Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #190030 > unrolled thread

Debian networking - accessing public-side servers from a private network

Back to article view | Back to linux.debian.user

Contents

  Debian networking - accessing public-side servers from a private  network Phil Reynolds <phil-debian@tinsleyviaduct.com> - 2017-12-19 19:50 +0100
    Re: Debian networking - accessing public-side servers from a  private network Phil Reynolds <phil-debian@tinsleyviaduct.com> - 2017-12-20 13:30 +0100
      Re: Debian networking - accessing public-side servers from a private  network Tom Furie <tom@furie.org.uk> - 2017-12-20 14:00 +0100
    Re: Debian networking - accessing public-side servers from a private  network Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-20 21:10 +0100
      Re: Debian networking - accessing public-side servers from a  private network Phil Reynolds <phil-debian@tinsleyviaduct.com> - 2017-12-21 01:50 +0100
        Re: Debian networking - accessing public-side servers from a private  network Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-21 07:30 +0100
          Re: Debian networking - accessing public-side servers from a private network メット <mett@pmars.jp> - 2017-12-21 09:30 +0100
          Re: Debian networking - accessing public-side servers from a private network メット <mett@pmars.jp> - 2017-12-21 09:40 +0100
            Re: Debian networking - accessing public-side servers from a  private network Phil Reynolds <phil-debian@tinsleyviaduct.com> - 2017-12-21 12:20 +0100
          Re: Debian networking - accessing public-side servers from a  private network Phil Reynolds <phil-debian@tinsleyviaduct.com> - 2017-12-21 12:20 +0100
            Re: Debian networking - accessing public-side servers from a  private network Phil Reynolds <phil-debian@tinsleyviaduct.com> - 2017-12-21 15:10 +0100
            Re: Debian networking - accessing public-side servers from a private  network Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-21 21:00 +0100
              Re: Debian networking - accessing public-side servers from a  private network Phil Reynolds <phil-debian@tinsleyviaduct.com> - 2017-12-22 10:00 +0100
                Re: Debian networking - accessing public-side servers from a private  network Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-22 11:00 +0100
                  Re: Debian networking - accessing public-side servers from a  private network Phil Reynolds <phil-debian@tinsleyviaduct.com> - 2017-12-23 00:50 +0100
                    Re: Debian networking - accessing public-side servers from a private  network Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-23 01:10 +0100

#190030 — Debian networking - accessing public-side servers from a private network

I have a network with a Debian router, using iptables for NAT and
firewalling. Connected to it via a Wi-fi acces point is, among other
things, an Android phone. This is mosty relevant in that I cannot vary
its settings very much, other than by changing them on the router.

I have IPv6 on the network, and, were all the apps I need to use on the
phone enabled, there would not be a problem, however some of them
require IPv4.

I have both public and private networks - let's say they are
192.0.2.48/28 and 192.168.0.0/24.

My network includes several physical machines that act as servers, and
all such machines have addresses in both IPv4 ranges, statically
assigned. Machines not used as servers have private addresses only,
assigned by DHCP. radvd is in use to assign IPv6 addresses and DNS
servers.

It is probably most notable that one server is running Asterisk, as it
is partially herein that the problem lies. I am trying to connect
Zoiper on the Android phone to it using IAX.

The router has addresses 192.0.2.49 and 192.168.0.1. The Asterisk box
has 192.0.2.51 and 192.168.0.4. The phone has been assigned
192.168.0.130 on this occasion. The router has NAT set up on
192.0.2.62 to enabre the private address only systems to access the
Internet.

If I set up Zoiper to use the FQDN of the Asterisk box, it connects
just fine when I am not at home. However, when I am at home, it still
uses the public IP address (192.0.2.51) of the Asterisk box, which,
because it can see the phone directly, then responds using its own
private address (192.168.0.4) - this causes Zoiper to fail to register.
(it is clear from a tcpdump that this is happening)

At no point does the router get involved in the communication between
the phone and the Asterisk box. To do so might make things easier, or
could just add an unnecessary layer of complexity.

The answer to the problem could lie in several places:

- If I could somehow get the phone to use the NAT to communicate with
  the Asterisk box, that would probably work.

- If I could get the phone to pick up the private address of the
  Asterisk box rather than the public one, that would probably work. I
  have tried setting up to do this with dnsmasq, but the IPv6 settings
  for DNS cause this to be overridden. If I could somehow change the
  priority of this on the phone, it would help.

- If I could persuade the Asterisk box to respond on its public address
  rather than its private one, that would probably work.

- If I could find an IPv6-enabled equivalent of Zoiper, that would
  probably work.

- If I could find an equivalent of Zoiper that would work registered to
  the private IP address when at home and the public one elsewhere,
  that would work.

The first three, if possible, should be possible on the Debian side of
things. The others are clearly outside Debian.

I am happy to do whatever it takes to investigate this further, but am
a bit at a loss on how to proceed from here.

Does anyone have any suggestions on how I might proceed?

-- 
Phil Reynolds
mail: phil-debian@tinsleyviaduct.com
Web: http://phil.tinsleyviaduct.com/

[toc] | [next] | [standalone]

#190060 — Re: Debian networking - accessing public-side servers from a private network

On Tue, 19 Dec 2017 18:22:47 +0000
Phil Reynolds <phil-debian@tinsleyviaduct.com> wrote:
> If I set up Zoiper to use the FQDN of the Asterisk box, it connects
> just fine when I am not at home. However, when I am at home, it still
> uses the public IP address (192.0.2.51) of the Asterisk box, which,
> because it can see the phone directly, then responds using its own
> private address (192.168.0.4) - this causes Zoiper to fail to
> register. (it is clear from a tcpdump that this is happening)
> 
> At no point does the router get involved in the communication between
> the phone and the Asterisk box. To do so might make things easier, or
> could just add an unnecessary layer of complexity.
> 
> The answer to the problem could lie in several places:
> 
> - If I could persuade the Asterisk box to respond on its public
> address rather than its private one, that would probably work.

... and, by adding two bindaddrs to the iax.conf, I have made this
happen. It no longer listens on 192.168.0.4, and my Android phone now
registers with it even when I'm at home, with no fiddling with anything
else.

Obviously, if I ever did need IAX on the local IPv4, I would have to
reopen this, so by no means do I consider this a permanent solution.
However, at present I can work with it. If some other solution (other
than the pinnacle, IPv6-enabled Zoiper) can be found, that would be
even better.

-- 
Phil Reynolds
mail: phil-debian@tinsleyviaduct.com
Web: http://phil.tinsleyviaduct.com/

[toc] | [prev] | [next] | [standalone]

#190061

[Multipart message — attachments visible in raw view] — view raw

On Wed, Dec 20, 2017 at 12:25:24PM +0000, Phil Reynolds wrote:
> On Tue, 19 Dec 2017 18:22:47 +0000
> Phil Reynolds <phil-debian@tinsleyviaduct.com> wrote:
> > If I set up Zoiper to use the FQDN of the Asterisk box, it connects
> > just fine when I am not at home. However, when I am at home, it still
> > uses the public IP address (192.0.2.51) of the Asterisk box, which,
> > because it can see the phone directly, then responds using its own
> > private address (192.168.0.4) - this causes Zoiper to fail to
> > register. (it is clear from a tcpdump that this is happening)
> > 
> > At no point does the router get involved in the communication between
> > the phone and the Asterisk box. To do so might make things easier, or
> > could just add an unnecessary layer of complexity.
> > 
> > The answer to the problem could lie in several places:
> > 
> > - If I could persuade the Asterisk box to respond on its public
> > address rather than its private one, that would probably work.
> 
> ... and, by adding two bindaddrs to the iax.conf, I have made this
> happen. It no longer listens on 192.168.0.4, and my Android phone now
> registers with it even when I'm at home, with no fiddling with anything
> else.
> 
> Obviously, if I ever did need IAX on the local IPv4, I would have to
> reopen this, so by no means do I consider this a permanent solution.
> However, at present I can work with it. If some other solution (other
> than the pinnacle, IPv6-enabled Zoiper) can be found, that would be
> even better.

One potential solution would be to split your DNS so that hostnames
resolve to public addresses for external queries, but private addresses
for internal queries.

I doubt dnsmasq can do this though, so you might have to look into
setting up a "real" DNS server.

Cheers,
Tom

-- 
knghtbrd: there may be no spoon, but can you spot the vulnerability in
eye_render_shiny_object.c?
		-- rcw

[toc] | [prev] | [next] | [standalone]

#190066

Le 19/12/2017 à 19:22, Phil Reynolds a écrit :
> I have a network with a Debian router, using iptables for NAT and
> firewalling. Connected to it via a Wi-fi acces point is, among other
> things, an Android phone. This is mosty relevant in that I cannot vary
> its settings very much, other than by changing them on the router.
> 
> I have IPv6 on the network, and, were all the apps I need to use on the
> phone enabled, there would not be a problem, however some of them
> require IPv4.
> 
> I have both public and private networks - let's say they are
> 192.0.2.48/28 and 192.168.0.0/24.
> 
> My network includes several physical machines that act as servers, and
> all such machines have addresses in both IPv4 ranges, statically
> assigned. Machines not used as servers have private addresses only,
> assigned by DHCP. radvd is in use to assign IPv6 addresses and DNS
> servers.
> 
> It is probably most notable that one server is running Asterisk, as it
> is partially herein that the problem lies. I am trying to connect
> Zoiper on the Android phone to it using IAX.
> 
> The router has addresses 192.0.2.49 and 192.168.0.1. The Asterisk box
> has 192.0.2.51 and 192.168.0.4. The phone has been assigned
> 192.168.0.130 on this occasion. The router has NAT set up on
> 192.0.2.62 to enabre the private address only systems to access the
> Internet.

IIUC, both the public and the private subnets are on the same physical LAN ?

> If I set up Zoiper to use the FQDN of the Asterisk box, it connects

I guess you mean the public domain name pointing to the public IPv4 
addresse ?

> just fine when I am not at home. However, when I am at home, it still
> uses the public IP address (192.0.2.51) of the Asterisk box, which,
> because it can see the phone directly, then responds using its own
> private address (192.168.0.4) - this causes Zoiper to fail to register.
> (it is clear from a tcpdump that this is happening)

That's really bad. I consider that Asterisk is faulty here. In theory 
UDP is not connection-oriented but in practice many client/server 
protocols based on UDP use some form of loose connection and work better 
through stateful firewalls and NATs when the reply packet source address 
is equal to the request packet destination address.

> At no point does the router get involved in the communication between
> the phone and the Asterisk box. To do so might make things easier, or
> could just add an unnecessary layer of complexity.

How does the private client know that the public server address is 
reachable directly on the LAN an not through the router ?

> The answer to the problem could lie in several places:
> 
> - If I could somehow get the phone to use the NAT to communicate with
>    the Asterisk box, that would probably work.

You could use SNAT in the POSTROUTING chain on the router you can force 
routing of the public server address from the client through the router.
Or you could use SNAT on the server (in the INPUT chain on recent enough 
kernels) when the incoming packet has a private source address and a 
public destination address.
However in either case SIP requires special by netfilter with the 
conntrack and NAT SIP handler.

> - If I could get the phone to pick up the private address of the
>    Asterisk box rather than the public one, that would probably work. I
>    have tried setting up to do this with dnsmasq, but the IPv6 settings
>    for DNS cause this to be overridden. If I could somehow change the
>    priority of this on the phone, it would help.

All the IPv4 and IPv6 nameservers used by the client must resolve the 
name into the private address. If they also serve the public zone, you 
must set up "split DNS" to server different versions for private and 
public clients.

[toc] | [prev] | [next] | [standalone]

#190072 — Re: Debian networking - accessing public-side servers from a private network

On Wed, 20 Dec 2017 21:08:21 +0100
Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:

> IIUC, both the public and the private subnets are on the same
> physical LAN ?

Yes, that is correct.
 
> > If I set up Zoiper to use the FQDN of the Asterisk box, it
> > connects  
> 
> I guess you mean the public domain name pointing to the public IPv4 
> addresse ?

Points to the public IPv6 and IPv4 addresses - most places other than
home do not currently have IPv6, though.

> > just fine when I am not at home. However, when I am at home, it
> > still uses the public IP address (192.0.2.51) of the Asterisk box,
> > which, because it can see the phone directly, then responds using
> > its own private address (192.168.0.4) - this causes Zoiper to fail
> > to register. (it is clear from a tcpdump that this is happening)  
> 
> That's really bad. I consider that Asterisk is faulty here. In theory 
> UDP is not connection-oriented but in practice many client/server 
> protocols based on UDP use some form of loose connection and work
> better through stateful firewalls and NATs when the reply packet
> source address is equal to the request packet destination address.

I will try to chase this up further with the Asterisk developers, but
their main answer has been "use the private address when at home". I do
agree it's a fault with Asterisk.

> > At no point does the router get involved in the communication
> > between the phone and the Asterisk box. To do so might make things
> > easier, or could just add an unnecessary layer of complexity.  
> 
> How does the private client know that the public server address is 
> reachable directly on the LAN an not through the router ?

That I couldn't say, but it's plainly the case.

> > The answer to the problem could lie in several places:
> > 
> > - If I could somehow get the phone to use the NAT to communicate
> > with the Asterisk box, that would probably work.  
> 
> You could use SNAT in the POSTROUTING chain on the router you can
> force routing of the public server address from the client through
> the router. Or you could use SNAT on the server (in the INPUT chain
> on recent enough kernels) when the incoming packet has a private
> source address and a public destination address.
> However in either case SIP requires special by netfilter with the 
> conntrack and NAT SIP handler.

Indeed, SIP can get mighty complicated with NAT. It's part of the
reason I prefer to use IAX for clients that connect from outside.

> > - If I could get the phone to pick up the private address of the
> >    Asterisk box rather than the public one, that would probably
> > work. I have tried setting up to do this with dnsmasq, but the IPv6
> > settings for DNS cause this to be overridden. If I could somehow
> > change the priority of this on the phone, it would help.  
> 
> All the IPv4 and IPv6 nameservers used by the client must resolve the 
> name into the private address. If they also serve the public zone,
> you must set up "split DNS" to server different versions for private
> and public clients.

Unfortunately I have found no way to override the radvd-provided DNS
server addresses - otherwise I would have done this.

-- 
Phil Reynolds
mail: phil-debian@tinsleyviaduct.com
Web: http://phil.tinsleyviaduct.com/

[toc] | [prev] | [next] | [standalone]

#190076

Le 21/12/2017 à 01:48, Phil Reynolds a écrit :
> 
>>> At no point does the router get involved in the communication
>>> between the phone and the Asterisk box. To do so might make things
>>> easier, or could just add an unnecessary layer of complexity.
>>
>> How does the private client know that the public server address is
>> reachable directly on the LAN an not through the router ?
> 
> That I couldn't say, but it's plainly the case.

How are TCP/IP parameters configured on the client ?
Could you show its routing table ?

>>> - If I could get the phone to pick up the private address of the
>>>     Asterisk box rather than the public one, that would probably
>>> work. I have tried setting up to do this with dnsmasq, but the IPv6
>>> settings for DNS cause this to be overridden. If I could somehow
>>> change the priority of this on the phone, it would help.
>>
>> All the IPv4 and IPv6 nameservers used by the client must resolve the
>> name into the private address. If they also serve the public zone,
>> you must set up "split DNS" to server different versions for private
>> and public clients.
> 
> Unfortunately I have found no way to override the radvd-provided DNS
> server addresses - otherwise I would have done this.
Aren't you in control of the router configuration and which IPv6 DNS 
servers are advertised in the RAs it sends (radvd ?), and of these 
servers behaviour ?

Just another thought : isn't it possible to set up Asterisk to listen 
explicitly on both the private and public IPv4 addresses instead of any 
local address, so that it opens two separate sockets ? This way I think 
it would reply with the proper source address.

[toc] | [prev] | [next] | [standalone]

#190078 — Re: Debian networking - accessing public-side servers from a private network

On 2017年12月21日 15:23:06 JST, Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
>Le 21/12/2017 à 01:48, Phil Reynolds a écrit :
>> 
>>>> At no point does the router get involved in the communication
>>>> between the phone and the Asterisk box. To do so might make things
>>>> easier, or could just add an unnecessary layer of complexity.
>>>
>>> How does the private client know that the public server address is
>>> reachable directly on the LAN an not through the router ?
>> 
>> That I couldn't say, but it's plainly the case.
>
>How are TCP/IP parameters configured on the client ?
>Could you show its routing table ?
>
>>>> - If I could get the phone to pick up the private address of the
>>>>     Asterisk box rather than the public one, that would probably
>>>> work. I have tried setting up to do this with dnsmasq, but the IPv6
>>>> settings for DNS cause this to be overridden. If I could somehow
>>>> change the priority of this on the phone, it would help.
>>>
>>> All the IPv4 and IPv6 nameservers used by the client must resolve
>the
>>> name into the private address. If they also serve the public zone,
>>> you must set up "split DNS" to server different versions for private
>>> and public clients.
>> 
>> Unfortunately I have found no way to override the radvd-provided DNS
>> server addresses - otherwise I would have done this.
>Aren't you in control of the router configuration and which IPv6 DNS 
>servers are advertised in the RAs it sends (radvd ?), and of these 
>servers behaviour ?
>
>Just another thought : isn't it possible to set up Asterisk to listen 
>explicitly on both the private and public IPv4 addresses instead of any
>
>local address, so that it opens two separate sockets ? This way I think
>
>it would reply with the proper source address.



Did u try to use stunt server? 
I had same pbm b4, 
solved with resiprocate stunt server
IIRC. 

Diff in my setup are: 
-asterisk and router are on same box, 
same OS
-using sip
Dont think that matters though. 

HTH

[toc] | [prev] | [next] | [standalone]

#190079 — Re: Debian networking - accessing public-side servers from a private network

On 2017年12月21日 15:23:06 JST, Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
>Le 21/12/2017 à 01:48, Phil Reynolds a écrit :
>> 
>>>> At no point does the router get involved in the communication
>>>> between the phone and the Asterisk box. To do so might make things
>>>> easier, or could just add an unnecessary layer of complexity.
>>>
>>> How does the private client know that the public server address is
>>> reachable directly on the LAN an not through the router ?
>> 
>> That I couldn't say, but it's plainly the case.
>
>How are TCP/IP parameters configured on the client ?
>Could you show its routing table ?
>
>>>> - If I could get the phone to pick up the private address of the
>>>>     Asterisk box rather than the public one, that would probably
>>>> work. I have tried setting up to do this with dnsmasq, but the IPv6
>>>> settings for DNS cause this to be overridden. If I could somehow
>>>> change the priority of this on the phone, it would help.
>>>
>>> All the IPv4 and IPv6 nameservers used by the client must resolve
>the
>>> name into the private address. If they also serve the public zone,
>>> you must set up "split DNS" to server different versions for private
>>> and public clients.
>> 
>> Unfortunately I have found no way to override the radvd-provided DNS
>> server addresses - otherwise I would have done this.
>Aren't you in control of the router configuration and which IPv6 DNS 
>servers are advertised in the RAs it sends (radvd ?), and of these 
>servers behaviour ?
>
>Just another thought : isn't it possible to set up Asterisk to listen 
>explicitly on both the private and public IPv4 addresses instead of any
>
>local address, so that it opens two separate sockets ? This way I think
>
>it would reply with the proper source address.


Sorry, I have been too fast on the last mail.
resiprocate is only sip and is for nat pbm.

Try setup asterisk address as ANY ie.
0.0.0.0.

Then asterisk will act on both addresses.

HTH

[toc] | [prev] | [next] | [standalone]

#190094 — Re: Debian networking - accessing public-side servers from a private network

On Thu, 21 Dec 2017 17:30:25 +0900
メット <mett@pmars.jp> wrote:


> Try setup asterisk address as ANY ie.
> 0.0.0.0.
> 
> Then asterisk will act on both addresses.

That is probably the equivalent of the default, i.e. no address
specified, which fails as indicated. I will however try it later.

-- 
Phil Reynolds
mail: phil-debian@tinsleyviaduct.com
Web: http://phil.tinsleyviaduct.com/

[toc] | [prev] | [next] | [standalone]

#190093 — Re: Debian networking - accessing public-side servers from a private network

On Thu, 21 Dec 2017 07:23:06 +0100
Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:

> How are TCP/IP parameters configured on the client ?
> Could you show its routing table ?

Output of "route" on it:

Destination 192.168.0.0 Gateway * Genmask 255.255.255.0 Flags U Metric
0 Ref 0 Use 0 Iface wlan0

Output of "route -A inet6" is much longer - see
http://paste.debian.net/1001796 - note that this is "as is", I haven't
concealed anything.

> >>> - If I could get the phone to pick up the private address of the
> >>>     Asterisk box rather than the public one, that would probably
> >>> work. I have tried setting up to do this with dnsmasq, but the
> >>> IPv6 settings for DNS cause this to be overridden. If I could
> >>> somehow change the priority of this on the phone, it would help.  
> >>
> >> All the IPv4 and IPv6 nameservers used by the client must resolve
> >> the name into the private address. If they also serve the public
> >> zone, you must set up "split DNS" to server different versions for
> >> private and public clients.  
> > 
> > Unfortunately I have found no way to override the radvd-provided DNS
> > server addresses - otherwise I would have done this.  
> Aren't you in control of the router configuration and which IPv6 DNS 
> servers are advertised in the RAs it sends (radvd ?), and of these 
> servers behaviour ?

I am in control but it's a case of "can it be done and if so how?".

> Just another thought : isn't it possible to set up Asterisk to listen 
> explicitly on both the private and public IPv4 addresses instead of
> any local address, so that it opens two separate sockets ? This way I
> think it would reply with the proper source address.
 
Not tried that yet but I will, a bit later.

-- 
Phil Reynolds
mail: phil-debian@tinsleyviaduct.com
Web: http://phil.tinsleyviaduct.com/

[toc] | [prev] | [next] | [standalone]

#190100 — Re: Debian networking - accessing public-side servers from a private network

On Thu, 21 Dec 2017 11:10:40 +0000
Phil Reynolds <phil-debian@tinsleyviaduct.com> wrote:

> On Thu, 21 Dec 2017 07:23:06 +0100
> Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
> > Just another thought : isn't it possible to set up Asterisk to
> > listen explicitly on both the private and public IPv4 addresses
> > instead of any local address, so that it opens two separate
> > sockets ? This way I think it would reply with the proper source
> > address.  
>  
> Not tried that yet but I will, a bit later.

That seems to be effective.

-- 
Phil Reynolds
mail: phil-debian@tinsleyviaduct.com
Web: http://phil.tinsleyviaduct.com/

[toc] | [prev] | [next] | [standalone]

#190115

Now you seem to have found a rather good solution (not based on some 
hackish NAT, convoluted routing or complex split DNS), it may be uselee 
to carry on this thread, but I am just interested and curious.

Le 21/12/2017 à 12:10, Phil Reynolds a écrit :
> On Thu, 21 Dec 2017 07:23:06 +0100
> Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
> 
>> How are TCP/IP parameters configured on the client ?
>> Could you show its routing table ?
> 
> Output of "route" on it:
> 
> Destination 192.168.0.0 Gateway * Genmask 255.255.255.0 Flags U Metric
> 0 Ref 0 Use 0 Iface wlan0

Is that all ? No default route ?
How can it reach any address outside the private subnet ?

> Output of "route -A inet6" is much longer - see
> http://paste.debian.net/1001796 - note that this is "as is", I haven't
> concealed anything.

That does not look like an IPv6 routing table, not even like any routing 
table. It rather looks like some key=value pair config file. Here are 
the few first lines of what I see :

activer_ajout_hosts="non"
activer_antispoofing="non"
activer_apache="non"
activer_bash_completion="oui"
activer_bonding_eth0="non"

>>>> All the IPv4 and IPv6 nameservers used by the client must resolve
>>>> the name into the private address. If they also serve the public
>>>> zone, you must set up "split DNS" to server different versions for
>>>> private and public clients.
>>>
>>> Unfortunately I have found no way to override the radvd-provided DNS
>>> server addresses - otherwise I would have done this.
>> Aren't you in control of the router configuration and which IPv6 DNS
>> servers are advertised in the RAs it sends (radvd ?), and of these
>> servers behaviour ?
> 
> I am in control but it's a case of "can it be done and if so how?".

If the IPv6 router advertisements are sent by radvd on the router, the 
RDNSS option advertising the IPv6 DNS addresses are defined in the 
config file /etc/radvd.conf. The defined DNS server(s), along with the 
IPv4 ones, should be under your control and set up to serve different 
records for the Asterisk server name based on the query source address. 
This is called split DNS. In BIND the feature is named "views".

[toc] | [prev] | [next] | [standalone]

#190139 — Re: Debian networking - accessing public-side servers from a private network

On Thu, 21 Dec 2017 20:57:09 +0100
Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:

> Now you seem to have found a rather good solution (not based on some 
> hackish NAT, convoluted routing or complex split DNS), it may be
> uselee to carry on this thread, but I am just interested and curious.
> 
> Le 21/12/2017 à 12:10, Phil Reynolds a écrit :
> > On Thu, 21 Dec 2017 07:23:06 +0100
> > Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
> >   
> >> How are TCP/IP parameters configured on the client ?
> >> Could you show its routing table ?  
> > 
> > Output of "route" on it:
> > 
> > Destination 192.168.0.0 Gateway * Genmask 255.255.255.0 Flags U
> > Metric 0 Ref 0 Use 0 Iface wlan0  
> 
> Is that all ? No default route ?
> How can it reach any address outside the private subnet ?

What it can see locally on the physical network, it reaches. Otherwise
it goes through the router. I haven't interfered with this at all.

> > Output of "route -A inet6" is much longer - see
> > http://paste.debian.net/1001796 - note that this is "as is", I
> > haven't concealed anything.  
> 
> That does not look like an IPv6 routing table, not even like any
> routing table. It rather looks like some key=value pair config file.
> Here are the few first lines of what I see :

Indeed, I have no idea where it actually went. Now at
http://paste.debian.net/1001920/

> >>>> All the IPv4 and IPv6 nameservers used by the client must resolve
> >>>> the name into the private address. If they also serve the public
> >>>> zone, you must set up "split DNS" to server different versions
> >>>> for private and public clients.  
> >>>
> >>> Unfortunately I have found no way to override the radvd-provided
> >>> DNS server addresses - otherwise I would have done this.  
> >> Aren't you in control of the router configuration and which IPv6
> >> DNS servers are advertised in the RAs it sends (radvd ?), and of
> >> these servers behaviour ?  
> > 
> > I am in control but it's a case of "can it be done and if so
> > how?".  
> 
> If the IPv6 router advertisements are sent by radvd on the router,
> the RDNSS option advertising the IPv6 DNS addresses are defined in
> the config file /etc/radvd.conf. The defined DNS server(s), along
> with the IPv4 ones, should be under your control and set up to serve
> different records for the Asterisk server name based on the query
> source address. This is called split DNS. In BIND the feature is
> named "views".

Perhaps I should say "I am in control of the radvd but the IPv6
nameservers are not mine and therefore I cannot control their
behaviour." 

It may be possible for me to use dnsmasq to provide a workaround, but
as things stand now I don't need it.

-- 
Phil Reynolds
mail: phil-debian@tinsleyviaduct.com
Web: http://phil.tinsleyviaduct.com/

[toc] | [prev] | [next] | [standalone]

#190142

Le 22/12/2017 à 09:56, Phil Reynolds a écrit :
> Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
>> Le 21/12/2017 à 12:10, Phil Reynolds a écrit :
>>> Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
>>>    
>>>> How are TCP/IP parameters configured on the client ?
>>>> Could you show its routing table ?
>>>
>>> Output of "route" on it:
>>>
>>> Destination 192.168.0.0 Gateway * Genmask 255.255.255.0 Flags U
>>> Metric 0 Ref 0 Use 0 Iface wlan0
>>
>> Is that all ? No default route ?
>> How can it reach any address outside the private subnet ?
> 
> What it can see locally on the physical network, it reaches. Otherwise
> it goes through the router. I haven't interfered with this at all.

How does it know the router address if there is no route ?
Maybe the output of the following command is more complete :

ip -4 route show table all

Is the IPv4 configuration static or dynamic (DHCP) ?

>>> Output of "route -A inet6" is much longer - see
(...)
> http://paste.debian.net/1001920/

A bit hard to read. "ip -6 route show" would be easier to read. Anyway 
it looks like it contains the usual IPv6 routes (subnet prefix, 
link-local prefix, local addresses, default route with router).

[toc] | [prev] | [next] | [standalone]

#190175 — Re: Debian networking - accessing public-side servers from a private network

On Fri, 22 Dec 2017 10:59:24 +0100
Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:

> How does it know the router address if there is no route ?
> Maybe the output of the following command is more complete :
> 
> ip -4 route show table all

http://paste.debian.net/1002048/
 
> Is the IPv4 configuration static or dynamic (DHCP) ?

DHCP.
 
> >>> Output of "route -A inet6" is much longer - see  
> (...)
> > http://paste.debian.net/1001920/  
> 
> A bit hard to read. "ip -6 route show" would be easier to read.
> Anyway it looks like it contains the usual IPv6 routes (subnet
> prefix, link-local prefix, local addresses, default route with
> router).

ip -6 route show - no output.
-- 
Phil Reynolds
mail: phil-debian@tinsleyviaduct.com
Web: http://phil.tinsleyviaduct.com/

[toc] | [prev] | [next] | [standalone]

#190178

Le 23/12/2017 à 00:46, Phil Reynolds a écrit :
> On Fri, 22 Dec 2017 10:59:24 +0100
> Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
> 
>> How does it know the router address if there is no route ?
>> Maybe the output of the following command is more complete :
>>
>> ip -4 route show table all
> 
> http://paste.debian.net/1002048/

The output is not so big. You could have put it directly in your post.
"route" did not show the default route with the router address because 
it is in a custom routing table (1013), not in the main routing table. I 
have no idea why, but it does not matter much. I guess there must be 
some advanced routing rules using that custom table (ip rule will show).

However I see not route for the public subnet. So the first time the 
host sends a packet to the public server address, it must send it to the 
router. The router forwards it to the server and also sends back an ICMP 
"redirect" message to the host to inform it that the address is actually 
directly reachable. So the host may send subsequent packets directly to 
the server - or not, still sending them to the router.

So I guess you could have used source NAT on the router to work around 
the issue.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web