| View previous topic :: View next topic |
| Author |
Message |
f.kater
Guru
Joined: 23 May 2002
Posts: 342
Location: Berlin
|
 Posted: Tue Sep 02, 2003 6:54 pm Post subject: howto: pppd closes connection even with incoming traffic now |
 |
|
Hi,
there seem to be very little topics dealing with active-filter here and what it is good for. I thought I would just describe my experience:
I've got a DSL router running with dial on demand and a timeout of 600 seconds (/etc/ppp/pppoe.conf: DEMAND=600). There is also a firewall (iptables) blocking unallowed input packages.
The problem: Due to large amounts of unrequested incoming packages pppd never terminates the connection. Check your /var/log/syslog (if you log these kind of packages with iptables). It's surprising.
To make the timer count only outgoing traffic and ignore incoming do the following:
(1) Check if your kernel has set CONFIG_PPP_FILTER=y in /usr/src/linux/.config. If not you have to recompile the kernel.
(2) emerge libpcap
(3) Add "activefilter" to your USE var. This will compile ppp with active-filter option.
(4) emerge ppp. If you have it already, do it again.
(5) Add this line to /etc/ppp/options:
| Code: |
active-filter 'outbound and not icmp[0] == 3 and not tcp[13] & 4 != 0'
|
So, now pppd closes the connection after 600 seconds as it should even if there was incoming unwanted traffic in the meantime. |
|
| Back to top |
|
 |
FallenAngel
n00b
Joined: 29 Sep 2004
Posts: 51
|
| Posted: Wed Sep 29, 2004 3:02 pm Post subject: |
|
|
| Seems you need libpcap-0.7.2, because newer versions no longer support 'outbound' on ppp devices |
|
| Back to top |
|
|
f.kater
Guru
Joined: 23 May 2002
Posts: 342
Location: Berlin
|
| Posted: Tue Oct 05, 2004 9:58 am Post subject: |
|
|
True. (And on that machine I even use a kernel version 2.4.x.)
However, how can we upgrade to libpcap-8.x and use outbound filter nevertheless?
Is it true that with newer kernels (>2.6.5) and libpcap-8.x we can set an outbound filter in the kernel again? Did anyone get it to run again? |
|
| Back to top |
|
|
|
Networking & Security
