Home / user-379366

Manuth Chek's questions

Martin Hope
Manuth Chek
Asked: 2016-12-28 23:28:38 +0800 CST
  • 1

The L2TP/IPSec VPN server is a Mikrotik router, with these firewall configurations:

/ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic 
 0  D ;;; special dummy rule to show fasttrack counters
      chain=forward action=passthrough 

 1    ;;; VPN L2TP port 500
      chain=input action=accept protocol=udp in-interface=pppoe-out1 
      dst-port=500 

 2    ;;; VPN L2TP port 1701
      chain=input action=accept protocol=udp in-interface=pppoe-out1 
      dst-port=1701 

 3    ;;; VPN L2TP port 4500
      chain=input action=accept protocol=udp in-interface=pppoe-out1 
      dst-port=4500 

 4    ;;; VPN L2TP IPSec
      chain=input action=accept protocol=ipsec-esp in-interface=pppoe-out1 

 5    ;;; VPN L2TP AH
      chain=input action=accept protocol=ipsec-ah in-interface=pppoe-out1 

 6    ;;; Allow all from VPN
      chain=input action=accept src-address-type=local 

 7    ;;; defconf: accept ICMP
      chain=input action=accept protocol=icmp log=no log-prefix="" 

 8    ;;; defconf: accept establieshed,related
      chain=input action=accept connection-state=established,related log=no 
      log-prefix="" 

 9    ;;; Drop SSH requests from outside
      chain=input action=drop protocol=tcp in-interface=pppoe-out1 
      dst-port=22 log=no log-prefix="" 

10    ;;; Drop Winbox connection from outside
      chain=input action=drop protocol=tcp in-interface=pppoe-out1 
      dst-port=8291 log=no log-prefix="" 

11    ;;; Drop UDP DNS requests from outside
      chain=input action=drop protocol=udp in-interface=pppoe-out1 
      dst-port=53 log=no log-prefix="" 

12    ;;; Drop TCP DNS requests from outside
      chain=input action=drop protocol=tcp dst-port=53 log=no log-prefix="" 

13    ;;; Allow ping from outside
      chain=input action=accept protocol=icmp dst-address=103.12.163.90 
      log=no log-prefix="" 

14    ;;; defconf: drop all from WAN
      chain=input action=drop in-interface=ether1 log=no log-prefix="" 

15    ;;; defconf: fasttrack
      chain=forward action=fasttrack-connection 
      connection-state=established,related log=no log-prefix="" 

16    ;;; defconf: accept established,related
      chain=forward action=accept connection-state=established,related log=no 
      log-prefix="" 

17    ;;; defconf: drop invalid
      chain=forward action=drop connection-state=invalid log=no log-prefix="" 

18    ;;; defconf:  drop all from WAN not DSTNATed
      chain=forward action=drop connection-state=new 
      connection-nat-state=!dstnat in-interface=ether1 log=no log-prefix="" 

/ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic 
 0    chain=srcnat action=masquerade out-interface=pppoe-out1 log=no 
      log-prefix="" 

 1    ;;; HTTPS remote access
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=900 
      protocol=tcp in-interface=pppoe-out1 dst-port=900 log=no log-prefix="" 

 2    ;;; HTTP remote access
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=443 
      protocol=tcp in-interface=pppoe-out1 dst-port=443 log=no log-prefix="" 

 3    ;;; HTTP remote access
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=80 
      protocol=tcp in-interface=pppoe-out1 dst-port=80 log=no log-prefix="" 

 4    ;;; Plex server remote access
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=32400 
      protocol=tcp in-interface=pppoe-out1 dst-port=32400 log=no 
      log-prefix="" 

 5    ;;; HTTPS hairpin NAT
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=443 
      protocol=tcp dst-address-type=local dst-port=443 log=no log-prefix="" 

 6    ;;; HTTP hairpin NAT
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=80 
      protocol=tcp dst-address-type=local dst-port=80 log=no log-prefix="" 

 7    ;;; HTTPS hairpin NAT
      chain=srcnat action=masquerade to-addresses=10.0.0.2 protocol=tcp 
      src-address=10.0.0.0/24 dst-address=10.0.0.2 out-interface=bridge 
      dst-port=443 log=no log-prefix="" 

 8    ;;; HTTP hairpin NAT
      chain=srcnat action=masquerade to-addresses=10.0.0.2 to-ports=80 
      protocol=tcp src-address=10.0.0.0/24 dst-address=10.0.0.2 
      out-interface=bridge dst-port=80 log=no log-prefix=""

Now the strange thing is that iOS clients can connect to this VPN and reach both local network and Internet, but Windows clients can only reach the local network and not the Internet (dunno about other platforms since I don't have access to right now). I've ruled out DNS and route issues, as these Windows clients can ping global IP addresses and domain names and also tracert. Am I missing something? I've already used the same configuration for many Mikrotik routers, and what the routers with issues have in common is that the WAN connection is PPPoE:

/ip firewall filter
add chain=input action=accept comment="VPN L2TP UDP 500" in-interface=pppoe-out1 protocol=udp dst-port=500 
add chain=input action=accept comment="VPN L2TP UDP 1701" in-interface=pppoe-out1 protocol=udp dst-port=1701
add chain=input action=accept comment="VPN L2TP 4500" in-interface=pppoe-out1 protocol=udp dst-port=4500
add chain=input action=accept comment="VPN L2TP ESP" in-interface=pppoe-out1 protocol=ipsec-esp
add chain=input action=accept comment="VPN L2TP AH" in-interface=pppoe-out1 protocol=ipsec-ah

/ppp profile add change-tcp-mss=yes local-address=10.0.0.1 name=vpn-profile remote-address=pool-vpn dns-server=10.0.0.1 use-encryption=yes

/ppp secret add name="yourusername" password="yourpassword" profile=vpn-profile service=any

/interface l2tp-server server set authentication=mschap2 default-profile=vpn-profile enabled=yes max-mru=1460 max-mtu=1460 use-ipsec=yes

/ip ipsec peer add address=0.0.0.0/0 exchange-mode=main-l2tp nat-traversal=yes generate-policy=port-override secret="yourl2tpsecret" enc-algorithm=aes-128,3des
/ip ipsec proposal set [ find default=yes ] enc-algorithms=aes-128-cbc,3des
windows mikrotik l2tp
Martin Hope
Manuth Chek
Asked: 2016-11-17 22:16:10 +0800 CST
  • 1

I have this one Mikrotik router (RB951G-2HnD) that serves as a main router with port forwarding for HTTP/HTTPS and Plex to a server behind NAT. Now since there isn't much upload bandwidth (15Mbps), I'd love to limit the bandwith for HTTP/HTTPS on the WAN interface so that there's some bandwidth left for Plex. I've been looking in /queue but haven't seen anything that limits by port number.

mikrotik bandwidth-control
Martin Hope
Manuth Chek
Asked: 2016-11-07 21:02:10 +0800 CST
  • 7

This is output from a Ubuntu 16.04 client:

OpenSSH_7.2p2 Ubuntu-4, OpenSSL 1.0.2g-fips  1 Mar 2016
debug1: Reading configuration data /home/manuth/.ssh/config
debug1: /home/manuth/.ssh/config line 1: Applying options for r2d2.manuth.life
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to r2d2.manuth.life [103.12.163.90] port 900.
debug1: Connection established.
debug1: identity file /home/manuth/.ssh/dqar-rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/manuth/.ssh/dqar-rsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4
ssh_exchange_identification: Connection closed by remote host

The path and permission for /home/manuth/.ssh/dqar-rsa are also correct:

$ ls -l /home/manuth/.ssh/dqar-rsa*
-rw------- 1 manuth manuth 3243 Nov  7 11:27 /home/manuth/.ssh/dqar-rsa
-rw-r--r-- 1 manuth manuth  740 Nov  7 11:27 /home/manuth/.ssh/dqar-rsa.pub

The entry for this host in ~/.ssh/config is:

host r2d2.manuth.life
 IdentityFile ~/.ssh/dqar-rsa
 Port 900
 IdentitiesOnly yes
 ForwardX11 yes

If I try commenting the IdentityFile line, it doesn't even read any id_* inside ~/.ssh:

OpenSSH_7.2p2 Ubuntu-4, OpenSSL 1.0.2g-fips  1 Mar 2016
debug1: Reading configuration data /home/manuth/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to r2d2.manuth.life [103.12.163.90] port 900.
debug1: Connection established.
debug1: identity file /home/manuth/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/manuth/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/manuth/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/manuth/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/manuth/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/manuth/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/manuth/.ssh/id_ed25519 type 4
debug1: key_load_public: No such file or directory
debug1: identity file /home/manuth/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4
ssh_exchange_identification: Connection closed by remote host

This seems to come up all of a sudden today.

Edit: contents inside ~/.ssh:

$ ls -la
insgesamt 36
drwx------  2 manuth manuth 4096 Nov  7 16:28 .
drwxr-xr-x 53 manuth manuth 4096 Nov  7 13:31 ..
-rw-r--r--  1 manuth manuth  805 Nov  7 12:10 authorized_keys
-rw-r--r--  1 manuth manuth  543 Nov  7 13:47 config
-rw-------  1 manuth manuth  411 Nov  7 12:10 dqar-ed25519
-rw-r--r--  1 manuth manuth   96 Nov  7 12:10 dqar-ed25519.pub
-rw-------  1 manuth manuth 3243 Nov  7 12:10 dqar-rsa
-rw-r--r--  1 manuth manuth  740 Nov  7 12:10 dqar-rsa.pub
-rw-r--r--  1 manuth manuth 1990 Nov  7 15:14 known_hosts

Edit 2: Ah hah, the console output was several lines of this:

Nov 7 13:51:32 dqar sshd [11316]: fatal: Missing privilege separation directory: /var/empty

The server in question is FreeBSD 10.3.

ssh
Martin Hope
Manuth Chek
Asked: 2016-10-08 20:13:33 +0800 CST
  • 5

Client is Ubuntu 16.04 with keychain, server is FreeBSD 10.3. There is only one key in ~/.ssh/authorized_keys on the server (this key is ECDSA p521 and not RSA), and the client has both private and public key inside ~/.ssh. The problem is the client keeps sending all RSA keys available in its ~/.ssh first - see this verbose output:

OpenSSH_7.2p2 Ubuntu-4, OpenSSL 1.0.2g-fips  1 Mar 2016
debug1: Reading configuration data /home/manuth/.ssh/config
debug1: /home/manuth/.ssh/config line 1: Applying options for r2d2.manuth.life
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to r2d2.manuth.life [103.12.163.90] port 900.
debug1: Connection established.
debug1: identity file /home/manuth/.ssh/dqar type 3
debug1: key_load_public: No such file or directory
debug1: identity file /home/manuth/.ssh/dqar-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2 FreeBSD-20160310
debug1: match: OpenSSH_7.2 FreeBSD-20160310 pat OpenSSH* compat 0x04000000
debug1: Authenticating to r2d2.manuth.life:900 as 'manuth'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: [email protected]
debug1: kex: host key algorithm: ecdsa-sha2-nistp521
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp521 SHA256:awtuO9udROeroYOv3GJ8Z6xcHt4IQhjNkcKQ6eavuik
debug1: Host '[r2d2.manuth.life]:900' is known and matches the ECDSA host key.
debug1: Found key in /home/manuth/.ssh/known_hosts:10
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: manuth@wackypc
debug1: Authentications that can continue: publickey
debug1: Offering RSA public key: manuth@wackypc
debug1: Authentications that can continue: publickey
debug1: Offering RSA public key: manuth@wackypc
debug1: Authentications that can continue: publickey
debug1: Offering ECDSA public key: /home/manuth/.ssh/dqar
debug1: Server accepts key: pkalg ecdsa-sha2-nistp521 blen 172
debug1: Authentication succeeded (publickey).
Authenticated to r2d2.manuth.life ([103.12.163.90]:900).

Still the same output even when I specify this in ~/.ssh/config on the client:

host r2d2.manuth.life
IdentityFile ~/.ssh/dqar
Port 900

Tried removing all keys from keychain but no help. If I add an RSA public key to the server then specify the RSA private key in ~/.ssh/config on the client, it does pick up the RSA key straight away.

ssh ssh-keys
Martin Hope
Manuth Chek
Asked: 2016-10-07 01:07:02 +0800 CST
  • 4

One of my WordPress sites has a lot of static images (think at least 20 per page) and after I enable HTTP/2, the images in the lower part start to appear as broken (crossed out, like in images with dead links). Nothing wrong shows up in error.log file, but Chrome 53 says like this in the console:

Failed to load resource: net::ERR_SPDY_PROTOCOL_ERROR

I tried messing with client_max_body_size but that was no luck.

edit: this is my nginx.conf:

load_module /usr/local/libexec/nginx/ngx_mail_module.so;
load_module /usr/local/libexec/nginx/ngx_stream_module.so;
user  www;
worker_processes 4;
error_log  /var/log/nginx/error.log  info;

events {
        worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;

    client_body_buffer_size 10K;
    client_header_buffer_size 1k;
    client_max_body_size 0;
    large_client_header_buffers 2 1k;
    client_body_timeout 12;
    send_timeout 10;
    #keepalive_timeout  0;
    keepalive_timeout  65;
    gzip off;
    charset UTF-8;

    server {
        listen       80;
        server_name manuth.life www.manuth.life;
        server_tokens off;
        return 301 https://$server_name$request_uri; #redirects to HTTPS
        root   /usr/local/www/nginx/manuth.life;
        index index.php index.html index.htm;
        access_log /var/log/nginx/manuth.life.access.log;
        error_log /var/log/nginx/manuth.life.error.log;

        error_page      500 502 503 504  /50x.html;

        # redirect server error pages to the static page /50x.html
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/local/www/nginx-dist;
        }
    }

    server {
        listen       443 ssl http2;
        server_name  manuth.life www.manuth.life;
        server_tokens off;
        root   /usr/local/www/nginx/manuth.life;
        index index.php index.html index.htm;
        access_log /var/log/nginx/manuth.life.access.log;
        error_log /var/log/nginx/manuth.life.error.log;

        # redirect server error pages to the static page /50x.html
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/local/www/nginx-dist;
        }

        # strict SSL settings
        ssl_certificate /usr/local/etc/letsencrypt/live/manuth.life/fullchain.pem;
        ssl_certificate_key /usr/local/etc/letsencrypt/live/manuth.life/privkey.pem;

        ssl_session_timeout 5m;
        ssl_protocols TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_ecdh_curve secp384r1; #
        ssl_session_cache builtin:1000 shared:SSL:10m;
        ssl_session_tickets off;
        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_dhparam /usr/local/etc/ssl/dhparam.pem;
        resolver 8.8.8.8 8.8.4.4 valid=300s;
        resolver_timeout 10s;
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;

        location / {
            try_files $uri $uri/ /index.php?q=$uri&$args;
        }

        location ~ \.php$ {
            try_files $uri =404;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass unix:/var/run/php-fpm.sock;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $request_filename;
            include fastcgi_params;
        }

    }

}

nginx http2