[Bug 391453] New: NetworkManager VPNC Connection Problem
https://bugzilla.novell.com/show_bug.cgi?id=391453 Summary: NetworkManager VPNC Connection Problem Product: openSUSE 11.0 Version: Factory Platform: x86-64 OS/Version: openSUSE 11.0 Status: NEW Severity: Normal Priority: P5 - None Component: Network AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: delder@novacoast.com QAContact: qa@suse.de Found By: Beta-Customer In SLED 10 (up to and including SP2) I was able to use NetworkManager to access all of my Cisco based vpn tunnels. For some reason, in 11 (beta 3) I'm having problem with one particular connection (but not the others). If I manually connect using vpnc it works just fine. I can connect through nm-applet to my remote network (CitrixOnline) and the tunnel will be brought up correctly. Unfortunately, I can't get traffic to any systems (although I can if I use vpnc). Here is a sample of the output from /var/log/NetworkManager: May 16 10:24:54 delder NetworkManager: <info> Starting VPN service 'org.freedesktop.NetworkManager.vpnc'... May 16 10:24:54 delder NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.vpnc' started (org.freedesktop.NetworkManager.vpnc), PID 12015 May 16 10:24:54 delder NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.vpnc' just appeared, activating connections May 16 10:24:54 delder NetworkManager: <info> VPN plugin state changed: 1 May 16 10:24:54 delder NetworkManager: <info> VPN plugin state changed: 3 May 16 10:24:54 delder NetworkManager: <info> VPN connection 'CitrixOnline' (Connect) reply received. May 16 10:24:55 delder NetworkManager: <info> VPN connection 'CitrixOnline' (IP Config Get) reply received. May 16 10:24:55 delder NetworkManager: <info> VPN Gateway: 67.217.73.250 May 16 10:24:55 delder NetworkManager: <info> Tunnel Device: tun2 May 16 10:24:55 delder NetworkManager: <info> Internal IP4 Address: 10.22.53.162 May 16 10:24:55 delder NetworkManager: <info> Internal IP4 Netmask: 255.255.255.0 May 16 10:24:55 delder NetworkManager: <info> Internal IP4 Point-to-Point Address: 10.22.53.162 May 16 10:24:55 delder NetworkManager: <info> Maximum Segment Size (MSS): 0 May 16 10:24:55 delder NetworkManager: <info> Internal IP4 DNS: 10.1.90.19 May 16 10:24:55 delder NetworkManager: <info> Internal IP4 DNS: 10.1.0.34 May 16 10:24:55 delder NetworkManager: <info> DNS Domain: 'corp.expertcity.com' May 16 10:24:55 delder NetworkManager: <info> Login Banner: May 16 10:24:55 delder NetworkManager: <info> ----------------------------------------- May 16 10:24:55 delder NetworkManager: <info> (null) May 16 10:24:55 delder NetworkManager: <info> ----------------------------------------- May 16 10:24:56 delder NetworkManager: <info> Clearing nscd hosts cache. May 16 10:24:56 delder NetworkManager: <info> VPN connection 'CitrixOnline' (IP Config Get) complete. May 16 10:24:56 delder NetworkManager: <info> VPN plugin state changed: 4 Everything looks normal and the same route is pushed down that I see in SLED 10. In SLED 10 I would normally restrict the route to 10.0.0.0/8 but with or without that setting (Only use vpn connection for these addresses) it doesn't work with NetworkManager. The routes pushed down via vpnc are: 10.1.90.19 0.0.0.0 255.255.255.255 UH 0 0 0 tun2 10.21.6.203 0.0.0.0 255.255.255.255 UH 0 0 0 tun2 10.1.0.34 0.0.0.0 255.255.255.255 UH 0 0 0 tun2 10.22.4.152 0.0.0.0 255.255.255.255 UH 0 0 0 tun2 10.21.6.204 0.0.0.0 255.255.255.255 UH 0 0 0 tun2 10.22.4.149 0.0.0.0 255.255.255.255 UH 0 0 0 tun2 10.1.0.203 0.0.0.0 255.255.255.255 UH 0 0 0 tun2 10.1.0.204 0.0.0.0 255.255.255.255 UH 0 0 0 tun2 If I use NetworkManager (with no address restrictions for the vpn connection) I get: 0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 tun2 If I use NetworkManager (with the restriction to the 10.0.0.0/8 network like in SLED 10) I get: 10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 tun2 Which is the same route I get in SLED 10. I can't find any errors anywhere. I can sniff and observe traffic on the tun2 interface going out but nothing comes back in. I don't know what is different about this particular vpn tunnel but any pointers on where to look would be appreciated. Does NetworkManager not call vpnc in the background for building out tunnels? I'm currently running: NetworkManager-debuginfo-0.7.0.r3649-3 NetworkManager-openvpn-0.7.0.r3647-1 NetworkManager-glib-0.7.0.r3649-3 NetworkManager-0.7.0.r3649-3 NetworkManager-gnome-debuginfo-0.7.0.r720-3 NetworkManager-openvpn-debuginfo-0.7.0.r3647-1 NetworkManager-gnome-0.7.0.r720-3 NetworkManager-vpnc-0.7.0.r3647-1 NetworkManager-vpnc-gnome-0.7.0.r3647-1 NetworkManager-openvpn-gnome-0.7.0.r3647-1 vpnc-0.5.1-26 Thanks, Dan -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=391453 Cyril Hrubis <chrubis@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.provo.novell.com |bnc-team-gnome@forge.provo.novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=391453 JP Rosevear <jpr@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-gnome@forge.provo.novell.com |tambet@novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=391453 User bili@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=391453#c1 --- Comment #1 from Li Bin <bili@novell.com> 2008-05-30 04:06:04 MDT --- It's the same issue with Bug #394754, although it's different VPN. I review the source code found that when connecting the vpn server successfully, the nm call "nm_system_vpn_device_set_from_ip4_config" set the ip4 address and route, and call "nm_system_device_replace_default_ip4_route" cause "g_slist_length (routes)=0", so the default route to be changed to tun2, like this : 0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 tun2 There are two method to resolved this issue, one is: edit the configuration, open the "Optional" tab, select "Only use VPN connection for these addresses:" and input 10.1.90.19/32 10.21.6.203/32 10.1.0.34/32 10.22.4.152/32 10.21.6.204/32 10.22.4.149/32 10.1.0.203/32 10.1.0.204/32 then it works fine. Another, we need let the nm don't replace the default route when the routes is null. tambet, any idea? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=391453 User bili@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=391453#c2 --- Comment #2 from Li Bin <bili@novell.com> 2008-05-30 04:11:51 MDT --- I'm not review the SLED10's NetworkManger code yet, I would read it to found how it works fine, and reply you later. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=391453 User delder@novacoast.com added comment https://bugzilla.novell.com/show_bug.cgi?id=391453#c3 --- Comment #3 from Dan Elder <delder@novacoast.com> 2008-05-30 09:34:15 MDT --- I actually seem to be having a slightly different problem. I can set the routes manually like that and reproduce the routing table that a straight vpnc connection would give me: 10.21.6.203 0.0.0.0 255.255.255.255 UH 0 0 0 tun3 10.1.90.19 0.0.0.0 255.255.255.255 UH 0 0 0 tun3 10.1.0.34 0.0.0.0 255.255.255.255 UH 0 0 0 tun3 10.21.6.204 0.0.0.0 255.255.255.255 UH 0 0 0 tun3 10.22.4.152 0.0.0.0 255.255.255.255 UH 0 0 0 tun3 10.22.4.149 0.0.0.0 255.255.255.255 UH 0 0 0 tun3 10.1.0.203 0.0.0.0 255.255.255.255 UH 0 0 0 tun3 10.1.0.204 0.0.0.0 255.255.255.255 UH 0 0 0 tun3 Unfortunately, I still can't connect to any endpoints when using nm. This particular vpn configuration is very restrictive on the policy side which is why I'm usually lazy and use 10.0.0.0/8 so I don't have to manually setup routes to any devices they don't explicitly push routes for. I unfortunately don't know any of the details of the remote cisco setup. It doesn't look like there is any problem with routing from what I can see but maybe I'm missing something. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=391453 Tambet Ingo <tambet@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|Normal |Major Priority|P5 - None |P3 - Medium -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=391453 User tambet@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=391453#c4 Tambet Ingo <tambet@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #4 from Tambet Ingo <tambet@novell.com> 2008-11-07 07:44:19 MST --- Fixed in 11.1 beta5. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=391453 User delder@novacoast.com added comment https://bugzilla.novell.com/show_bug.cgi?id=391453#c5 Dan Elder <delder@novacoast.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED | --- Comment #5 from Dan Elder <delder@novacoast.com> 2008-11-25 22:56:07 MST --- Unfortunately it's actually worse as of SLED 11 beta 5 (same as 11.1 beta 5). Prior to beta 5 it was just one Cisco profile which didn't work. Now none of them work and they fail immediately. Here's the NetworkManager log: Nov 25 21:53:39 delder NetworkManager: <info> Starting VPN service 'org.freedesktop.NetworkManager.vpnc'... Nov 25 21:53:39 delder NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.vpnc' started (org.freedesktop.NetworkManager.vpnc), PID 8514 Nov 25 21:53:39 delder NetworkManager: <info> VPN service 'org.freedesktop.NetworkManager.vpnc' just appeared, activating connections Nov 25 21:53:39 delder NetworkManager: <info> VPN plugin state changed: 1 Nov 25 21:53:39 delder NetworkManager: <info> VPN plugin state changed: 3 Nov 25 21:53:39 delder NetworkManager: <info> VPN connection 'Tropitone' (Connect) reply received. Nov 25 21:53:40 delder NetworkManager: <info> VPN plugin failed: 1 Nov 25 21:53:40 delder NetworkManager: <info> VPN plugin state changed: 6 Nov 25 21:53:40 delder NetworkManager: <info> VPN plugin state change reason: 0 Nov 25 21:53:40 delder NetworkManager: <WARN> connection_state_changed(): Could not process the request because no VPN connection was active. Nov 25 21:53:40 delder NetworkManager: <debug> [1227678820.528323] run_netconfig(): Spawning '/sbin/netconfig modify --service NetworkManager' Nov 25 21:53:40 delder NetworkManager: <debug> [1227678820.532008] write_to_netconfig(): Writing to netconfig: INTERFACE='eth0' Nov 25 21:53:40 delder NetworkManager: <debug> [1227678820.532108] write_to_netconfig(): Writing to netconfig: DNSSEARCH='theelderfamily.org theelderfamily.org' Nov 25 21:53:40 delder NetworkManager: <debug> [1227678820.532162] write_to_netconfig(): Writing to netconfig: DNSSERVERS='172.16.99.1' Nov 25 21:53:40 delder NetworkManager: <info> Clearing nscd hosts cache. Nov 25 21:53:40 delder NetworkManager: <info> Policy set 'System eth0' (eth0) as default for routing and DNS. Nov 25 21:53:52 delder NetworkManager: <debug> [1227678832.535023] ensure_killed(): waiting for vpn service pid 8514 to exit Nov 25 21:53:52 delder NetworkManager: <debug> [1227678832.535483] ensure_killed(): vpn service pid 8514 cleaned up OpenVPN profiles still work at least and vpnc from the cli works just fine. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=391453 User delder@novacoast.com added comment https://bugzilla.novell.com/show_bug.cgi?id=391453#c6 --- Comment #6 from Dan Elder <delder@novacoast.com> 2008-12-01 16:53:45 MST --- Still present in beta 6 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply@novell.com