Messages

Can you confirm that the wiki page for this is correct?

http://wiki.linuxmce.org/index.php/Fail2ban_-_A_tool_against_brute_force

should the ignore IP line look like:

ignoreip = 127.0.0.1 192.168.80.1 192.168.80.0/254

The wiki is correct, i tested it again with lmce 10.04. I created it while using lmce 8.10.
The ignoreip will make fail2ban ignore the given ip's or blocks, so ip's in your network will not be blocked by fail2ban in case of successive failed tries..

Hi,
i did note that the CDR records of asterisk only shown the trunk numbers, not the dialed or incoming calling numbers.
Best regards!

Frankly speaking, i gave up with ipsec/l2tp.
My setup is:
ADSL <------>  Tomato router <----> external NIC LMCE <-----> Internal NIC <-----> Home network.
On my tomato: UDP 500, 1701 and 4500 forward to external NIC
On my LMCE Firewall: 500 and 4500.
I did read a ton of tutorials, had examples, but got it working only 2 times for less than 3 minutes each.
That's all.
I will set up the old pptp, which i had working on my 8.10 box with no glitch, but after vacation.

ipsec maybe working, but xl2tpd is unreliable..... could not make it work for more than 2 minutes and repeat it.... i only got it working 2 times, for less than 2 minutes, in a universe of more than 100 tries.

pw44,

instead of posting it to the wiki, see if you can create a pnp script for the SPA. Look at the grandstream perl scripts how it is done.

Posde, i did not forget the issue. Searching, there is one way, but it's a backup done by saving the webpage of the spa3102 and editing some parameters and then loading the page again.
I'm not sure if this is a reliable solution. I will keep you posted.
BR

well, it seams the ppp will be the reliable one.....
I will test ppp on 10.04 (had i working on 8.10).
BR
Paulo

Hi,
yesterday, vpn connected, two times and no more.
Is xl2tp reliable?

Polly, the strange is that your config files are almost the same as mines, but i'm stiil getting xl2tpd error.
How is your l2tp-secrets looking (no password, please)
Ipsec goes well......
Sambuca, any hint?
TIA,
Paulo

@Sambuca: yes, all the xl2tpd log is there.

Code Select Expand


dcerouter_1031272:/etc/fail2ban/action.d# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.23/K2.6.32-42-generic (netkey)
Checking for IPsec support in kernel                            [OK]
NETKEY detected, testing for disabled ICMP send_redirects       [OK]
NETKEY detected, testing for disabled ICMP accept_redirects     [OK]
Checking for RSA private key (/etc/ipsec.secrets)               [OK]
Checking that pluto is running                                  [OK]
Pluto listening for IKE on udp 500                              [OK]
Pluto listening for NAT-T on udp 4500                           [OK]
Two or more interfaces found, checking IP forwarding            [OK]
Checking NAT and MASQUERADEing                             
Checking for 'ip' command                                       [OK]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]


Code Select Expand


dcerouter_1031272:/home/cameras# grep pppd /var/log/syslog*
dcerouter_1031272:/home/cameras# grep xl2tpd /var/log/syslog*
/var/log/syslog.1:Nov 27 12:47:04 dcerouter xl2tpd[6009]: control_finish: Peer requested tunnel 23 twice, ignoring second one.
/var/log/syslog.1:Nov 27 12:47:04 dcerouter xl2tpd[6009]: control_finish: Peer requested tunnel 23 twice, ignoring second one.
/var/log/syslog.1:Nov 27 12:47:09 dcerouter xl2tpd[6009]: Maximum retries exceeded for tunnel 34456.  Closing.
/var/log/syslog.1:Nov 27 12:47:10 dcerouter xl2tpd[6009]: control_finish: Peer requested tunnel 23 twice, ignoring second one.
/var/log/syslog.1:Nov 27 12:47:10 dcerouter xl2tpd[6009]: Connection 23 closed to 186.242.246.139, port 56213 (Timeout)
/var/log/syslog.1:Nov 27 12:47:14 dcerouter xl2tpd[6009]: control_finish: Peer requested tunnel 23 twice, ignoring second one.
/var/log/syslog.1:Nov 27 12:47:15 dcerouter xl2tpd[6009]: Unable to deliver closing message for tunnel 34456. Destroying anyway.
/var/log/syslog.1:Nov 27 12:47:18 dcerouter xl2tpd[6009]: control_finish: Peer requested tunnel 23 twice, ignoring second one.
/var/log/syslog.1:Nov 27 12:47:28 dcerouter xl2tpd[6009]: Maximum retries exceeded for tunnel 3240.  Closing.


@polly: i did read about dpd (dead peer detection). I guess this will solve the second time....
Would you share your config file with me (changed passwords and secrets, of course)?

Anyway, i'm reading, trying but am not able to get x2tpd right.

TIA

Any hints? Anyone have it working? TIA!

Hi Sambuca,
yes, xl2tpd is running.


/var/log/auth.log

Code Select Expand


Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: received Vendor ID payload [RFC 3947] method set to=109
Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike] method set to=110
Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: ignoring unknown Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: ignoring unknown Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: ignoring unknown Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: ignoring unknown Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: ignoring unknown Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 110
Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 110
Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 110
Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: ignoring Vendor ID payload [FRAGMENTATION 80000000]
Nov 24 13:29:35 dcerouter pluto[21730]: packet from 186.242.129.142:500: received Vendor ID payload [Dead Peer Detection]
Nov 24 13:29:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: responding to Main Mode from unknown peer 186.242.129.142
Nov 24 13:29:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Nov 24 13:29:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: STATE_MAIN_R1: sent MR1, expecting MI2
Nov 24 13:29:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): i am NATed
Nov 24 13:29:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Nov 24 13:29:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: STATE_MAIN_R2: sent MR2, expecting MI3
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: Main mode peer ID is ID_IPV4_ADDR: '186.242.129.142'
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: new NAT mapping for #18, was 186.242.129.142:500, now 186.242.129.142:4500
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: the peer proposed: 187.15.164.55/32:17/1701 -> 186.242.129.142/32:17/0
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #19: responding to Quick Mode proposal {msgid:0e352bfd}
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #19:     us: 192.168.0.160[+S=C]:17/1701
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #19:   them: 186.242.129.142[+S=C]:17/51077===?
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #19: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #19: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #19: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
Nov 24 13:29:36 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #19: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x0bfea5b5 <0x46b2c1c7 xfrm=AES_256-HMAC_SHA1 NATOA=none NATD=186.242.129.142:4500 DPD=none}
Nov 24 13:29:58 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: received Delete SA(0x0bfea5b5) payload: deleting IPSEC State #19
Nov 24 13:29:58 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: netlink recvfrom() of response to our XFRM_MSG_DELPOLICY message for policy eroute_connection delete inbound was too long: 100 > 36
Nov 24 13:29:58 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: netlink recvfrom() of response to our XFRM_MSG_DELPOLICY message for policy eroute_connection delete inbound was too long: 100 > 36
Nov 24 13:29:58 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: netlink recvfrom() of response to our XFRM_MSG_DELPOLICY message for policy unk255.10000@192.168.0.160 was too long: 168 > 36
Nov 24 13:29:58 dcerouter pluto[21730]: | raw_eroute result=0
Nov 24 13:29:58 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: received and ignored informational message
Nov 24 13:29:58 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142 #18: received Delete SA payload: deleting ISAKMP State #18
Nov 24 13:29:58 dcerouter pluto[21730]: "L2TP-PSK-NAT"[9] 186.242.129.142: deleting connection "L2TP-PSK-NAT" instance with peer 186.242.129.142 {isakmp=#0/ipsec=#0}
Nov 24 13:29:58 dcerouter pluto[21730]: packet from 186.242.129.142:4500: received and ignored informational message
Nov 24 13:30:01 dcerouter CRON[28937]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 24 13:30:01 dcerouter CRON[28938]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 24 13:30:01 dcerouter CRON[28939]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 24 13:30:03 dcerouter CRON[28939]: pam_unix(cron:session): session closed for user root
Nov 24 13:30:03 dcerouter CRON[28938]: pam_unix(cron:session): session closed for user root
Nov 24 13:30:10 dcerouter CRON[28937]: pam_unix(cron:session): session closed for user root


dcerouter_1031272:/var/log# ps ax | grep xl2
11310 pts/33   S+     0:00 grep --color=auto xl2
23156 ?        Ss     0:00 /usr/sbin/xl2tpd


/var/log/syslog (x2ltpd)

Code Select Expand


Nov 24 13:29:38 dcerouter xl2tpd[23156]: control_finish: Peer requested tunnel 17 twice, ignoring second one.
Nov 24 13:29:43 dcerouter xl2tpd[23156]: last message repeated 2 times
Nov 24 13:29:43 dcerouter xl2tpd[23156]: Maximum retries exceeded for tunnel 40741.  Closing.
Nov 24 13:29:48 dcerouter xl2tpd[23156]: control_finish: Peer requested tunnel 17 twice, ignoring second one.
Nov 24 13:29:48 dcerouter xl2tpd[23156]: Connection 17 closed to 186.242.129.142, port 51077 (Timeout)
Nov 24 13:29:52 dcerouter xl2tpd[23156]: control_finish: Peer requested tunnel 17 twice, ignoring second one.
Nov 24 13:29:53 dcerouter xl2tpd[23156]: Unable to deliver closing message for tunnel 40741. Destroying anyway.
Nov 24 13:29:57 dcerouter xl2tpd[23156]: control_finish: Peer requested tunnel 17 twice, ignoring second one.


Did recheck the configs, but is not working....

News about using l2tp and ipsec?
I get a different result, from outside:

Code Select Expand


Nov 23 22:40:09 dcerouter CRON[5524]: pam_unix(cron:session): session closed for user root
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: received Vendor ID payload [RFC 3947] method set to=109
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike] method set to=110
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: ignoring unknown Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: ignoring unknown Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: ignoring unknown Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: ignoring unknown Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: ignoring unknown Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 110
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 110
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 110
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: ignoring Vendor ID payload [FRAGMENTATION 80000000]
Nov 23 22:40:12 dcerouter pluto[21730]: packet from 187.124.217.240:500: received Vendor ID payload [Dead Peer Detection]
Nov 23 22:40:12 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: responding to Main Mode from unknown peer 187.124.217.240
Nov 23 22:40:12 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Nov 23 22:40:12 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: STATE_MAIN_R1: sent MR1, expecting MI2
Nov 23 22:40:12 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): i am NATed
Nov 23 22:40:12 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Nov 23 22:40:12 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: STATE_MAIN_R2: sent MR2, expecting MI3
Nov 23 22:40:12 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000
Nov 23 22:40:12 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: Main mode peer ID is ID_IPV4_ADDR: '187.124.217.240'
Nov 23 22:40:12 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Nov 23 22:40:12 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: new NAT mapping for #5, was 187.124.217.240:500, now 187.124.217.240:4500
Nov 23 22:40:12 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}
Nov 23 22:40:13 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: the peer proposed: 187.15.164.55/32:17/1701 -> 187.124.217.240/32:17/0
Nov 23 22:40:13 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #6: responding to Quick Mode proposal {msgid:6aad2eab}
Nov 23 22:40:13 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #6:     us: 192.168.0.160[+S=C]:17/1701
Nov 23 22:40:13 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #6:   them: 187.124.217.240[+S=C]:17/61362===?
Nov 23 22:40:13 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #6: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
Nov 23 22:40:13 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #6: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
Nov 23 22:40:13 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #6: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
Nov 23 22:40:13 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #6: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x06bdda38 <0x0874effc xfrm=AES_256-HMAC_SHA1 NATOA=none NATD=187.124.217.240:4500 DPD=none}
Nov 23 22:40:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: received Delete SA(0x06bdda38) payload: deleting IPSEC State #6
Nov 23 22:40:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: netlink recvfrom() of response to our XFRM_MSG_DELPOLICY message for policy eroute_connection delete inbound was too long: 100 > 36
Nov 23 22:40:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: netlink recvfrom() of response to our XFRM_MSG_DELPOLICY message for policy eroute_connection delete inbound was too long: 100 > 36
Nov 23 22:40:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: netlink recvfrom() of response to our XFRM_MSG_DELPOLICY message for policy unk255.10000@192.168.0.160 was too long: 168 > 36
Nov 23 22:40:35 dcerouter pluto[21730]: | raw_eroute result=0
Nov 23 22:40:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: received and ignored informational message
Nov 23 22:40:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240 #5: received Delete SA payload: deleting ISAKMP State #5
Nov 23 22:40:35 dcerouter pluto[21730]: "L2TP-PSK-NAT"[3] 187.124.217.240: deleting connection "L2TP-PSK-NAT" instance with peer 187.124.217.240 {isakmp=#0/ipsec=#0}
Nov 23 22:40:35 dcerouter pluto[21730]: packet from 187.124.217.240:4500: received and ignored informational message
Nov 23 22:42:01 dcerouter CRON[8123]: pam_unix(cron:session): session opened for user root by (uid=0)
Nov 23 22:42:02 dcerouter CRON[8123]: pam_unix(cron:session): session closed for user root

Any hints?

I'm not willing to use ppp....

No, i was looking for a DID in LA for my lmce asterisk. I ended renting one from flynumber (US$ 2.95 / month) and it's already working.
For dial out, i do use voipcheap, and for USA, the calls are free for fixed and mobile numbers.
Thx!

Hi,
does anyone knows about free dial in number (for asterisk) in Los Angeles, or at least a low rate flat dial in number service in Los Angeles?
Thx in advance for any hint or help.
Paulo

Hi,
is there a way to get the sony ip control remote template on the regular linuxmce?
Best regards,
Paulo