Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[andyhill24]

We have a setup where a DFL-800 is located at head office is used to connect to the internet.
There is another router on the LAN which provides connection to branch offices via a private network.
Network Config is as follows.
Head Office 192.168.0.0/24
Branch 1 10.0.31.0/24
Branch 2 10.0.32.0/24
DFL-800 LAN IP 192.168.0.225
Branch office router LAN IP 192.168.0.201
Branch office router is a managed service, but has a default route to send all unknown traffic to 192.168.0.225 (DFL-800)
Problem is Branch offices are unable to route traffic to internet.
DFL-800 has static routes to branch office networks with the branch office router as the gateway.
Probably missing something silly but any pointers much appreciated.

[Fatman]

Well, the problem is almost certainly either in Routes or in IP Rules.

Do you get log entries?

If they mention Default_Rule, you have an IP Rule problem.

If they mention Default_Access_Rule, you have a routing problem.

If you don't have any, the traffic is most likely not reaching the DFL, inspect downstream first.

[Lavdd]

Got almost the same



There was freebsd on *.0.1
route add x.x.1.0/24 x.x.0.224
everything was fine - 1.0/24 and 0.0/24 was routed

On DFL-260 when it replased freebsd server
with rout lan x.x.1.0/24 x.x.0.224
0.0/24 pings 1.0/24 but telnet dont work
1.0/24 pings dfl but not 0.0/24

Ip rules
Allow lan/lannet lan/remote_net all_tcpudpicmp
Allow lan/remote_net lan/lannet all_tcpudpicmp

there is something about too high scr value in logs when I do telnet on 135 fron 0.0/24 to 1.0/24

[Fatman]

Show me what is in the logs and we can decipher it together.

[Lavdd]

Ill make another try on thursday.
I plugged freebsd svr back to 0.1 now.

[Lavdd]

Did full reset and add some rules
ping 192.168.3.10 goes
telnet 192.168.3.10 135 dont

[Lavdd]

set
TCP Sequence Numbers: Ignore


2009-12-24
12:36:04 Warning TCP_FLAG 3300010 LogStateViolations TCP lan lan 192.168.0.191 192.168.3.10 50337 135 unexpected_tcp_flags drop
flags=SYN endpoint=originator state=FIN_RCVD origsent=232 termsent=0 ipdatalen=28 tcphdrlen=28 syn=1 

[Lavdd]

set
Allow TCP Reopen On

dont work, no logs ...

[Lavdd]

Jesus

for rules put
from_local  FwdFast
from_far  FwdFast

set
Allow TCP Reopen Off

http://archive.netbsd.se/?ml=cfw-users&a=2002-08&t=253890

[Fatman]

I belive that was a statement of exasperation, and not a name.  The link points to mailing list thread where an issue with a Clavister firewall is troubleshot, which Lavdd then used as inspiration for his fix here.