Hallo, was mich betrifft, kann ich nur sagen, ISDN unter 6.3 ist echt was für Nager. Ich hatte das gleiche Problem. Eine Einwahl OK, dann wurde die Verbindung beendet : Route gelöscht (ip-down) und nichts ging mehr. Bin echt verzweifelt. Jetzt habe ich mit 7.0 Standard-Kernel und Masquerading Script keine Probleme es klappt alles auf Anhieb. Allerdings auch nur mit der Professional 7.0. So viel Zeit vergeudet mit 6.3 - ist glaube ich buggy !!! -----Original Message----- From: Thorsten Marquardt [mailto:THOM@kaupp.chemie.uni-oldenburg.de] Sent: Monday, October 30, 2000 3:21 PM To: suse-isdn@suse.com Subject: [suse-isdn] Re: Nur Einmalverbindung möglich? Hallo Martin, Am 29-Okt-00 schriebst Du:

Hallo Leute,

Mein Dialin-Server (SuSE 6.3; AVM Fritz PCI) ist auf automatischen Verbindungsaufbau eingestellt. Sobald er allerdings einmal die Verbindung getrennt hat und wieder versucht eine neue aufzubauen, wählt er zwar an, aber es gehen keine Daten mehr über die Leitung. In /var/log/messages hab ich keinen Hinweis gefunden, nur die jeweiligen Wählversuche!

Weis jemand woran das liegen kann?

Fehlerhaftes Routing, fehlerhafter FW-Script. Was sagt Dir denn ifconfig nach der zweiten Einwahl und wie sieht dann die Rouingtabelle aus (netstat -nr) Grüße Thom -- Software suppliers are trying to make their software packages more 'user-friendly'.... Their best approach, so far, has been to take all the old brochures, and stamp the words, 'user-friendly' on the cover. -- Bill Gates ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM@kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://www.pzt.de ------------------------------------------------------------------- --------------------------------------------------------------------- To unsubscribe, e-mail: suse-isdn-unsubscribe@suse.com For additional commands, e-mail: suse-isdn-help@suse.com

Hallöchen,

Mein Dialin-Server (SuSE 6.3; AVM Fritz PCI) ist

...

auf automatischen Verbindungsaufbau eingestellt. Sobald er allerdings einmal die Verbindung getrennt hat und wieder versucht eine neue aufzubauen, wählt er zwar an, aber es gehen keine Daten mehr über die Leitung. In /var/log/messages hab ich keinen Hinweis gefunden, nur die jeweiligen Wählversuche!

Weis jemand woran das liegen kann?

Fehlerhaftes Routing, fehlerhafter FW-Script. Was sagt Dir denn ifconfig nach der zweiten Einwahl und wie sieht dann die Rouingtabelle aus (netstat -nr)

Damit kann ich dienen: Vorher: root@hofgesang:/home/martin > netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 193.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 ippp0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 193.158.137.61 0.0.0.0 UG 0 0 0 ippp0 root@hofgesang:/home/martin > ifconfig eth0 Link encap:Ethernet HWaddr 00:50:04:37:39:D6 inet addr:192.168.0.99 Bcast:192.168.0.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:562 errors:0 dropped:0 overruns:0 frame:0 TX packets:658 errors:0 dropped:0 overruns:0 carrier:0 collisions:7 txqueuelen:100 Interrupt:11 Base address:0xfc80 ippp0 Link encap:Point-to-Point Protocol inet addr:62.224.37.32 P-t-P:193.158.137.61 Mask:255.0.0.0 UP POINTOPOINT RUNNING NOARP DYNAMIC MTU:1500 Metric:1 RX packets:570 errors:0 dropped:0 overruns:0 frame:0 TX packets:548 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:30 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:3924 Metric:1 RX packets:464 errors:0 dropped:0 overruns:0 frame:0 TX packets:464 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 Nachher: root@hofgesang:/home/martin > ifconfig eth0 Link encap:Ethernet HWaddr 00:50:04:37:39:D6 inet addr:192.168.0.99 Bcast:192.168.0.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:6729 errors:0 dropped:0 overruns:0 frame:0 TX packets:7815 errors:0 dropped:0 overruns:0 carrier:0 collisions:32 txqueuelen:100 Interrupt:11 Base address:0xfc80 ippp0 Link encap:Point-to-Point Protocol inet addr:192.168.0.99 P-t-P:192.168.0.1 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP DYNAMIC MTU:1500 Metric:1 RX packets:11067 errors:0 dropped:0 overruns:0 frame:0 TX packets:12215 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:30 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:3924 Metric:1 RX packets:5084 errors:0 dropped:0 overruns:0 frame:0 TX packets:5084 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 root@hofgesang:/home/martin > netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 192.168.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 192.168.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 ippp0 root@hofgesang:/home/martin > Nur schlau werde ich da leider nicht draus :-(( Danke schonmal für die Antworten! Martin

Hallöchen,

Ich hoffe, daß ich mit meiner Analyse nicht so völlig fasch liege. Aber mich würde interessieren, welcher Provider denn so merkwürdige Netzwerkkonfigurationen macht.

Erstmal danke für die bisherigen Antworten! Ich hab jetzt die IP-Adresse vom ippp0 auf 192.168.1.99 geändert und den default-Gateway auf 192.168.1.1 inkl. P-t-P-Partner auch auf 192.168.1.1. Jetzt ändert er in Ifconfig und netstat -nr auch alles korrekt, soweit ich das beurteilen kann, nur leider hat sich das Problem noch nicht aufgelöst :-(( Da ich vorher gehört habe, dass auch ein fehlerhaftes Firewall-Skript dafür zuständig sein kann und ich die Firewall im Einsatz habe, könntet Ihr euch das mal anschauen? Ach übrigens, der Provider ist T-Online!! Danke Martin ------ # # 1.) # Should the Firewall be started? # # This setting is done in /etc/rc.config (START_FW="yes") # # 2.) # Which is the interface that points to the internet? # # Enter all the network devices here which are untrusted. # # Choice: any number of devices, seperated by a space # e.g. "eth0", "ippp0 ippp1" # FW_DEV_WORLD="ippp0" # # You *may* configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_WORLD_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # #FW_DEV_WORLD_ippp0="192.168.0.1 255.255.255.255" # e.g. for exernal interface ippp0 # # 3.) # Which is the interface that points to the internal network? # # Enter all the network devices here which are trusted. # If you are not connected to a trusted network (e.g. you have just a # dialup) leave this empty. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1" or "" # FW_DEV_INT="eth0" # # You may configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_INT_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # #FW_DEV_INT_eth0="192.168.1.1 255.255.255.0" # e.g. for internal interface eth0 # # 4.) # Which is the interface that points to the dmz network? # # Enter all the network devices here which point to the dmz. # A "dmz" is a special, seperated network, which is only connected to the # firewall, and should be reachable from the internet to provide services, # e.g. WWW, Mail, etc. and hence are at risk from attacks. # See /usr/doc/packages/firewals/EXAMPLES for an example. # # Special note: You have to configure FW_FORWARD_TCP and FW_FORWARD_UDP to # define the services which should be available to the internet and set # FW_ROUTE to yes. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1" or "" # FW_DEV_DMZ="" # # You may configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_INT_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # #FW_DEV_DMZ_eth1="192.168.1.1 255.255.255.0" # e.g. for dmz interface eth1 # # 5.) # Should routing between the internet, dmz and internal network be activated? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ # # You need only set this to yes, if you either want to masquerade internal # machines or allow access to the dmz (or internal machines, but this is not # a good idea). This option supersedes IP_FORWARD from /etc/rc.config! # # Setting this option one alone doesn't do anything. Either activate # massquerading with FW_MASQUERADE below if you want to masquerade your # internal network to the internet, or configure FW_FORWARD_TCP and/or # FW_FORWARD_UDP to define what is allowed to be forwarded! # # Choice: "yes" or "no", defaults to "no" # FW_ROUTE="yes" # # 6.) # Do you want to masquerade internal networks to the outside? # REQUIRES: FW_DEV_INT, FW_ROUTE # # "Masquerading" means that all your internal machines which use services on # the internet seem to come from your firewall. # Please note that it is more secure to communicate via proxies to the # internet than masquerading # # Choice: "yes" or "no", defaults to "no" # FW_MASQUERADE="yes" # # Which internal computers/networks are allowed to access the internet # directly (not via proxys on the firewall)? # Only these networks will be allowed access and will be masqueraded! # # Choice: leave empty or any number of computers and/or networks, seperated by # a space. You may NOT set this to "0/0" ! # e.g. "10.0.0.0/8", "10.0.0.1 10.0.0.10 10.10.10.0/24" or "" # FW_MASQ_NETS="192.168.0.2 192.168.0.3 192.168.0.4" # # If you want (and you should) you may also set the FW_MASQ_DEV option, to # specify the outgoing interface to masquerade on. (You would normally use # the external interface(s), the FW_DEV_WORLD device(s), e.g. "ippp0") # FW_MASQ_DEV="$FW_DEV_WORLD" # e.g. "ippp0" or "$FW_DEV_WORLD" # # 7.) # Do you want to protect the firewall from the internal network? # REQUIRES: FW_DEV_INT # # If you set this to "yes", internal machines may only access services on # the machine you explicitly allow. They will be also affected from the # FW_AUTOPROTECT_GLOBAL_SERVICES option. # If you set this to "no", any user can connect (and attack) any service on # the firewall. # # Choice: "yes" or "no", defaults to "yes" # FW_PROTECT_FROM_INTERNAL="no" # # 8.) # Do you want to autoprotect all global running services? # # If set to "yes", all network access to services TCP and UDP on this machine # which are not bound to a special IP address will be prevented (except to # those which you explicitly allow, see below: FW_*_SERVICES_*) # Example: "0.0.0.0:23" would be protected, but "10.0.0.1:53" not. # # Choice: "yes" or "no", defaults to "yes" # FW_AUTOPROTECT_GLOBAL_SERVICES="yes" # "yes" is a good choice # # 9.) # Which services on the firewall should be accessible from either the internet # (or other untrusted networks), the dmz or internal (trusted networks)? # # Enter all ports or known portnames below, seperated by a space. # TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_*_TCP, and # UDP services (e.g. syslog) must be set in FW_SERVICES_*_UDP. # e.g. if a webserver on the firewall should be accessible from the internet: # FW_SERVICES_EXTERNAL_TCP="www" # e.g. if the firewall should receive syslog messages from the dmz: # FW_SERVICES_DMZ_UDP="syslog" # # Choice: leave empty or any number of ports, known portnames (from # /etc/services) and port ranges seperated by a space. Port ranges are # written like this, from 1 to 10: "1:10" # e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514" # FW_SERVICES_EXTERNAL_TCP="119" # Common: smtp domain FW_SERVICES_EXTERNAL_UDP="" # Common: domain # FW_SERVICES_DMZ_TCP="119" # Common: smtp domain FW_SERVICES_DMZ_UDP="" # Common: domain syslog # FW_SERVICES_INTERNAL_TCP="119" # Common: ssh smtp domain FW_SERVICES_INTERNAL_UDP="" # Common: domain # # 10.) # Which services should be accessible from trusted hosts/nets on the internet? # # Define trusted networks on the internet, and the TCP and/or UDP services # they are allowed to use. # # Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or # networks, seperated by a space. e.g. "172.20.1.1", "172.20.0.0/16" # FW_TRUSTED_NETS="" # # leave FW_SERVICES_TRUSTED_* empty or any number of ports, known portnames # (from /etc/services) and port ranges seperated by a space. # e.g. "25", "ssh", "1:65535", "1 3:5" # FW_SERVICES_TRUSTED_TCP="" # Common: ssh FW_SERVICES_TRUSTED_UDP="" # Common: syslog time ntp # # 11.) # How is access allowed to high (unpriviliged [above 1023]) ports? # # You may either allow everyone from anyport access to your highports ("yes"), # disallow anyone ("no"), anyone who comes from a defined port (portnumber or # known portname) [note that this is easy to circumvent!], or just your # defined nameservers ("dns"). # Note that if you want to use normal (active) ftp, you have to set the TCP # option to ftp-data. If you use passive ftp, you don't need that. # Note that you can't use rpc requests (e.g. rpcinfo, showmount) as root # from a firewall using this script. # # Choice: "yes", "no", "dns", portnumber or known portname, defaults to "no" # FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # Common: "dns" # # 12.) # Are you running some of the services below? # They need special attention - otherwise they won´t work! # # Set services you are running to "yes", all others to "no", defaults to "no" # FW_SERVICE_DNS="yes" # if yes, FW_TCP_SERVICES_* needs to have port 53 # (or "domain") set to allow incoming queries. # also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes" FW_SERVICE_DHCLIENT="no" # if you use dhclient to get an ip address # you have to set this to "yes" ! FW_SERVICE_DHCPD="no" # set to yes, if this server is a DHCP server # # 13.) # Which services accessed from the internet should be allowed to the # dmz or internal network? # REQUIRES: FW_ROUTE # # With this option you may allow access to e.g. your mailserver. The # machines must have valid, non-private, IP addresses which were assigned to # you by your ISP. This opens a direct link to your network, so only use # this option for access to your dmz!!!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forwarding rules, seperated each by a space. # A forwarding rule consists of 1) source IP/net, 2) destination IP (dmz/intern) # and 3) destination port, seperated by a comma (","), e.g. # "4.0.0.0/8,1.1.1.1,22", # "4.4.4.4/12,20.20.20.20,22 12.12.12.12/12,20.20.20.20,22" # FW_FORWARD_TCP="" # Beware to use this! FW_FORWARD_UDP="" # Beware to use this! # # 14.) # Which accesses to services should be redirected to a localport on the # firewall machine? # This can be used to force all internal users to surf via your squid proxy, # or transparently redirect incoming webtraffic to a secure webserver. # # Choice: leave empty or use the following explained syntax of redirecting # rules, seperated by a space. # A redirecting rule consists of 1) source IP/net, 2) destination IP/net, # 3) original destination port and 4) local port to redirect the traffic to, # seperated by a colon. e.g. "10.0.0.0/8,0/0,80,3128 0/0,172.20.1.1,80,8080" # FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" # # 15.) # Which logging level should be enforced? # You can define to log packets which were accepted or denied. # You can also the set log level, the critical stuff or everything. # Note that logging *_ALL is only for debugging purpose ... # # Choice: "yes" or "no", FW_LOG_*_CRIT defaults to "yes", # FW_LOG_*_ALL defaults to "no" # FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" # # 16.) # Do you want to enable additional kernel TCP/IP security features? # If set to yes, some obscure kernel options are set. # (icmp_ignore_bogus_error_responses, icmp_echoreply_rate, # icmp_destunreach_rate, icmp_paramprob_rate, icmp_timeexeed_rate, # ip_local_port_range, log_martians, mc_forwarding, mc_forwarding, # rp_filter, routing flush) # Tip: Set this to "no" until you have verified that you have got a # configuration which works for you. Then set this to "yes" and keep it # if everything still works. (It should!) ;-) # # Choice: "yes" or "no", defaults to "yes" # FW_KERNEL_SECURITY="yes" # # 17.) # Keep the routing set on, if the firewall rules are unloaded? # REQUIRES: FW_ROUTE # # If you are using diald, or automatic dialing via ISDN, if packets need # to be sent to the internet, you need to turn this on. The script will then # not turn off routing and masquerading when stopped. # You *might* also need this if you have got a DMZ. # Please note that this is *insecure*! If you unload the rules, but are still # connected, you might your internal network open to attacks! # The better solution is to remove "/sbin/SuSEfirewall stop" or # "/sbin/init.d/firewall stop" from the ip-down script! # # # Choices "yes" or "no", defaults to "no" # FW_STOP_KEEP_ROUTING_STATE="yes" # # 18.) # Allow (or don't) ICMP echo pings on either the firewall or the dmz from # the internet? # REQUIRES: FW_ROUTE for FW_ALLOW_PING_DMZ # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" ## # END of rc.firewall ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # # # 19.) # Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall. # This is used for traceroutes to your firewall (or traceroute like tools). # # Please note that the unix traceroute only works if you say "yes" to # FW_UDP_ALLOW_INCOMING_HIGHPORTS, and windows traceroutes only if you say # "yes" to FW_ALLOW_PING_FW # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_FW_TRACEROUTE="no" # # 20.) # Allow ICMP sourcequench from your ISP? # If set to yes, the firewall will notice when connection is choking, however # this opens yourself to a denial of service attack. Choose your poison. # # Choice: "yes" or "no", defaults to "yes" # FW_ALLOW_FW_SOURCEQUENCH="yes" # # 21.) # Which masquerading modules should be loaded? # REQUIRES: FW_ROUTE, FW_MASQUERADE # # (omit the path or "ip_masq_" prefix as well as the ".o" suffix!) # FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive"

Am Tue, 31 Oct 2000 schrieb Martin Hofgesang:

Nachher:

root@hofgesang:/home/martin > ifconfig eth0 Link encap:Ethernet HWaddr 00:50:04:37:39:D6 inet addr:192.168.0.99 Bcast:192.168.0.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:6729 errors:0 dropped:0 overruns:0 frame:0 TX packets:7815 errors:0 dropped:0 overruns:0 carrier:0 collisions:32 txqueuelen:100 Interrupt:11 Base address:0xfc80

ippp0 Link encap:Point-to-Point Protocol inet addr:192.168.0.99 P-t-P:192.168.0.1 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP DYNAMIC MTU:1500 Metric:1 RX packets:11067 errors:0 dropped:0 overruns:0 frame:0 TX packets:12215 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:30

lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:3924 Metric:1 RX packets:5084 errors:0 dropped:0 overruns:0 frame:0 TX packets:5084 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0

root@hofgesang:/home/martin > netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 192.168.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 192.168.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 ippp0 root@hofgesang:/home/martin >

Hallo Martin, gehe mal mit yast in das Konfigurationsmenue (Netzwerk-Konfiguration) des ippp0-devices, stelle im Untermenue IP-Adresse die Adresse des point-to-point-Partners auf eine Adresse, die nicht im lokalen Netz liegt (z.B. 192.168.10.1) und dieselbe Adresse auch als default-Gateway-Adresse ein.

Nur schlau werde ich da leider nicht draus :-(( Danke schonmal für die Antworten!

Martin

-- Gruß, Harald