Date: Wed, 21 Nov 2007 14:43:10 +0100 From: Ljupco Vangelski <ljupco.vangelski@gmail.com> To: freebsd-isp@freebsd.org Subject: Problems with FreeBSD PPPOE server Message-ID: <474435EE.4010704@gmail.com>
next in thread | raw e-mail | index | archive | help
Hi, first I want to apologize for the size of this mail, but I want to explain the situtation better. I'm using a FreeBSD PPPoE server and freeRadius RADIUS server for providing dsl services to clients. My configuratino is as follows: - FreeBSD 6.0 - user PPP for PPPoE server - freeRadius 1.1.6 for RADIUS server I have multiple vlan's on one network interface, and I have different PPPoE severs listening on each one: /usr/libexec/pppoed -d -P /var/run/pppoed-1.pid -a PPPoE-Service-1 -l ppppe-1 vlan1 /usr/libexec/pppoed -d -P /var/run/pppoed-2.pid -a PPPoE-Service-3 -l ppppe-2 vlan2 /usr/libexec/pppoed -d -P /var/run/pppoed-3.pid -a PPPoE-Service-3 -l ppppe-3 vlan3 My ppp.conf looks like this: pppoe-1: set log Chat Command Phase Alert Error TUN enable pap allow mode direct disable ipv6cp set mru 1492 set mtu 1492 set timeout 0 enable lqr echo set lqrperiod 30 set ifaddr 10.0.1.1 10.0.1.2-10.0.1.255 set radius /etc/ppp/radius.conf set rad_alive 60 set dns {ip-ns1} {ip-ns2} accept dns pppoe-2: set log Chat Command Phase Alert Error TUN enable pap allow mode direct disable ipv6cp set mru 1492 set mtu 1492 set timeout 0 enable lqr echo set lqrperiod 30 set ifaddr 10.0.2.1 10.0.2.2-10.0.2.255 set radius /etc/ppp/radius.conf set rad_alive 60 set dns {ip-ns1} {ip-ns2} accept dns pppoe-3: set log Chat Command Phase Alert Error TUN enable pap allow mode direct disable ipv6cp set mru 1492 set mtu 1492 set timeout 0 enable lqr echo set lqrperiod 30 set ifaddr 10.0.3.1 10.0.3.2-10.0.3.255 set radius /etc/ppp/radius.conf set rad_alive 60 set dns {ip-ns1} {ip-ns2} accept dns I have few problems which I cannot solve: * 1) First is a problem with a Linksys SPA3102 Voice Gateway with Router**** which is making an PPPoE connection to my server and responds with lqr packets with unexpected length. I've tried with the newest firmware from Linksys, but the same happens. After 5 LQR Echo packets are lost, the PPP session is terminated and the Linksys must reestablish it. This has something to do with the Linksys, but is there any workaround, can I tell the PPPoE server to accept LQR packets with length 6? In man ppp I only see parametars about lcq frequency. set openmode passive doesn't help as well. Here is the log from my server: pppoed ppp[22886]: tun99: LCP: deflink: SendEchoRequest(2) state = Opened pppoed ppp[22886]: tun99: LCP: deflink: RecvEchoReply(2) state = Opened pppoed ppp[22886]: tun99: Warning: lqr_RecvEcho: Got packet size 6, expecting 12 ! * 2) Sometimes when a client gets disconnected, the ppp process stays alive, keeping the tun interface up and the public IP address active. So, the freeRadius assigns that IP address to another client, and scince the stalled connection is active, the gateway for that IP address is the first tun interface and not the on on which the latter client which gets connected. And the latter client doesn't have any service, because previous ppp connection stays up instead of terminating when the client is disconnected (even though the client is disconnected at the RADIUS server, the ppp.linkdown script is executed). Here is a log from the ppp.log file concerning this connection. == Establishing connection == Nov 17 08:46:50 pppoed ppp[95701]: Phase: Using interface: tun56 Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: enable pap Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: disable ipv6cp Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: set mru 1492 Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: set mtu 1492 Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: set timeout 0 Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: enable lqr echo Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: set lqrperiod 30 Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: set ifaddr 10.0.2.1 10.0.2.2-10.0.2.255 Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: set radius /etc/ppp/radius.conf Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: set rad_alive 60 Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: set dns 80.77.144.10 80.77.144.11 Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: pppoe-2: accept dns Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: PPP Started (direct mode). Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: bundle: Establish Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: deflink: closed -> opening Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: deflink: Link is a netgraph node Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: deflink: Connected! Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: deflink: opening -> carrier Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: deflink: carrier -> lcp Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: bundle: Authenticate Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: deflink: his = none, mine = PAP Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: Pap Input: REQUEST (almqwr14h) Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: Radius: Request sent Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: Radius(auth): ACCEPT received Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: Session-Timeout 43200 Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: IP 88.85.109.31 Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: Netmask 255.255.255.255 Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: Pap Output: SUCCESS Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: deflink: lcp -> open Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: bundle: Network Nov 17 08:46:50 pppoed ppp[95701]: tun56: Phase: Radius(acct): START data sent Nov 17 08:46:50 pppoed ppp[95701]: tun56: Command: breezeaccess-vodno: bg /etc/ppp/addClient.sh USER connect HISADDR INTERFACE PPPoE-Service-2 PROCESSID Nov 17 08:46:50 pppoed ppp[95701]: tun56: Warning: ff02:45::/32: Change route failed: errno: Network is unreachable == Terminating connection == Nov 17 08:50:50 pppoed ppp[95701]: tun56: Phase: deflink: open -> lcp Nov 17 08:50:50 pppoed ppp[95701]: tun56: Warning: ff02:45::/32: Change route failed: errno: Network is unreachable Nov 17 08:50:50 pppoed ppp[95701]: tun56: Phase: Radius(acct): STOP data sent Nov 17 08:50:50 pppoed ppp[95701]: tun56: Command: pppoe-2: bg /etc/ppp/removeClient.sh USER connect HISADDR INTERFACE PPPoE-Service-2 PROCESSID Nov 17 08:50:51 pppoed ppp[95701]: tun56: Phase: bundle: Terminate But, the process holding the interface tun56 stays up and still holds the IP 88.85.109.31 * 3) I have ppp processes which keep tun interfaces up, but aren't associated with any RADIUS user. For example tun44: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500 inet 10.0.2.1 --> 10.0.2.63 netmask 0xffffffff Opened by PID 8455 tun45: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500 inet 10.0.2.1 --> 10.0.2.188 netmask 0xffffffff Opened by PID 51922 Information about the process: [root@pppoed ~]# ps -auwx | grep 8455 root 8455 0.0 0.2 3252 1900 ?? Ss 13Nov07 0:22.31 /usr/sbin/ppp -direct pppoe-2 First the MTU is 1500 (not specified anywhere in my /etc/ppp/ppp.conf) and the addresses are not from the ippool of the freeradius. Why do these connections stay up and don't terminate? Can this cause a DoS attack on my router? For example a client starts establishing may ppp connections. Is there a way to limit the number of pppoe connections (total or per MAC address)? If I set the timeout value, I guess that the connections will terminate after that amount of seconds, but can I add priority to the Session-Timeout attribute of the RADIUS server, because the set timeout is set for all clients. * 4) Though I think that this is purely freeRadius issue, I would appreciate any suggestions, scince I can't solve this annoyng problem. The freeRadius assigns duplicate IP addresses to different clients, even though the requests come from the same NAS and different PORT type. I use freeRadius 1.1.6 with ippool. The feature works great, but once in week or so - this happens. It can be resolved only by terminating both of the processes, restarting the radius and clearing the Here is an extraction from my radiusd.conf concerning pools. ippool soho-1 { range-start = 88.85.109.1 range-stop = 88.85.109.128 netmask = 255.255.255.255 cache-size = 0 session-db = ${raddbdir}/nov-pool-soho-1 ip-index = ${raddbdir}/nov-pool-index-1 override = yes maximum-timeout = 0 } ippool soho-2 { range-start = 88.85.109.129 range-stop = 88.85.109.192 netmask = 255.255.255.255 cache-size = 0 session-db = ${raddbdir}/nov-pool-soho-2 ip-index = ${raddbdir}/nov-pool-index-2 override = yes maximum-timeout = 0 } ippool soho-3 { range-start = 88.85.109.193 range-stop = 88.85.109.255 netmask = 255.255.255.255 cache-size = 0 session-db = ${raddbdir}/pool-soho-3 ip-index = ${raddbdir}/pool-index-3 override = yes maximum-timeout = 0 } I also have them in the accounting and post-auth sections: accounting { ... soho-1 soho-2 soho-3 ... } post-auth { ... soho-1 soho-2 soho-3 ... } Thank You very much for Your time, -- Ljupco
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?474435EE.4010704>