ipcop-devel Mailing List for IPCop Firewall

----- Original Message ----- 
From: "Sanjay Arora" <san...@gm...>
To: "Gilles Espinasse" <g....@fr...>
Sent: Tuesday, February 28, 2006 11:59 PM
Subject: Re: [IPCop-devel] HELP PL: ADSL Driver for IPcop...Huawei SmartAX
MT how to add to IPcop


On 3/1/06, Gilles Espinasse <g....@fr...> wrote:
> >
> > I am interested to look at the sources.
> >
> Am enclosing the linux source & the pdf file about the modem. If you
> see the back panel illustration, there is an ethernet port to connect
> to ipcop in addition to the usb port, which I think needs the linux
> driver. The IPcop ppoe setup page should have an option for an eth
> interface for connecting ppoe & in that case not need any other
> settings except that the router be set in a bridge mode.
>
> Ethernet port DSL routers are very common out here in India and I
> would like to see IPcop support it without drivers.
>

Ethernet should work without adding a driver?
Could you check the debug option on pppsetup.cgi page and show the resulting
log of attempt to connect.

Concerning the sources send for usb, this would involve to changes CDCether
driver include in kernel already include in IPCop.
I am reluctant to change something wich should work and that I have no
possibility to test.

Could you try too using the CDCether module already supplied?
You have to set a RED connection and not a 'RED is modem'. Then plug your
modem into usb and let setup probe your modem, it should recognise a
CDCether interface.

Gilles

Bugs item #1440623, was opened at 2006-02-28 23:24
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1440623&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: 1.4.10
Status: Open
Resolution: None
Priority: 5
Submitted By: TopForce (topforce)
Assigned to: Nobody/Anonymous (nobody)
Summary: Access to remote pptp server (Digicom Firegate) don't work

Initial Comment:
I have installed IpCop 1.4.10 in my office lan.
When I try to connect form GREEN to an external PPTP 
server (Digicom Firegate Firewall), connection fail; 
connection work with another distribution (Debian 
Sarge based firewall).

Digicom Firegate Firewall also is upgraded with 
latest firmware avalaible.

I have compared tcpdump (on IpCop) of connection fail 
with tcpdump of a working connection (with Poptop 
linux server) and I read that:

- when connection succedeed, first GRE packet is 
sending from client (in green lan);

- when connection working, first GRE packet is 
sending from server (Digicom Firegate Firewall) and 
firewall block it.

I believe that IpCop don't track nat pptp connection 
correctly.
I would to try with 1.4.11 (with pptp-conntrack-nat
update) but I don't know how to use toolchain.

Is this a bug ?


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1440623&group_id=40604

----- Original Message ----- 
From: "Sanjay Arora" <san...@gm...>
To: <ipc...@li...>
Sent: Tuesday, February 28, 2006 4:22 PM
Subject: [IPCop-devel] HELP PL: ADSL Driver for IPcop...Huawei SmartAX MT
how to add to IPcop


> I have Huawei SmartAX MT882 adsl router (about 100000 of them bought
> by biggest ISP BSNL in India), works without any problem with static
> IP in bridge mode but BSNL requires ppoe/username & passwd.
>
> Has a Ethernet port for connecting to the IPcop machine, as well as a
> USB port. When connecting from centos DSL connect (roaringpenguin)
> works transparently with the router in bridge mode. Tried to configure
> with ppoe in setup followed by gui dial-up...does not work though
> IPcop gets the dynamic IP address and DNS IPs.

If IPCop receive the public IP and and DNS IP, you are connected.
After it a problem with dns setting for your machines on the green lan.

> The modem comes with a source linux driver, for the usb connection.
> Please advise how to upload it to IPcop box after compiling. Also, I
> can email it to the list or better to any developer who can build it
> in IPcop.
>
> Huwaei links:
http://www.huawei.com/products/terminal/products/view.do?id=121
>
> I could not find the driver on the site but have it with me on CD and
> can mail it to anyone req.

I am interested to look at the sources.

Gilles

I have Huawei SmartAX MT882 adsl router (about 100000 of them bought
by biggest ISP BSNL in India), works without any problem with static
IP in bridge mode but BSNL requires ppoe/username & passwd.

Has a Ethernet port for connecting to the IPcop machine, as well as a
USB port. When connecting from centos DSL connect (roaringpenguin)
works transparently with the router in bridge mode. Tried to configure
with ppoe in setup followed by gui dial-up...does not work though
IPcop gets the dynamic IP address and DNS IPs.

The modem comes with a source linux driver, for the usb connection.
Please advise how to upload it to IPcop box after compiling. Also, I
can email it to the list or better to any developer who can build it
in IPcop.

Huwaei links: http://www.huawei.com/products/terminal/products/view.do?id=
=3D121

I could not find the driver on the site but have it with me on CD and
can mail it to anyone req.

Please advise.
Best regards.
Sanjay.

I don't think it is an IPCop issue, but rather PPPOE. It works
fine with DSLExtreme/SBC. But, it is configured as a bridge
and I have static IPs.

Bao

On Mon, February 27, 2006 3:34 pm, Alessio Cecchi wrote:
> Alle 00:27, martedì 28 febbraio 2006, Alessio Cecchi ha scritto:
>> Hello all
>>
>> I have an IPCOP 1.4.10 installed on a Lex Light with an "Light System
>> ADSL Module" (Conexant ADSL USB modem):
>
> I have read this now...
>
> http://sourceforge.net/tracker/index.php?func=detail&aid=1182107&group_id=40604&atid=428516
>
> :(
> --
> Alessio Cecchi ++ www.skye.it
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by xPML, a groundbreaking scripting
> language
> that extends applications into web and mobile media. Attend the live
> webcast
> and join the prime developer group breaking into this new coding
> territory!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
>


-- 
Best Regards.
Bao C. Ha
Hacom OpenBrick Distributor USA http://www.hacom.net
voice: (714) 530-8817 fax: (714) 530-8818
8D66 6672 7A9B 6879 85CD 42E0 9F6C 7908 ED95 6B38

Alle 00:27, marted=EC 28 febbraio 2006, Alessio Cecchi ha scritto:
> Hello all
>
> I have an IPCOP 1.4.10 installed on a Lex Light with an "Light System
> ADSL Module" (Conexant ADSL USB modem):

I have read this now...

http://sourceforge.net/tracker/index.php?func=3Ddetail&aid=3D1182107&group_=
id=3D40604&atid=3D428516

:(
=2D-=20
Alessio Cecchi ++ www.skye.it

Hello all

I have an IPCOP 1.4.10 installed on a Lex Light with an "Light System
ADSL Module" (Conexant ADSL USB modem):

The modem and the line are discovered correctly:

root@ipcop:~ # /etc/rc.d/rc.conexantusbadsl start
cxload
Conexant AccessRunner microcode upload program. 6/9/2003
Josep Comas <jc...@gn...>
See credits in documentation

I found ADSL modem with VendorID = 0572 & ProductID = cb06
Loading and sending /usr/sbin/cxfirm4.bin...
Firmware is sent!
Setting configuration...
Waiting ADSL line is up (until 90 seconds)...
....
ADSL line is up (Downstream 2464 Kbits/s, Upstream 640 Kbits/s)
Conexant AccessRunner ioctl call. 6/9/2003
Josep Comas <jc...@gn...>
See credits in documentation
I found ADSL modem with VendorID = 0572 & ProductID = cb06


But i'm unable to connect to internet:
With PPPoA i see this error:
from /var/log/messages

Feb 24 02:37:48 ipguard ipcop: Dialling ngi.
Feb 24 02:38:03 ipguard kernel: CSLIP: code copyright 1989 Regents of
the University of California
Feb 24 02:38:03 ipguard kernel: PPP generic driver version 2.4.2
Feb 24 02:38:03 ipguard pppd[849]: Plugin pppoatm.so loaded.
Feb 24 02:38:03 ipguard pppd[849]: PPPoATM plugin_init
Feb 24 02:38:03 ipguard pppd[849]: PPPoATM setdevname - remove unwanted
options
Feb 24 02:38:03 ipguard pppd[849]: PPPoATM setdevname_pppoatm -
SUCCESS:8.35 Feb 24 02:38:03 ipguard pppd[850]: pppd 2.4.2 started by
root, uid 0 Feb 24 02:38:03 ipguard pppd[850]: using channel 1
Feb 24 02:38:03 ipguard pppd[850]: Using interface ppp0
Feb 24 02:38:03 ipguard pppd[850]: Connect: ppp0 <--> 8.35
Feb 24 02:38:03 ipguard pppd[850]: sent [LCP ConfReq id=0x1 <magic
0x7dc4cda0>]
Feb 24 02:38:36 ipguard last message repeated 11 times
Feb 24 02:38:51 ipguard last message repeated 5 times
Feb 24 02:38:55 ipguard pppd[850]: sent [LCP ConfReq id=0x1 <magic
0x7dc4cda0>]
Feb 24 02:39:28 ipguard last message repeated 11 times
Feb 24 02:39:58 ipguard last message repeated 10 times
Feb 24 02:40:01 ipguard pppd[850]: sent [LCP ConfReq id=0x1 <magic
0x7dc4cda0>]
Feb 24 02:40:31 ipguard last message repeated 10 times
Feb 24 02:40:34 ipguard pppd[850]: LCP: timeout sending Config-Requests

pppd run with (from ps aux | grep pppd):

/usr/sbin/pppd plugin pppoatm.so 8.35 vc-encaps usepeerdns
active-filter outbound and not icmp[0] == 3 and not tcp[13] & 4 != 0
noipdefault defaultroute user 7450424364 ipcp-accept-local
ipcp-accept-remote passive nopcomp noccp novj nobsdcomp nodeflate
lcp-echo-interval 20 lcp-echo-failure 3 lcp-max-configure 50 maxfail 5
debug

What test can i do for investigate?
Thanks
-- 
Alessio Cecchi ++ www.skye.it

Feature Requests item #1439618, was opened at 2006-02-27 14:32
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1439618&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Priority: 5
Submitted By: Florian Schnabel (fireball)
Assigned to: Nobody/Anonymous (nobody)
Summary: add a refresh to graphs

Initial Comment:
It would be nice to add a meta tag for refresh to
various pages, especially the graphs.

I did that on my IPcop myself, it's just one line
anyway but it took a bit to find out where to add it :-)

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1439618&group_id=40604

I used to have a road warrior VPN working using IPSecuritas , but 
when I upgraded to OS/X Tiger it stopped working.  I have had IPCop 
1.4 net to net VPNs working the whole time.  I've been struggling 
with the problem for months and am happy to report I finally 
circumvented it.

First the circumvention, and then an explanation.

Solution:

Go to the Firewall->External Access web page and add an entry for UDP port 500.

Explanation:

Apparently Apple didn't follow the standard for NAT-Traversal packets 
in OS/X Tiger.  The IPSec standard is that IPSec without NAT-T starts 
a session with UDP packets with both source and destination ports of 
500 and then switches to IP protocol 47 for the rest of the session. 
For NAT-T sessions, all traffic has a destination port of 4500 and 
any source port.  Apple does NAT-T with a destination port of 500, 
instead of 4500.  Since the packets are NATed, the source port can 
and will be anything.  This is described as the Apple floating port 
500 problem on the net.

IPCop's iptables chains follow the standard:  UDP packets with both 
source and destination ports of 500 are let through, as well as 
packets with a destination port of 4500 with any source port.  This 
means that Apple's NAT-T UDP packets with any source port, floating 
port, and a destination port of 500 are logged and then dropped 
before OpenS/WAN sees them.

Adding the External Access rule for destination port 500 UDP packets 
circumvents the problem, by allowing destination port 500 UDP packets 
through to OpenS/WAN.

Harry

Bugs item #1439387, was opened at 2006-02-27 14:11
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1439387&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Security (Patches etc)
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Geoff (g8se)
Assigned to: Nobody/Anonymous (nobody)
Summary: openswan IKE daemon DoS

Initial Comment:
SecurityFocus lists a DoS vulnerability for OpenSwan:
http://www.securityfocus.com/bid/15416

From what I could work out in the IPcop changelogs,
you're running openswan 2.3.1, so there are probably
other issues that have also been fixed since.

Please consider updating openswan.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1439387&group_id=40604

Feature Requests item #1439193, was opened at 2006-02-26 21:13
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1439193&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Priority: 5
Submitted By: TopForce (topforce)
Assigned to: Nobody/Anonymous (nobody)
Summary: Include poptop server

Initial Comment:
It's interesting to include Poptop server (with mppe-
mppc kernel patch) for easy VPN access from Microsoft 
Windows 2k/XP client.

Why do I have to configure another MS pptp server if 
I have Poptop server possibility on my IpCop fw ?

Tnx.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1439193&group_id=40604

Bugs item #1439166, was opened at 2006-02-26 20:48
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1439166&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: 1.4.10
Status: Open
Resolution: None
Priority: 5
Submitted By: TopForce (topforce)
Assigned to: Nobody/Anonymous (nobody)
Summary: Access to remote pptp server (Cisco PIX) don't work

Initial Comment:
I have installed IpCop 1.4.10 in my office lan.
When I try to connect form GREEN to an external PPTP 
server (CISCO PIX), connection fail; connection work 
with another distribution (Debian Sarge based 
firewall).

I have compared tcpdump (on IpCop) of connection fail 
with tcpdump of a working connection (with Poptop 
linux server) and I read that:
- when connection succedeed, first GRE packet is 
sending from client (in green lan);
- when connection working, first GRE packet is 
sending from server (CISCO PIX) and firewall block it.

I believe that IpCop don't track nat pptp connection 
correctly.
I would to try with 1.4.11 (with pptp-conntrack-nat 
update) but I don't know how to use toolchain.

Is this a bug ?


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1439166&group_id=40604

Hi Gilles,

Gilles Espinasse wrote:
>> I was wondering if it would be possible for you to include "Sip
>> contrack/NAT" capability to IPCOP, some more details here:
>>   http://sipx-wiki.calivia.com/index.php/HowTo_configure_iptables
>>
> sip-conntrack-nat info state
> "Title: SIP connection tracking and NAT helper
> Author: Christian Hentschel <che...@ar...>
> Status: Testing
> Repository: extra
> Requires: linux-2.6 >= 2.6.11"
>
> We need a 2.6 kernel

Okay thank you very much for the information... is the "SIP conntrack/NAT" 
extension planned to be include in 1.5 then?

I have been very busy and unable to keep up with the IPCOP project lately; 
is it possible to indicate how far away 1.5 might be at this time [very 
rough timing]?

Thanks and Kind Regards

AndrewM

Andrew McGlashan
Broadband Solutions now including VoIP 1300 85 3804

Mobile: 04 2574 1827 Fax: 03 8790 1224

Affinity Vision Australia Pty Ltd
www.affinityvision.com.au
www.affinityvision.net/adsl/

In Case of Emergency --  http://www.affinityvision.com.au/ice.html 

----- Original Message ----- 
From: "Andrew McGlashan" <and...@af...>
To: <ipc...@li...>
Sent: Sunday, February 26, 2006 8:51 AM
Subject: [IPCop-devel] SIP conntrack/NAT extension


> Hi Guys/Gals,
> 
> I was wondering if it would be possible for you to include "Sip 
> contrack/NAT" capability to IPCOP, some more details here:
>   http://sipx-wiki.calivia.com/index.php/HowTo_configure_iptables
> 
sip-conntrack-nat info state
"Title: SIP connection tracking and NAT helper
Author: Christian Hentschel <che...@ar...>
Status: Testing
Repository: extra
Requires: linux-2.6 >= 2.6.11"

We need a 2.6 kernel

Gilles

Hi Guys/Gals,

I was wondering if it would be possible for you to include "Sip 
contrack/NAT" capability to IPCOP, some more details here:
  http://sipx-wiki.calivia.com/index.php/HowTo_configure_iptables

I have been considering options for SIP and come across the sipx project, 
but it looks like they push Astaro Security Linux as one of the products to 
use.

I have a software phone and need to be able to use a STUN server for some 
accounts, not all accounts have a STUN server available... in the past I 
have considered Asterisk @ Home, but I think that SIPX might be a better 
solution  for SIP.  Anyway, I am also thinking that if we had "Sip 
contrack/NAT" capability, then my Xten software phone might work properly 
for all call types [incoming without a STUN server] -- outgoing already 
works fine.

Kind Regards

AndrewM

Andrew McGlashan
Broadband Solutions now including VoIP 1300 85 3804

Mobile: 04 2574 1827 Fax: 03 8790 1224

Affinity Vision Australia Pty Ltd
www.affinityvision.com.au
www.affinityvision.net/adsl/

In Case of Emergency --  http://www.affinityvision.com.au/ice.html 

Le Dimanche 26 F=E9vrier 2006 02:24, Trevor Forbes a =E9crit=A0:
> Subversion client does not work with ipcop proxy turned on.
>
> example:
> svn co http://svn.xxxxx.de/xgl-overlay portage-xgl
> svn: REPORT request failed on '/xgl-overlay/!svn/vcc/default'
> svn: REPORT of '/xgl-overlay/!svn/vcc/default': 400 Bad Request
> (http://svn.xxxxx.de)
>
> If I turn proxy off then the svn client works.
>
> >From what I have read in the FAQ
>
> "you need to make sure the proxy server itself support all the HTTP
> methods Subversion uses. Some proxy servers do not support these methods
> by default: PROPFIND, REPORT, MERGE, MKACTIVITY, CHECKOUT. "
>
> Apparently this can be fixed as follows in squid.conf, however, I was
> not sure which is the correct file to test the fix?
>
> #  TAG: extension_methods
> #       Squid only knows about standardized HTTP request methods.
> #       You can add up to 20 additional "extension"
> #       methods here.
> #
> #Default:
> # none
> extension_methods REPORT MERGE MKACTIVITY CHECKOUT PROPFIND
>
> Trevor
>

It is included in 1.4.11 (was an RFE)

=46ranck

Subversion client does not work with ipcop proxy turned on.

example:
svn co http://svn.xxxxx.de/xgl-overlay portage-xgl
svn: REPORT request failed on '/xgl-overlay/!svn/vcc/default'
svn: REPORT of '/xgl-overlay/!svn/vcc/default': 400 Bad Request
(http://svn.xxxxx.de)

If I turn proxy off then the svn client works.

From what I have read in the FAQ
"you need to make sure the proxy server itself support all the HTTP
methods Subversion uses. Some proxy servers do not support these methods
by default: PROPFIND, REPORT, MERGE, MKACTIVITY, CHECKOUT. "

Apparently this can be fixed as follows in squid.conf, however, I was
not sure which is the correct file to test the fix?

#  TAG: extension_methods
#       Squid only knows about standardized HTTP request methods.
#       You can add up to 20 additional "extension"
#       methods here.
#
#Default:
# none
extension_methods REPORT MERGE MKACTIVITY CHECKOUT PROPFIND

Trevor

Bugs item #1436903, was opened at 2006-02-22 13:44
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1436903&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Michael Berg (mberg22)
Assigned to: Nobody/Anonymous (nobody)
Summary: Statefull FW not working with browsers correctly

Initial Comment:
I installed ipcop wiht a red, green, blue config and 
from the green rail tried to surf.  When I went to 
very simple html based sites everything was ok. But 
when I went to very complex ones things started 
hanging. This happened with proxy turned on and off.  
At the same time I purcahsed a new linksys with 
statfull firewall built in and it did the same thing 
of couse I tested with and with out IPCOP in the mix.  
I then flashed the latest image to the linksys and it 
was happy with complex sites.  After reading a number 
threads I'm guessing its the way IPCOP is processing 
all those packets comming back. It's almost like its 
forgetting about the other sites that are HREF'ed to 
for images and adds etc.  Has anyone else had issues 
browsing complex websites when going thru IP COP? 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1436903&group_id=40604

Bugs item #1436828, was opened at 2006-02-22 10:52
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1436828&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: VPN
Group: 1.4.10
Status: Open
Resolution: None
Priority: 5
Submitted By: BillK (bill_klumper)
Assigned to: Nobody/Anonymous (nobody)
Summary: W/ PSK/Cert RW Not  create PSK based RW

Initial Comment:
IPCOP 1.4.11 and 1.4.10 and related to 1350343

Clean Installs. PII400 with 768mb Ram Compaq DP6400

When using the WebUI to add a new Road warrior 
configuration and I have already created a road 
warrior and the first Road Warrior that was created 
by doing the generate certificate  Host(Certificate) 
I will get the following Error Message when I attempt 
to create a new Road Warrior using PSK.

"You can only define one Roadwarrior connection when 
using pre-shared key authentication."

In this case I have no Road warrior Connections 
created with PSK just Host Certificate. 

This is the case even if you have one that has been 
created with Host(Certificate) as a Roadwarrior 
connection.

You will get the same message if you try to add new 
PSK road warrior connection and the first RW 
connection is a PSK connection.

I can create multiple certificate based RWs with out 
any difficulty

With respect to the first observed issue, I have 
looked in my ipsec.conf and posted it below and have 
no other connections defined with PSK and I have  
only ne RW connection defined. When I attempt to 
create a new connection that is PSK based and I have 
already one defined as Host(Certificate) that is 
where the error message happens.

On a side note which this may give us a clue as to 
the problem.

I cannot get the Connection to work with the RSASIG 
for the RW connection that uses Host(Certificte) 

I get an error essage indicating that the "no 
connection had been authorized with RSASIG."  

THis is what the certificate shows for the host.pem
Signature Algorithm: md5WithRSAEncryption

The client certificate
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: md5WithRSAEncryption

Root Certificate
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a4:e4:cf:da:86:e7:c7:57
        Signature Algorithm: md5WithRSAEncryption

host Certificate
   Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: md5WithRSAEncryption


The clock is synchronized each day and I have a valid 
time server and the NTP Log shows successful Sync. I 
synced time prior to doing anyting with the VPN 
configuration.

I am on a fixed IP address on all connections with 
DNS entries at my ISP.

Client Trying to Connect is Linsys. Machine is 
Windows 2000, SP4

The certificate appears to be fine for the client. It 
can be imported into IE and I have used it in 
application which can create and generate encrypted 
emails that can be decrypted by the local mta.

The log file from last night show the following error 
messages showing the RSASIG error message

21:45:15 pluto[3166] packet from x8.13.xx.xx:500: 
ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00 
000002] 
21:45:15 pluto[3166] packet from x8.13.xx.xx:500: 
ignoring Vendor ID payload [FRAGMENTATION] 
21:45:15 pluto[3166] packet from x8.13.xx.xx:500: 
received Vendor ID payload [draft-ietf-ipsec-nat-t -
ike-02_n] 
21:45:15 pluto[3166] packet from x8.xx.xx.xx:500: 
initial Main Mode message received on 
63.160.255.3 :500 but no connection has been 
authorized with policy=RSASIG 

I went ahead and did a full reset and deleted all 
existing certificates via the webui and started all 
over with the VPN connections.   It seem to show a 
successful start.

Starting Pluto (Openswan Version 1.0.10) 
08:55:36 pluto[29937] including X.509 patch with 
traffic selectors (Version 0.9.42) 
08:55:36 pluto[29937] including NAT-Traversal patch 
(Version 0.6) 
08:55:36 pluto[29937] | inserting event 
EVENT_REINIT_SECRET, timeout in 3600 seconds 
08:55:36 pluto[29937] ike_alg_register_enc(): 
Activating OAKLEY_AES_CBC: Ok (ret=0) 
08:55:36 pluto[29937] ike_alg_register_enc(): 
Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0) 
08:55:36 pluto[29937] ike_alg_register_enc(): 
Activating OAKLEY_CAST_CBC: Ok (ret=0) 
08:55:36 pluto[29937] ike_alg_register_enc(): 
Activating OAKLEY_SERPENT_CBC: Ok (ret=0) 
08:55:36 pluto[29937] ike_alg_register_hash(): 
Activating OAKLEY_SHA2_256: Ok (ret=0) 
08:55:36 pluto[29937] ike_alg_register_hash(): 
Activating OAKLEY_SHA2_512: Ok (ret=0) 
08:55:36 pluto[29937] ike_alg_register_enc(): 
Activating OAKLEY_TWOFISH_CBC: Ok (ret=0) 
08:55:36 pluto[29937] ike_alg_register_enc(): 
Activating OAKLEY_SSH_PRIVATE_65289: Ok (ret=0) 
08:55:36 pluto[29937] | inserting event 
EVENT_SHUNT_SCAN, timeout in 120 seconds 
08:55:36 pluto[29937] Changing to 
directory '/etc/ipsec.d/cacerts' 
08:55:36 pluto[29937] loaded cacert file 'cacert.pem' 
(1801 bytes) 
08:55:36 pluto[29937] Changing to 
directory '/etc/ipsec.d/crls' 
08:55:36 pluto[29937] loaded crl file 'cacrl.pem' 
(739 bytes) 
08:55:36 pluto[29937] | cacert list locked 
by 'insert_crl' 
08:55:36 pluto[29937] | crl issuer cacert found 
08:55:36 pluto[29937] | cacert list unlocked 
by 'insert_crl' 
08:55:36 pluto[29937] | crl signature is valid 
08:55:36 pluto[29937] | crl list locked 
by 'insert_crl' 
08:55:36 pluto[29937] | crl list unlocked 
by 'insert_crl' 
08:55:36 pluto[29937] OpenPGP certificate 
file '/etc/pgpcert.pgp' not found 
08:55:36 pluto[29937] | next event EVENT_SHUNT_SCAN 
in 120 seconds 
Older 

my ipsecrets files show the following entry
: RSA /var/ipcop/certs/hostkey.pem

here is my ipsec.conf
config setup

	interfaces=%defaultroute
	klipsdebug=none
	plutodebug="crypt control dns nat_t "
	plutoload=%search
	plutostart=%search
	uniqueids=yes
	nat_traversal=yes
	virtual_private=%v4:10.0.0.0/8,%
v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!
10.0.0.0/255.255.255.0

conn %default
	keyingtries=0
	disablearrivalcheck=no
        conn myvsion
	left=home.xxxxxx.net
	leftnexthop=%defaultroute
	leftsubnet=10.0.0.0/255.255.255.0
	leftcert=/var/ipcop/certs/hostcert.pem
	right=%any
	rightsubnet=vhost:%no,%priv
	rightcert=/var/ipcop/certs/myvsioncert.pem
	ike=aes128-sha-modp1536,aes128-sha-
modp1024,aes128-md5-modp1536,aes128-md5-modp1024,3des-
sha-modp1536,3des-sha-modp1024,3des-md5-modp1536,3des-
md5-modp1024
	esp=aes128-sha1,aes128-md5,3des-sha1,3des-md5
	ikelifetime=1h
	keylife=8h
	dpddelay=30
	dpdtimeout=120
	dpdaction=clear
	pfs=yes
	authby=rsasig
	auto=add


The connection is via high speed and the at the road 
warrior end the fw is an IPCOP 1.4.10 box.

Any help would be appreciated.  I am willing to allow 
for developer access to this fw machine and can use 
such remote tools as webex to work from windows UI to 
show you what the web is is reporting

Only other addon to this box is copfilter by Marcus.

Thanks for the great product.

wk

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1436828&group_id=40604

Feature Requests item #1436381, was opened at 2006-02-21 22:58
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1436381&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Priority: 5
Submitted By: Stewart Baker (bakers)
Assigned to: Nobody/Anonymous (nobody)
Summary: Opportunistic Encryption

Initial Comment:
Hi,
   would be very interested in seeing opportunistic
encryption capability built into IPCOP.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1436381&group_id=40604

Feature Requests item #1435709, was opened at 2006-02-21 13:24
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1435709&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: Next Release (example)
Status: Open
Priority: 5
Submitted By: Sameer (samgurung)
Assigned to: Nobody/Anonymous (nobody)
Summary: Multiple Red Interfaces

Initial Comment:
Hi 

Multiple red interfaces support with load balancing and
failover would be a great addition to IPCOP. I think a
lot of users would benefit from this. This is one
feature sorely lacking in an otherwise great product
and I hope this will be added in the next release. 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1435709&group_id=40604

Feature Requests item #1435409, was opened at 2006-02-20 16:55
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1435409&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Priority: 5
Submitted By: Ricardo E. Carraretto (riccar)
Assigned to: Nobody/Anonymous (nobody)
Summary: Openswan2.x support

Initial Comment:
Hello,

Since Jan, 1st, 2006, Openswann 1.x is no longer being 
supported. It would be nice to se a patch to IPCOP 
1.4.10 with the new, improved and supported Openswan 
2.x.

Thanks
Ricardo

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1435409&group_id=40604

Bugs item #1435385, was opened at 2006-02-20 20:03
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1435385&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: burd (burdlaz)
Assigned to: Nobody/Anonymous (nobody)
Summary: unable to update ipcop v1.2

Initial Comment:
unable to update ipcop v1.2

1. Server: www.ipcop.org
2. URL path: /cgi-bin/twiki/view/IPCop/IPCopDownload
3. Error notes: script not found or unable to stat:
/home/groups/i/ip/ipcop/cgi-bin/twiki
4. Error type: 404
5. Request method: GET
6. Request query string:
7. Time: 2006-02-20 10:36:16 PST (1140460576)

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1435385&group_id=40604

Feature Requests item #1434944, was opened at 2006-02-20 10:14
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1434944&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: Next Release (example)
Status: Open
Priority: 5
Submitted By: Vikrant Rathore (vikrantrathore)
Assigned to: Nobody/Anonymous (nobody)
Summary: Load balancing and failsafeover

Initial Comment:
since ipcop has Linux Advanced Router it can be made to
do load balancing and fail safeover easily just need an
simple interface.

Another way to do it is using balance a very easy
userland command http://www.inlab.de/balance.html

Do not know if anyone is interested but it could prove
a big boost for ipcop.




----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1434944&group_id=40604

Feature Requests item #1433721, was opened at 2006-02-17 18:25
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1433721&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Priority: 5
Submitted By: Pietro Santoro (psantoro)
Assigned to: Nobody/Anonymous (nobody)
Summary: Add Multicast Forwarding/Routing feature

Initial Comment:
I need to forward multicast packets from red to green
network (for multicast video streaming). But
CONFIG_IP_MULTICAST isn't setted in kernel. Is there
another solution for this?

thanks
Pietro

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1433721&group_id=40604