1

I have an Ubuntu 14.04 server running some services on different ports. I used to be able to connect to it (via SSH, samba, and a couple web servers on different ports) using a VPN.

I'll use ssh as an example, but this happens with every port.

When I am trying to connect from within my LAN, everything works fine, but when trying to reach it from my VPN nothing happens (the box gets the tcp packets but not the services listening the ports).

  • I can connect to other boxes on the network, so I know the VPN works fine.

  • I can also connect to my box within the network, so I also know ssh (and all other services) is up and listening.

Netstat:

$ netstat -ntple 
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode       PID/Program name 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          479         -               
  • I also used tshark to verify that the box is getting something, so I know the routers are working fine.

Output:

$ sudo tshark -i rename2 port 22
Capturing on 'rename2'
1   0.000000 172.17.11.165 -> 10.11.50.93  TCP 74 37478 > ssh [SYN] Seq=0 Win=65535 Len=0 MSS=1360 SACK_PERM=1 TSval=51759576 TSecr=0 WS=256
1   2   3.706230 172.17.11.165 -> 10.11.50.93  TCP 74 41261 > ssh [SYN] Seq=0 Win=65535 Len=0 MSS=1360 SACK_PERM=1 TSval=51760681 TSecr=0 WS=256
2   3   4.697915 172.17.11.165 -> 10.11.50.93  TCP 74 [TCP Retransmission] 41261 > ssh [SYN] Seq=0 Win=65535 Len=0 MSS=1360 SACK_PERM=1 TSval=51760982 TSecr=0 WS=256
3   4   6.730708 172.17.11.165 -> 10.11.50.93  TCP 74 [TCP Retransmission] 41261 > ssh [SYN] Seq=0 Win=65535 Len=0 MSS=1360 SACK_PERM=1 TSval=51761584 TSecr=0 WS=256
4   5  10.697776 172.17.11.165 -> 10.11.50.93  TCP 74 [TCP Retransmission] 41261 > ssh [SYN] Seq=0 Win=65535 Len=0 MSS=1360 SACK_PERM=1 TSval=51762788 TSecr=0 WS=256
  • I also added/removed rules from the firewall and disabled/restarted ufw with no success

  • Also checked my iptables and nothing looks out of place.

Iptables:

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
ACCEPT     udp  --  anywhere             anywhere             multiport dports mdns
ACCEPT     tcp  --  anywhere             anywhere             multiport dports 4000
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DOCKER-ISOLATION  all  --  anywhere             anywhere            
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (1 references)
target     prot opt source               destination         

Chain DOCKER-ISOLATION (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere 

I'm running out of ideas about what might be broken here. The problem appeared few days ago when installing Docker via ssh with $ curl -fsSL https://get.docker.com/ | sh, the ssh connection closed half way trough the installation and couldn't connect anymore. My guess is that the system might have been updated in some way and when docker installed it's network components something got broken. Still can't find what.


netstat -nr -4 output:

$ netstat -nr -4
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.11.50.1      0.0.0.0         UG        0 0          0 rename2
10.0.3.0        0.0.0.0         255.255.255.0   U         0 0          0 lxcbr0
10.11.50.0      0.0.0.0         255.255.255.0   U         0 0          0 rename2
172.17.0.0      0.0.0.0         255.255.0.0     U         0 0          0 docker0

ifconfig output:

 $ ifconfig
 docker0   Link encap:Ethernet  HWaddr 02:42:06:f0:a2:16  
           inet addr:172.17.0.1  Bcast:0.0.0.0  Mask:255.255.0.0
           UP BROADCAST MULTICAST  MTU:1500  Metric:1
           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
           TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

 eth6      Link encap:Ethernet  HWaddr 8c:dc:d4:2c:24:b6  
           UP BROADCAST MULTICAST  MTU:1500  Metric:1
           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
           TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000 
           RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
           Interrupt:20 Memory:d3300000-d3320000 

 lo        Link encap:Local Loopback  
           inet addr:127.0.0.1  Mask:255.0.0.0
           inet6 addr: ::1/128 Scope:Host
           UP LOOPBACK RUNNING  MTU:65536  Metric:1
           RX packets:8329 errors:0 dropped:0 overruns:0 frame:0
           TX packets:8329 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:1311610 (1.3 MB)  TX bytes:1311610 (1.3 MB)

 lxcbr0    Link encap:Ethernet  HWaddr 02:2f:b6:06:aa:d6  
           inet addr:10.0.3.1  Bcast:0.0.0.0  Mask:255.255.255.0
           inet6 addr: fe80::2f:b6ff:fe06:aad6/64 Scope:Link
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
           TX packets:785 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:0 (0.0 B)  TX bytes:222126 (222.1 KB)

 lxdbr0    Link encap:Ethernet  HWaddr fe:21:66:ba:91:98  
           inet6 addr: fe80::1/64 Scope:Link
           inet6 addr: fe80::3007:bfff:fe70:8407/64 Scope:Link
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:14 errors:0 dropped:0 overruns:0 frame:0
           TX packets:31 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:968 (968.0 B)  TX bytes:6130 (6.1 KB)

 rename2   Link encap:Ethernet  HWaddr 8c:dc:d4:2c:24:b7  
           inet addr:10.11.50.93  Bcast:10.11.50.255  Mask:255.255.255.0
           inet6 addr: fe80::8edc:d4ff:fe2c:24b7/64 Scope:Link
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:312920 errors:0 dropped:0 overruns:0 frame:0
           TX packets:33140 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000 
           RX bytes:51883472 (51.8 MB)  TX bytes:6473301 (6.4 MB)
           Memory:d3100000-d3180000 

 vethD4RBEX Link encap:Ethernet  HWaddr fe:21:66:ba:91:98  
           inet6 addr: fe80::fc21:66ff:feba:9198/64 Scope:Link
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:14 errors:0 dropped:0 overruns:0 frame:0
           TX packets:64 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000 
           RX bytes:1164 (1.1 KB)  TX bytes:11813 (11.8 KB)
4
  • Can you add output of ifconfig and netstat -nr -4 to your question ?
    – daniel
    Apr 30, 2016 at 20:08
  • @daniel Sure, I just did (the network device is rename2).
    – ButterDog
    Apr 30, 2016 at 20:14
  • If you don't use docker try ˋsudo ifdown docker0` and try connecting with your vpn.
    – daniel
    Apr 30, 2016 at 20:56
  • @daniel Woo it works, I deleted docker0 and it works normally. Feel free to post this as an answer. Thanks.
    – ButterDog
    Apr 30, 2016 at 21:11

1 Answer 1

2

Looking at your tshark capture and your routing table. I supposed that your vpn network is using the same subnet as the docker0 interface.

This will shutdown the docker0 interface:

sudo ifdown docker0

But the problem will come back after a reboot. To properly fix it you should remove docker, or change subnet settings of docker, or change your vpn subnet settings.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .