**** BEGIN LOGGING AT Sun May 23 02:59:57 2010 May 23 08:02:12 o/ May 23 08:03:44 hey lbt May 23 08:03:51 morning :) May 23 08:08:13 morn lbt May 23 08:11:08 * lbt is digging in kerberos/nfs4 this morning.... May 23 08:12:05 it should be easier than this ;) May 23 08:13:42 your internal network being kerberos and nfs4? :P May 23 08:13:53 *nod* ... nearly May 23 08:13:56 and ldap May 23 08:13:58 :) May 23 08:14:06 what could possibly go wrong? May 23 08:17:45 I read that "ntfs" for a second May 23 08:17:55 eek May 23 08:18:14 had to doublecheck after your last question (: May 23 08:18:52 trust me, there's enough caveats around krb5/nfs4 ... May 23 08:18:59 * Stskeeps should set up vpn for his home network. May 23 08:19:23 kinda neat though.... and I would like to use krb5 on maemo.org and meego.com May 23 08:19:33 Stskeeps: openvpn is nice May 23 08:19:48 * thiago_home likes openvpn May 23 08:19:50 and the little n900 applet is just..... mmmm May 23 08:20:08 it's easy to set up, pretty secure, and works through most NATs May 23 08:20:08 also has to be proxy friendly since when i use it abroad, i'm often behind :P May 23 08:20:41 proxies usually require TCP connections May 23 08:20:50 openvpn can do it, but IP-over-TCP is a bad idea May 23 08:20:52 best bet is to use 443 May 23 08:21:43 you *can* setup 2 openvpn services to the same vlan... one tcp, one udp but I wouldn't start there :) May 23 08:22:37 * thiago_home needs to use port 443 for other things May 23 08:23:16 openvpn on Maemo5, however, doesn't add the routes it should May 23 08:23:42 I think the wiki notes how to fix that May 23 08:34:48 lbt: did you ever get policy routing to work with openvpn? like use a computer on the network as a gateway without losing local network connectivity? May 23 08:36:03 on the N900? May 23 08:36:15 on linux May 23 08:36:36 mmm May 23 08:36:38 yes May 23 08:38:02 I use my laptop in hotels with both internet and home lan May 23 08:38:36 I just continually get locked out of the local network when messing with ip rule May 23 08:39:17 mmm, sounds like a routing conflict May 23 08:40:28 your vpn server config possibly? May 23 08:40:57 well this was on the server side May 23 08:41:12 trying to dual home but also serve as a gateway through the vpn May 23 08:41:56 so I had two networks connected through vpn, tried both openvpn and ipsec/strongswan May 23 08:42:02 my firewall has : ppp0/eth0/tun0 May 23 08:43:40 ppp0=internet eth0=10.0.0.0/24 tun0=10.20.20.0/24 May 23 08:44:03 but you have the internet uplink on the same machine as the ipsec/openvpn gateway? May 23 08:44:16 my problem is I'm trying to use this with an existing (ddwrt) router May 23 08:44:21 but run the vpn on a x86 pc May 23 08:46:28 so are you NATing into tun0 May 23 08:47:09 well I was hoping just to ip route 172.16.0.0/16 via 192.168.1.x which is the vpn gateway May 23 08:47:25 in any case it didn't know how to route the packets through tun May 23 08:47:48 so you were going to ask the internet nicely if you could have traffic for 172.16.0.0/16 ? :) May 23 08:47:56 no May 23 08:48:23 so how would a client "out there" connect to the x86 box? May 23 08:48:40 I was bridging two networks over vpn May 23 08:48:49 not the road warrior case May 23 08:49:08 so your x86 connected to 2 vpns May 23 08:49:24 there was an x86 box on each end of the vpn May 23 08:49:33 OK... May 23 08:49:48 I understand now May 23 08:50:09 so you need to bridge tun0/tun1 not route... May 23 08:50:24 so my uv network had 172.16.2.x/24 and my fn network had 192.168.1.x/24 May 23 08:50:52 yeah, that seemed to be an option but adding the interface to the bridge lost ssh connectivity with the box which I'm connected remotely to May 23 08:51:11 No, I think you want to route from A to B via a host X May 23 08:51:16 I'm trying to understand why linux policy routing wouldn't work, why I need bridging in the first place May 23 08:51:20 yes May 23 08:52:03 so you need to define X.b as a route for A on nw B and X.a as a route for B on nw A May 23 08:52:17 X.b is the tun on nw B May 23 08:52:28 X cannot do this May 23 08:53:07 typically a DHCP server on B would set a default route and the default route would know that X.b is the route for B May 23 08:53:20 what I was trying to do is if the packet is for dest 172.16.2.x send it through tun0, other wise send it to 192.168.1.1 over eth0 May 23 08:53:45 do this on both ends and then a ping should work, but it doesn't May 23 08:53:47 that would happen 'naturally' May 23 08:54:02 obviously the box I'm pinging on both ends needed the return route through the vpn gateway May 23 08:54:20 hold on... "both ends" ? May 23 08:54:40 to get full connectivity I should be able to ping a box on either network May 23 08:54:52 from any box on either network that had the proper routes May 23 08:55:13 OK, as you say things my mental image of your topology has to adapt May 23 08:55:53 you have 2 networks A and B May 23 08:55:58 yes May 23 08:56:12 one of them, B, has an openvpn server May 23 08:56:21 yes May 23 08:56:37 that is set to offer B to clients May 23 08:56:45 yes May 23 08:56:53 that server runs in bridge mode May 23 08:56:56 it has to May 23 08:57:03 both eth0 and tun0 are on B May 23 08:57:29 on A you have a vpn client (X) to B May 23 08:57:42 X has eth0 on A and tun0 on B May 23 08:57:46 X is a router May 23 08:57:57 right May 23 08:58:21 when X can ping anything on A and anything on B then your VPN works May 23 08:58:39 yes May 23 08:59:07 then you need to tell the clients on A that X is the route for B May 23 08:59:08 the problem is A and B each have an internet gateway that is not the same box as the vpn gateway, connected by a switch May 23 08:59:17 yes May 23 08:59:32 "connected by a switch" May 23 08:59:40 on the same ethernet network May 23 08:59:43 hold on... May 23 08:59:54 in a sane setup... :) May 23 09:00:19 you'd tell the default router on A that X was the route to B May 23 09:00:27 and the default router on B that X was the route to A May 23 09:00:31 however.... May 23 09:01:04 if the default routers already think they have routes to A and B then you may have an issue May 23 09:01:20 at that point you need to weight the routes May 23 09:02:05 but I want to put those weighted routes on all the machines on A and B and not on the routers May 23 09:02:41 no need May 23 09:03:03 the machines will send to the router which will redirect to a different IP on the same LAN May 23 09:03:19 okay, that makes sense May 23 09:03:30 :) May 23 09:04:01 so the packets go from a box to the gateway which looks up the static route to the vpn gateway, get encapsulated and go back to the gateway? May 23 09:04:13 not quite May 23 09:04:48 box->gw and the gateway says "not me, you want X"... May 23 09:04:51 box->X May 23 09:05:01 what protocol is that? May 23 09:05:06 IP May 23 09:05:32 didn't know there was a control message that did that May 23 09:06:07 I don't think it's RIP but it might be May 23 09:06:44 why do I need a routing protocol if I have a static route? May 23 09:07:16 or you can setup static routes on every machine on A and B May 23 09:07:30 do you use a hosts file or DNS ? May 23 09:07:37 hosts/static May 23 09:07:46 fair enough then :) May 23 09:07:49 there aren't that many machines on either network May 23 09:08:16 *nod* ... wasn't sure ... in general you'd use the same approach I think May 23 09:08:23 this still doesn't explain why linux isn't consulting the rpb when it receives a packet May 23 09:08:43 rpb? May 23 09:09:18 if my gateway has the static route to the remote network it would have to be routing the packets May 23 09:09:24 rpdb sorry May 23 09:10:12 if you have 2 routes from A to B then yes you need to weight them May 23 09:10:57 if briding eth0/tun0 works then I just add those to /etc/network/interfaces (all ubuntu matchines) and it should work? May 23 09:11:05 so no ip rule stuff May 23 09:11:29 there is no iptables May 23 09:11:44 but you may use the ip command to do "ip route add" May 23 09:11:52 only on the gateway, and ipsec uses iptables but openvpn doesn't May 23 09:12:21 yeah, no iptables May 23 09:12:48 that's vpn-implementation specific.... ignoring that, no other machines need iptables May 23 09:12:54 right May 23 09:15:24 biab.. painting... good luck :) May 23 14:01:05 'Morning May 23 17:07:21 lbt: it works, thanks. just needed to use a bridge on both ends and assign the vpn link ip to the br0:1 instead of tap0 May 23 17:07:53 OK - that'll work too :) May 23 17:09:38 still need a route on each device, I might try adding it on the gateway next May 23 17:39:05 what, meego already killed HAL? May 23 17:40:17 well, I guess someone had to do it first... May 23 17:41:15 so did ubuntu, didn't they? May 23 17:41:33 oh, indeed. May 23 17:47:22 lbt: how's the obs coming along? May 23 17:54:47 so, what is being used instead of HAL? May 23 17:56:03 th0br0: I think we're going to get web access RSN so we can get selected people to start to try it out May 23 17:56:16 devkit May 23 17:57:38 http://hal.freedesktop.org/docs/DeviceKit/index.html AFAIK May 23 17:57:57 but devkit is also depreciated! May 23 17:58:04 ;P now it's udev-extra May 23 17:58:09 (had to read that on wikipedia :P ) May 23 17:58:14 heh May 23 17:58:21 "DeviceKit can be considered a simple D-Bus frontend to udev" May 23 17:58:47 * lbt has kerberos and nfsv4 .... what else matters? May 23 17:59:23 * lbt wants his n900 to nfs-mount home storage via kerberos... May 23 17:59:38 Stskeeps: I hope your meego port to the n900 has nfs4 in the kernel May 23 18:02:26 i think it might May 23 21:44:02 Hi, I have trouble booting meego using my pendrive May 23 21:44:07 can anyone assist me plz? May 23 21:51:02 vnix state your problem exactly, otherwise no one will answer May 23 22:54:13 nite all, sweet dreams May 23 23:16:43 http://forums.kustompcs.co.uk/showthread.php?t=49296 May 24 00:40:37 my hard drives are 33'C, 37'C and 39'C May 24 00:43:19 i think one of my backup drives is overheating May 24 00:43:38 its gone a few hours after boot May 24 00:43:43 no message, nothing May 24 00:44:07 or its just about to die May 24 00:51:49 think i'll treat myself to a nas in the process, am low on hd space anyway May 24 01:01:34 cyas May 24 01:15:25 good morning May 24 01:44:15 Um May 24 01:44:26 What's up with the QA contact? May 24 01:52:20 w00t_, oops, duped your email. May 24 02:36:37 lbt: got what you were saying May 24 02:36:37 From 192.168.1.1: icmp_seq=2 Redirect Host(New nexthop: 192.168.1.5) May 24 02:36:38 From 192.168.1.5: icmp_seq=2 Redirect Host(New nexthop: 10.8.0.2) May 24 02:36:38 64 bytes from 172.16.2.65: icmp_seq=2 ttl=62 time=37.0 ms **** ENDING LOGGING AT Mon May 24 02:59:56 2010