Cisco VPN Client

synack1337 · n00b Joined: 17 Mar 2004 Posts: 5

othrer than a workaround, sadly no.

I was able to get proper checksum'd udp packets by compiling iptables into the kernel and doing an any any outbound rule. and everything works now.

I guess this should be mentioned to one of the maintainers for either the net code or driver code for 3c59x on 2.6.x. Not sure of the best way to go about it..

-"snizack"

kamilian · Posted: Thu Apr 01, 2004 12:22 pm Post subject:

On the topic of the Cisco VPN Client, has anyone else had this problem show up? Better yet, anyone know how to fix it? (The best I could find for something similar was to install lib-compat and I have lib-compat-1.3 installed).

X-Frog · Posted: Wed Apr 07, 2004 2:25 pm Post subject:

synack1337 · n00b Joined: 17 Mar 2004 Posts: 5

Glad it worked for you.

Now we need to get this in front of of a maintainer so we dont need iptables.

blscreen · Posted: Thu Apr 08, 2004 3:10 am Post subject:

Because of the problems with the Cisco VPN client and recent kernels I switched to the opensource client vpnc. It uses the kernel TUN/TAP device and works great for me.

theche · Guru Joined: 26 Feb 2004 Posts: 512

where's the option for enabling the TUN/TAP device driver??

blscreen · Posted: Fri Apr 16, 2004 11:19 am Post subject:

In 2.6.x:
Device Drivers -> Networking support -> Network device support -> Universal TUN/TAP device driver support

theche · Guru Joined: 26 Feb 2004 Posts: 512

blscreen · Posted: Sat Apr 17, 2004 8:53 am Post subject:

Seems like some dependency problem. Try to first emerge sync, reemerge dev-libs/libgcrypt and then net-misc/vpnc.

libgcrypt should have been merged together with vpnc though.

theche · Guru Joined: 26 Feb 2004 Posts: 512

exactly...

didn't work

same error.

should I start vpnc as root or as an user? whe doing so:

blscreen · Posted: Sat Apr 17, 2004 8:52 pm Post subject:

This doesn't seem to be related to any of the errors you receive, but I just tried vpnc on a gentoo box the first time (the other was debian), and devfsd made a wrong symlink /dev/net/tun->/dev/net/misc/net/tun which doesn't exist and should be /dev/misc/net/tun instead.

If this is true for you, you should add the following lines early in your /etc/devfsd.conf end send a SIGHUP to devfsd:

theche · Guru Joined: 26 Feb 2004 Posts: 512

eigentlich könnten wir deutsch reden...oder?

I dont't know whether there is a symlink...the directory net in /dev/ doesn't exist...and in /dev/misc/ there is no directory net...perhaps I messed something up with the TUN/TAP device driver??

blscreen · Posted: Sun Apr 18, 2004 5:06 pm Post subject:

theche · Guru Joined: 26 Feb 2004 Posts: 512

Universal TUN TAP driver is in the kernel (no module)

in dmesg appears the corresponding entry

yes, I do use devfs

LostControl · Posted: Tue Apr 20, 2004 6:23 pm Post subject:

Has anyone tried to use cisco-vpnclient-3des-4.0.3b-r3 with kernel 2.6.6-rc1 ?

Everything works using kernel 2.6.5 but no success with 2.6.6-rc1

Maybe something changes in the new kernel which brokes cisco-vpnclient-3des !? As for 2.6.2...

Corpse2 · n00b Joined: 14 Jan 2004 Posts: 60

I managed to get the vpnclient-linux-4.0.3.B-k9.tar.gz working on my 2.6.5-rc1 kernel.

I think it's the patched version metioned before.
Only one problem, I don't know why it works all of a sudden while it wouldn't work at first. :oops:

I've been fooling around first with a few different versions and vpnc without luck. But there is one thing I remember that I did: I found somewhere in another tread something about which things are needed in the kernel, some things in cryptography that are needed by IPsec and some other things.

vdp · n00b Joined: 10 Apr 2004 Posts: 15

kevin_barsby · n00b Joined: 23 Apr 2004 Posts: 50 Location: UK

Firstly I'm a noob to Gentoo forums so please forgive any lapses of netiquette.

I've just emerged the latest (4.0.3.B) ebuild of vpnclient and apart from having to rebuild the digest it compiled and installed ok.

I seem to be having the DNS problem some people have mentioned, i.e. I can run the module and connect quite happily, but couldn't get anywhere on the network, I tried pinging the machine I was connected to and that seemd ok, I guess if I'd tried going elsewhere on the network by ip address only that would have worked too.

How have people got around this problem? I read somewhere compiling in IP tables and creating an ANY->ANY rule would fix this, is this still people's favoured solution.

Cheers
Kev

kevin_barsby · n00b Joined: 23 Apr 2004 Posts: 50 Location: UK

I spent a frustrating morning trying various solutions on this and other forums. The upshot is everything I tried seemed to take a step back from where I am currently.

I have:
Kernel - 2.6.5
vpnclient - 4.0.3-B-K9 (vanilla patched via the Gentoo ebuild)

It starts, connects quite happily but DNS seems to be broken. Everything is fine by IP address.

Current workaround is to lob all the servers I need into /etc/hosts

The solutions / workarounds I've tried are:
- Compiling in iptables and setting up ANY->ANY OUTPUT rule: This resulted in the situation where the module would load, but any attempt to connect failed, module seems to hang for a bit then times out
- Various Kernel switches (I didn't have the IPSEC stuff in the kernel, I do now) : Made no difference
- Regressing to Kernel 2.6.1: No difference

I haven't tried a 2.4 kernel yet, but that is going to require a system rebuild which I don't really have time for ATM.

Has anyone got any suggestions?

AlterEgo · Veteran Joined: 25 Apr 2002 Posts: 1619

I'm trying to get net-misc/cisco-vpnclient-3des-4.0.3b-r4
working on 2.6.6.
i get stuck at: /etc/init.d/vpnclient start
* Starting Cisco VPN Client...
* Failed to load module cisco_ipsec

Can someone give me a lsmod of the modules needed?

[edit]
Just tested in 2.6.5: it does work there :?:

Berni · n00b Joined: 25 Aug 2003 Posts: 71

What does dmesg tell (or your syslog)? Did you enable the crypt modules+tun modules in your kernel config?

kevin_barsby · n00b Joined: 23 Apr 2004 Posts: 50 Location: UK

I noticed in the new 2.6.6 kernel changelog there are some patches to crc related stuff from people whose email address reads (@cisco.com).

I haven't tried it yet, but I'll post here if it fixes the dns problem

enkil · Posted: Thu May 13, 2004 8:54 pm Post subject:

@AlterEgo: I had the same problems using Kernel 2.6.6, too, but I use vpnclient-version 4.0.4(A).
Problem seems to be the following code in the init-script:

AlterEgo · Veteran Joined: 25 Apr 2002 Posts: 1619

That did not help me :cry:

/lib/modules/2.6.6/CiscoVPN/cisco_vpn is not a .ko file after emerging.
I also cannot get the modules insmodded manually.
I use the same config as 2.6.5, where it works flawlessly.

enkil · Posted: Fri May 14, 2004 8:40 am Post subject:

I think it should be a .ko-file...