[Bug 904511] New: Can not transfer TCP data using 3rd party VPN software / service (Astrill) since upgrade to 13.2

bugzilla_noreply＠novell.com

8 Nov 2014 8 Nov '14

07:46

http://bugzilla.opensuse.org/show_bug.cgi?id=904511 Bug ID: 904511 Summary: Can not transfer TCP data using 3rd party VPN software / service (Astrill) since upgrade to 13.2 Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: x86-64 OS: openSUSE 13.2 Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: bnc-team-screening@forge.provo.novell.com Reporter: dhutchison69@hotmail.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Created attachment 612880 --> http://bugzilla.opensuse.org/attachment.cgi?id=612880&action=edit Network Manager log, before and after ugrade I recently upgrade my PC from openSUSE 13.1 to 13.2 x86_64 build. (zypper dup method) No issue was present before the upgrade. After the upgrade, while it was possible to connect using the 2.9.2 2016 build Astrill client software, it was not possible to surf websites that are otherwise blocked in China using either Stealth or OpenVPN modes. Using OpenWeb mode, all websites can be surfed. This happens no matter what ports, protocols, or servers were tired, if a connection was even possible. It may also be worthy to note that while surfing websites such as youtube and google using stealth/OpenVPN was impossible, it was possible to ping them and get replies. Ping replies are not received from these blocked sites when Astrill is not connected. The client was uninstalled and reinstalled a number of times post-upgrade, and all relevant user config files were deleted. An internet speed test was attempted (speedtest.net) while connected via OpenVPN mode, and while the speed test ran, the Astrill client did not show any data being passed via VPN. Speedtest showed the data being transferred from here in Beijing, rather than remotely from near the VPN server. When the speed test was run using Open Web, it ran normally, transferring data from the overseas server. Other devices on this network (Android, Windows, other Linux) function via VPN normally. It seems the system in question is not recognizing OpenVPN / Stealth connections at the TCP layer, but has no trouble recognizing OpenWeb connections. A ticket for this issue was filed with Astrill, however it does not look hopeful that they'll handle, as the issue appeared after an OS upgrade. Attached is an excerpt from the network manager log. The upgrade was finished approx. 22:00 on 11/7. Example of functional VPN connections can be found before then. -- You are receiving this mail because: You are on the CC list for the bug.

Attachments:

attachment.htm (text/html — 4.3 KB)

Show replies by date

bugzilla_noreply＠novell.com

8 Nov 8 Nov

07:54

New subject: [Bug 904511] Can not transfer TCP data using 3rd party VPN software / service (Astrill) since upgrade to 13.2

...

From Astrill: "It Seems that your tun tap adaptor is missing or not working properly. Please

http://bugzilla.opensuse.org/show_bug.cgi?id=904511 --- Comment #1 from David Hutchison --- try to install it and run application with open vpn or stealth vpn. " lsmod shows: Module Size Used by tun 31381 0 -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

18:36

New subject: [Bug 904511] Can not transfer TCP data using 3rd party VPN software / service (Astrill) since upgrade to 13.2

http://bugzilla.opensuse.org/show_bug.cgi?id=904511 --- Comment #2 from Bernhard Wiedemann --- The software is at https://www.astrill.com/download.php overall it is not easy to know what it does and how. btw: you could use "ip r" command to see if routes go through a tunnel and you could try to switch to wicked using "yast2 lan" and see if that makes a difference -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

9 Nov 9 Nov

02:04

New subject: [Bug 904511] Can not transfer TCP data using 3rd party VPN software / service (Astrill) since upgrade to 13.2

http://bugzilla.opensuse.org/show_bug.cgi?id=904511 --- Comment #3 from David Hutchison --- Hello Bernhard, I received a similar request from Astrill about routing tables. It appears, according to the tables, that data is being tunneled. See below: Hello, I don't suspect a DNS issue, because I am able to ping blocked sites by name and get replies showing the IP. I have my router configured to send NS lookups to Google DNS and OpenDNS servers, which has always worked fine. Here are some nslookup results: Not connected: dh-desktop:/home/davidh # nslookup youtube.com Server: 10.0.0.1 Address: 10.0.0.1#53 Non-authoritative answer: Name: youtube.com Address: 37.61.54.158 Connected via Stealth: dh-desktop:/home/davidh # nslookup youtube.com Server: 198.18.80.1 Address: 198.18.80.1#53 Non-authoritative answer: Name: youtube.com Address: 74.125.224.161 Name: youtube.com Address: 74.125.224.163 Name: youtube.com Address: 74.125.224.160 Name: youtube.com Address: 74.125.224.166 Name: youtube.com Address: 74.125.224.174 Name: youtube.com Address: 74.125.224.162 Name: youtube.com Address: 74.125.224.169 Name: youtube.com Address: 74.125.224.168 Name: youtube.com Address: 74.125.224.165 Name: youtube.com Address: 74.125.224.164 Name: youtube.com Address: 74.125.224.167 Note the change in DNS address when connected. The internet connection IP changes when connected via Stealth. Not connected,it's 60.28.18.193. While connected, it's 192.159.166.92. Routing tables show as follows: Not connected: dh-desktop:/home/davidh # route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.0.0.1 0.0.0.0 UG 1024 0 0 eth0 10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 dh-desktop:/home/davidh # ip route show default via 10.0.0.1 dev eth0 proto static metric 1024 10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.3 Connected via Stealth: dh-desktop:/home/davidh # route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.0.0.1 0.0.0.0 UG 1024 0 0 eth0 10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 128.0.0.0 198.18.64.1 128.0.0.0 UG 20 0 0 tun0 198.18.64.0 0.0.0.0 255.255.240.0 U 0 0 0 tun0 204.152.207.174 10.0.0.1 255.255.255.255 UGH 0 0 0 eth0 dh-desktop:/home/davidh # ip route show default via 10.0.0.1 dev eth0 proto static metric 1024 10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.3 128.0.0.0/1 via 198.18.64.1 dev tun0 proto static metric 20 198.18.64.0/20 dev tun0 proto kernel scope link src 198.18.65.78 204.152.207.174 via 10.0.0.1 dev eth0 -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

02:22

New subject: [Bug 904511] Can not transfer TCP data using 3rd party VPN software / service (Astrill) since upgrade to 13.2

http://bugzilla.opensuse.org/show_bug.cgi?id=904511 --- Comment #4 from David Hutchison --- Hello Bernhard, Per your instructions, switched to Wicked via Yast. I am able to surf blocked sites using this connection manager. Below is the new routing table. Is the difference with the old one using NetworkManager significant? dh-desktop:/home/davidh # route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 198.18.112.1 128.0.0.0 UG 0 0 0 tun0 0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 eth0 0.0.0.0 10.0.0.1 0.0.0.0 UG 1024 0 0 eth0 10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 128.0.0.0 198.18.112.1 128.0.0.0 UG 0 0 0 tun0 198.18.112.0 0.0.0.0 255.255.240.0 U 0 0 0 tun0 204.152.207.174 10.0.0.1 255.255.255.255 UGH 0 0 0 eth0 dh-desktop:/home/davidh # ip r 0.0.0.0/1 via 198.18.112.1 dev tun0 default via 10.0.0.1 dev eth0 proto dhcp default via 10.0.0.1 dev eth0 proto static metric 1024 10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.3 128.0.0.0/1 via 198.18.112.1 dev tun0 198.18.112.0/20 dev tun0 proto kernel scope link src 198.18.113.57 204.152.207.174 via 10.0.0.1 dev eth0 -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

08:20

New subject: [Bug 904511] Can not transfer TCP data using 3rd party VPN software / service (Astrill) since upgrade to 13.2

...

Hello Bernhard, Per your instructions, switched to Wicked via Yast. I am able to surf blocked sites using this connection manager. Below is the new routing table. Is the difference with the old one using NetworkManager significant?

yes, the diff is relevant.

...

dh-desktop:/home/davidh # ip r 0.0.0.0/1 via 198.18.112.1 dev tun0 128.0.0.0/1 via 198.18.112.1 dev tun0

With NetworkManager, you only had the 2nd one of these routes, so that only half the internet would go through the tunnel and youtube's 74.x.x.x happened to be in the first half that was not tunnelled. My guess is that NetworkManager somehow dropped the other route. -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

21:00

New subject: [Bug 904511] Can not transfer TCP data using 3rd party VPN software / service (Astrill) since upgrade to 13.2

http://bugzilla.opensuse.org/show_bug.cgi?id=904511 Paul Hofmann changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |p.h.o@web.de --- Comment #6 from Paul Hofmann --- *** Bug 904550 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

11 Nov 11 Nov

02:29

New subject: [Bug 904511] Can not transfer TCP data using 3rd party VPN software / service (Astrill) since upgrade to 13.2

http://bugzilla.opensuse.org/show_bug.cgi?id=904511 --- Comment #7 from David Hutchison --- I was unable to connect using the method described in bug#904550, while using Network Manager. route add default gw 207.126.88.1 tap0 SIOCADDRT: No such device -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

20:23

New subject: [Bug 904511] Can not transfer TCP data using 3rd party VPN software / service (Astrill) since upgrade to 13.2

http://bugzilla.opensuse.org/show_bug.cgi?id=904511 --- Comment #8 from Paul Hofmann --- (In reply to David Hutchison from comment #7)

...

I was unable to connect using the method described in bug#904550, while using Network Manager.

route add default gw 207.126.88.1 tap0 SIOCADDRT: No such device

You must issue this command AFTER you've connected to the VPN. Have you done so? Or maybe (who knows?) the device isn't called tap0 on your machine. Check it out: "$ip link" BTW: I wrote a little NetworkManager dispatcher script to (dirty) fix the issue (http://pastebin.com/UwcidUGy) -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

12 Nov 12 Nov