route through 10.0.80.77.
>
>> state: TCP 10.0.80.4:22 10.0.80.4:22 10.0.80.150:51422 [lo=3150927679
>> high=3150923785 win=692 modulator=0] [lo=0 high=692 win=1 modulator=0]
>> 2:0 seq=3150927679
>>
>> I see this message several times and the connection no longer works
>> after that.
>>
>> Does anybody know what's going on and how I can fix it?
>
> Use separate ip-ranges on either side of the vpn-router or combine vpn-
> endpoints from the same subnet in a bridge interface to allow direct
> communication between all members in one subnet.
>
[-- Attachment #2 --]
0 *H
01 0 + 0 *H
Q00lS|
6$1-~j0
*H
0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
080630135157Z
090630135157Z0h10Uvan Erk10U*
Sebastiaan10USebastiaan van Erk1"0 *H
sebster@sebster.com0"0
*H
0
Va\bEnݚa<M8ʄ^tv>x73bohi2oqS_¶Bm^p* I x"9 pt!j ar#)n)^? 'z<).+Ѐ4ig R'UP*\Ւ ,?.;?f BܯTzM IDվCK*3Yŧ
mcaztxʐsq/ 00.0 U 0sebster@sebster.com0 U 0 0
*H
KT4W6ӽq]
tS` %f1 G:H b zJj$EjE'JV~-VbVnJZ E/`@@04!+T: c پf`$Z=1#|oG[OB RG00lS|
6$1-~j0
*H
0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
080630135157Z
090630135157Z0h10Uvan Erk10U*
Sebastiaan10USebastiaan van Erk1"0 *H
sebster@sebster.com0"0
*H
0
Va\bEnݚa<M8ʄ^tv>x73bohi2oqS_¶Bm^p* I x"9 pt!j ar#)n)^? 'z<).+Ѐ4ig R'UP*\Ւ ,?.;?f BܯTzM IDվCK*3Yŧ
mcaztxʐsq/ 00.0 U 0sebster@sebster.com0 U 0 0
*H
KT4W6ӽq]
tS` %f1 G:H b zJj$EjE'JV~-VbVnJZ E/`@@04!+T: c پf`$Z=1#|oG[OB RG0?0
0
*H
01 0 UZA10U Western Cape10U Cape Town10U
Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *H
personal-freemail@thawte.com0
030717000000Z
130716235959Z0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA00
*H
0 Ħ<UsUNʙZ hup [v :aQP
0cZ,p+Z?qV˯< 6$*+w=+>@dקe*TH<a@ dr` 00U 0 0CU <0:08642http://crl.thawte.com/ThawtePersonalFreemailCA.crl0 U 0)U "0 0 10UPrivateLabel2-1380
*H
HP .
fgCL!6 -6/ P p<ab:~ t%Pb'qW%ݩ9 Oe_N4[5MwV!x!5$ F]_eO1q0m0v0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAS|
6$1-~j0 + 0 *H
1 *H
0 *H
1
090423143714Z0# *H
1E m8bl,b<0_ *H
1R0P0 `He0
*H
0*H
0
*H
@0+0
*H
(0 +71x0v0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAS|
6$1-~j0 *H
1xv0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAS|
6$1-~j0
*H
Lk̒L >ԣ,G?9 ronj|Hhs4jE1Td<Zz8ՠ IsC:V MfHԥ$KMN3- d IhE
nǫ@{dSrpQb vI` Eg ߚikO]\C6¾HA Xd?= `Famq r9+eL#
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?49F07D1A.9010302>