nerds:~ #

31Jan/100

Search Results Blank in Windows SharePoint Services 3.0 (WSS 3.0)

Recently I experienced an issue where one of my WSS 3.0 sites stopped returning search results after having worked perfectly for a long period of time. I found that the Event Log had entries stating that the Search Gatherer service was failing.

Event Type: Warning
Event Source: Windows SharePoint Services 3 Search
Event Category: Gatherer
Event ID: 2436

The first thing I tried was just to stop and start the search service and give it some time to index again. After a day or two, I returned to see that the same issue was occurring. The next step was to focus on permissions issues, but I did not understand why something that always worked would suddenly stop, since I had not made any changes to permissions on the system. The likely issue was a recent security patch on the server.

In the SharePoint Application Management back-end, I changed the account for the Search Indexer to my own login, but even my Administrator account was unable to index the site, having received the same error messages. I decided to just access the site in the browser on my web server and received an error 401.1 loading up the site. I was unaware that the search indexer even worked in this method, but apparently it was failing because it was unable to load the FQDN (fully qualified domain name) of itself using Windows Authentication.

I then was able to find a Microsoft Support Article which stated the following:

You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or a later version

This issue occurs if you install Microsoft Windows XP Service Pack 2 (SP2) or Microsoft Windows Server 2003 Service Pack 1 (SP1). Windows XP SP2 and Windows Server 2003 SP1 include a loopback check security feature that is designed to help prevent reflection attacks on your computer. Therefore, authentication fails if the FQDN or the custom host header that you use does not match the local computer name.

There are two methods listed to fix this issue. I performed both methods by editing registry settings. The first method requires a reboot of the server. I did not want to reboot the server, but after making changes specified in method 2, the search indexer began to work, so I will assume method 2 is actually what fixed the issue.

From the Article:

Method 2: Specify host names

To specify the host names that are mapped to the loopback address and can connect to Web sites on your computer, follow these steps:

Set the DisableStrictNameChecking registry entry to 1.

Click Start, click Run, type regedit, and then click OK.

In Registry Editor, locate and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

Right-click MSV1_0, point to New, and then click Multi-String Value.

Type BackConnectionHostNames, and then press ENTER.

Right-click BackConnectionHostNames, and then click Modify.

In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.

Quit Registry Editor, and then restart the IISAdmin service.

Posted by: Brandon   Filed under: SharePoint No Comments
31Jan/100

Accessing XML using the MSDAOSP Provider on Windows Server 2008

For quite some time now, I have been using a scheduled task that executes a VBS file on my web server in order to update local weather information in a database. After porting the site to a Windows 2008 server, the scheduled task began to fail. The script is a bit out of date since the implementation of PowerShell, but there is no reason to re-write this minor script when it usually works properly.

The VBS script does the following:

1. Access current weather conditions for a zip code using the Weather.com XML data feed.
2. Save the XML to a flat file in the local directory.
3. Using the MSDAOSP Provider, connect to the XML file and open it as a record set.
4. Transform the data appropriately and insert it into a table in SQL Server which holds the current forecast.
5. Repeat for each zip code I wish to load.

The first error I encountered was "Permission Denied" even though I was an Admin user. I quickly resolved this by deleting the XML file the script was trying to overwrite, because I had previously changed the user that the script executes as.

After that error, I began to receive another error with a code of 80040E21:

Line 65 is my MSDAOSP connection string, so I assumed it was a compatibility issue with the OS. Searching the Internet for a quick fix did not return desired results, since most matches for the connection string only demonstrated how to use it.

The solution turned out to be very simple. Earlier versions Microsoft Data Access Components have been deprecated , so the Connection string was in need of a version update.

In previous versions of Microsoft Windows Server, I was able to use the following connection string:
rs.ActiveConnection = "Provider=MSDAOSP; Data Source=MSXML2.DSOControl.2.6;"

In Windows Server 2008, the connection string must be updated to the following:
rs.ActiveConnection = "Provider=MSDAOSP; Data Source=MSXML2.DSOControl.3.0;"

So for those of you who would like to see how to open the file using ADO, it is as follows:

    myXMLfile = "c:\scripts\weather.xml"
    set rs = createobject("adodb.recordset")
    rs.ActiveConnection = "Provider=MSDAOSP; Data Source=MSXML2.DSOControl.3.0;"
    rs.Open myXMLfile    'Open a recordset from the newly created file


For more information on the MSDAOSP provider and how to use it to access XML in ADO, visit this Microsoft Support Article.

Posted by: Brandon   Filed under: VBScript No Comments
27Jan/101

Setup WebDAV in Apache2 on SuSE Linux to Support Windows (XP/Vista/7) Clients

Earlier today, a colleague told me that she doesn't like using my servers because I don't have FTP setup thus, she couldn't map my server as a drive. Well, I showed her. I stand firmly against using FTP as any type of web-related solution and thus, decided on WebDAV to address my colleague's demanding needs.

Initially, I set the virtual host up for Basic Authentication but was unable to get Windows 7 and Windows XP to map the drive. Windows complained that "The network path could not be found." I tried mapping the drive from both the command line and from Windows Explorer with no luck. Then I read that theWindows webDAV client does not support Basic Authentication. If this server were on my domain, I'd use Kerberos without a second thought, but it's an Internet web server so that is out of the question. Digest Authentication it is.

I went enable mod_dav, mod_dav_fs, and mod_auth_digest in YaST under Network Services >> HTTP Server >> Server Modules and I restarted the service. I then created the folder /var/davlock, gave it the proper permissions and added the following to httpd.conf

<Ifmodule mod_dav.c>
  DAVLockDB /var/davlock/DAVlock
</IfModule>


Then I added the new host, sample.acme.com to my vhosts.conf file and restarted the service.

<VirtualHost *:80>
    ServerAdmin nobody@localhost
    ServerName sample.acme.com
    DocumentRoot /www/wordpress/solardb
    ErrorLog /var/log/apache2/sample-error_log
    CustomLog /var/log/apache2/sample-access_log combined
    UseCanonicalName Off

<Directory "/www/wordpress/sample">
Options Indexes FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
DAV On

#Auth in the house
AuthType Digest
AuthName "sample"
AuthDigestAlgorithm MD5
AuthDigestDomain http://sample.acme.com
AuthDigestNcCheck Off
AuthDigestNonceLifetime 0
AuthDigestQop auth
AuthDigestProvider file
AuthUserFile /etc/apache2/.htdigest
AuthGroupFile /dev/null
<LimitExcept GET HEAD OPTIONS POST>
require valid-user
</LimitExcept>
Order allow,deny
Allow from all
</Directory>
</VirtualHost>


Notice AuthUserFile /etc/apache2/.htdigest. That file was created using htdigest2 (or on most other systems, htdigest).

htdigest2 -c /etc/apache2/.htdigest sample acmeuser

The -c switch creates the file, "sample" correlates with the AuthName directive and acmeuser is the username of my demanding colleague. Also take note that the way I used LimitExcept allows all non-webDAV users to have anonymous access to the site, while any webDAV activity requires a username and password.

Next, I mapped a drive in Windows with the two methods I am familiar with. First, via the command line

W:\>net use * http://sample.acme.com
Enter the user name for 'sample.acme.com': acmeuser
Enter the password for sample.acme.com:
Drive X: is now connected to http://sample.acme.com.


And then via Windows Explorer (My Computer >> Map Network Drive [be sure to click "Connect Using Different Credentials"]). Both worked flawlessly. And of course, this is all better if you can do it over HTTPS, which I plan to setup when I have time. But for now, my servers are totally in style and ready for use by people who aren't fans of vi ;) .

Posted by: Chrissy   Filed under: Apache, Linux, Security, Windows 1 Comment
23Jan/107

Solved: Missing Hard Drive Space in Windows Server 2008

Tonight, I uninstalled Exchange Server 2007 from a development server and was surprised to see that, after the uninstall was complete (and not without a few workarounds), only 50GB of an 80GB hard drive remained. Explorer showed 25GB free, but only 25GB had been used. Where was the remaining 30GB? Poking around the net didn't help -- most of other people's issues revolved around System Restore and Volume Shadowing but I had disabled all of that.

Ultimately, I used a free tool called windirstat not only to find the missing space, but to delete the offending files as well. As I suspected, there were some super hidden files @ C:\Program Files\Microsoft\Exchange Server that took up nearly 30GB. I tried deleting them in Explorer (which showed me that the Exchange folder was 0kb in size) which resulted in FAIL. Windirstat, however, allowed me to right click and quickly delete the multitude of large log files.

Exchange was my issue, but your server may have another -- some people mentioned anti-viruses causing issues. In any case, using windirstat will shed some light on where to find missing drive space.

Phewf! Now to install SQL Server 2008 R2 on that server...

Posted by: Chrissy   Filed under: Exchange, Windows 7 Comments
22Jan/102

VMware ESXi 4.0: Create Virtual Machine Error Caused by NSF File on Western Digital MyBook WE

Such an awkward title, I know. It's just hard to encapsulate the following error message into a blog post title:

Create virtual machine 172.16.1.129 Error caused by file /vmfs/volumes/0-cb8d2a5-20-f15722/win-2k8.vmdk

Basically, I'm taking ghetto to the next level by using my Dell Optiplex 745 workstation as an ESXi 4.0 server, and using a Western Digital MyBook World Edition as an NFS server which will store the VM images. The MyBook is actually very cool; it's a quiet, visually appealing mirrored 1TB NAS. After manually enabling the NFS server, I was able to mount the shares in VMware but was unable to write to it. Attempting to create a VM would error out with the following in the messages log:

some bull

Hostd: [2010-01-22 19:45:36.384 5AA03B90 verbose 'ha-host'] ModeMgr::Begin: op = normal, current = normal, count = 0
Hostd: [2010-01-22 19:45:36.385 5AA03B90 info 'ha-eventmgr'] Event 18 : Creating win2k8 on host whateves.lan in ha-datacenter
Hostd: [2010-01-22 19:45:36.385 5AA03B90 verbose 'HostsvcPlugin'] CreateEntry '64'
Hostd: [2010-01-22 19:45:36.385 5AA03B90 verbose 'ResourcePool ha-root-pool'] Added child 64 to pool
Hostd: [2010-01-22 19:45:36.385 5AA03B90 verbose 'Vmsvc'] Create VM initiated [64]: /vmfs/volumes/0cb8d2a5-20f15722/win2k8/win2k8.vmx
Hostd: [2010-01-22 19:45:36.387 5AA03B90 verbose 'vm:/vmfs/volumes/0cb8d2a5-20f15722/win2k8/win2k8.vmx'] CreateVmDirectory: Creating vm dir (as vm principal user) '/vmfs/volumes/0cb8d2a5-20f15722/win2k8'
Hostd: [2010-01-22 19:45:36.388 5AA03B90 info 'App'] CreateDirectory: Calling _file->CreateDirectory with _file = [N7Vmacore6System8FileImplE:0x5af0ae58]
Hostd: [2010-01-22 19:45:36.388 5AA03B90 info 'App'] CreateDirectory: Calling _file->CreateDirectory for /vmfs/volumes/0cb8d2a5-20f15722/win2k8
Hostd: [2010-01-22 19:45:36.389 5AA03B90 verbose 'vm:/vmfs/volumes/0cb8d2a5-20f15722/win2k8/win2k8.vmx'] CreateVmDirectory: Failed to create vm dir (as vm principal user) '/vmfs/volumes/0cb8d2a5-20f15722/win2k8'.
Hostd: [2010-01-22 19:45:36.389 5AA03B90 verbose 'vm:/vmfs/volumes/0cb8d2a5-20f15722/win2k8/win2k8.vmx'] CreateVmDirectory: Creating vm dir (as superuser) '/vmfs/volumes/0cb8d2a5-20f15722/win2k8'
Hostd: [2010-01-22 19:45:36.390 5AA03B90 warning 'vm:/vmfs/volumes/0cb8d2a5-20f15722/win2k8/win2k8.vmx'] CreateVmDirectory: Failed to create vm dir '/vmfs/volumes/0cb8d2a5-20f15722/win2k8'
Hostd: [2010-01-22 19:45:36.391 5AA03B90 info 'vm:/vmfs/volumes/0cb8d2a5-20f15722/win2k8/win2k8.vmx'] Create failed with given spec: /vmfs/volumes/0cb8d2a5-20f15722/win2k8/win2k8.vmx
Hostd: (vim.vm.ConfigSpec) { dynamicType = <unset>,  changeVersion = <unset>,  name = "win2k8",  version = "vmx-07", uuid = <unset>, instanceUuid = <unset>, npivWorldWideNameType = <unset>, npivDesiredNodeW
wns = <unset>, npivDesiredPortWwns = <unset>, npivTemporaryDisabled = <unset>, npivOnNonRdmDisks = <unset>, npivWorldWideNameOp = <unset>, locationId = <unset>, guestId = "winLonghorn64Guest", alternateGuestName = "Microsoft Wi
ndows Server 2008 (64-bit)", annotation = <unset>, files = (vim.vm.FileInfo) { dynamicType = <unset>, vmPathName = "[VMs]", snapshotDirectory = "[VMs]", suspendDirectory = <unset>, logDirectory = <unset>, },
tools = (vim.vm.ToolsConfigInfo) { dynamicType = <unset>, toolsVersion = <unset>, afterPowerOn = true, afterResume = true, beforeGuestStandby = true, beforeGuestShutdown = true, beforeGuestReboot = true,
toolsUpgradePolicy = <unset>, pendingCustomization = <unset>, syncTimeWithHost = <unset>, }, flags = (vim.vm.FlagInfo) null, consolePreferences = (
Hostd: [2010-01-22 19:45:36.391 5AA03B90 info 'vm:/vmfs/volumes/0cb8d2a5-20f15722/win2k8/win2k8.vmx'] Exception thrown vim.fault.FileFault
Hostd: [2010-01-22 19:45:36.391 5AA03B90 info 'TaskManager'] Task Completed : haTask-ha-folder-vm-vim.Folder.createVm-172 Status error
Hostd: [2010-01-22 19:45:36.391 5AA03B90 verbose 'ha-host'] ModeMgr::End: op = normal, current = normal, count = 1
Hostd: [2010-01-22 19:45:36.391 5AA03B90 verbose 'vm:/vmfs/volumes/0cb8d2a5-20f15722/win2k8/win2k8.vmx'] RemoveFromAutoStart
Hostd: [2010-01-22 19:45:36.391 5AA03B90 verbose 'Hostsvc::AutoStartManager'] Request spec is (vim.host.AutoStartManager.Config) { dynamicType = <unset>, defaults = (vim.host.AutoStartManager.SystemDefaults) null, powerInfo
= (vim.host.AutoStartManager.AutoPowerInfo) [ (vim.host.AutoStartManager.AutoPowerInfo) { dynamicType = <unset>, key = 'vim.VirtualMachine:64', startOrder = -1, startDelay = -1, waitForHeartbeat = "n
o", startAction = "none", stopDelay = -1, stopAction = "none", } ], }
Hostd: [2010-01-22 19:45:36.391 5AA03B90 verbose 'Hostsvc::AutoStartManager'] Updated AutoStart sequence.
Hostd: [2010-01-22 19:45:36.392 5AA03B90 verbose 'Hostsvc::AutoStartManager'] Autostart info after reconfiguration: (vim.host.AutoStartManager.Config) { dynamicType = <unset>, defaults = (vim.host.AutoStartManager.SystemDefault
s) { dynamicType = <unset>, enabled = <unset>, startDelay = 120, stopDelay = 120, waitForHeartbeat = false, stopAction = "PowerOff", }, }
Hostd: [2010-01-22 19:45:36.392 5AA03B90 verbose 'Vmsvc'] Released Vm Id: 64.
Hostd: [2010-01-22 19:45:36.392 5AA03B90 verbose 'HostsvcPlugin'] RemoveEntry '64'
Hostd: [2010-01-22 19:45:36.392 5AA03B90 verbose 'HostsvcPlugin'] RemoveEntry succeeded
Hostd: [2010-01-22 19:45:36.392 5AA03B90 verbose 'ResourcePool ha-root-pool'] Removed child 64 from pool
Hostd: [2010-01-22 19:45:36.392 5A9C2B90 verbose 'App'] Looking up object with name = "64" failed.
Hostd: [2010-01-22 19:45:36.392 5AA03B90 info 'vm:/vmfs/volumes/0cb8d2a5-20f15722/win2k8/win2k8.vmx'] Create worker thread failed
Hostd: [2010-01-22 19:45:36.393 5AA03B90 verbose 'Statssvc'] EntityRemovedListener: Deleting stats for entity 64
Hostd: [2010-01-22 19:45:36.565 5AA44B90 verbose 'DvsTracker'] FetchDVPortgroups: added 0 items
Hostd: [2010-01-22 19:45:41.690 5AA03B90 verbose 'App'] Looking up object with name = "haTask-ha-host-vim.host.DatastoreSystem.removeDatastore-114" failed.


After searching the 'nets for about an hour, I found a post on MyBook World that addressed my issue. By default the MyBook mounts NFS shares as read-only. To change that, I modified the /etc/exports file, changing all instances of "ro" to "rw."

/nfs/Public *(rw,all_squash,sync,insecure,anonuid=65534,anongid=65534)
/nfs/Download *(rw,all_squash,sync,insecure,anonuid=65534,anongid=65534)


Then, I restarted the service by issuing /etc/init.d/S80nfsd restart. Once the restart was complete, my VM creation was successful :)

Posted by: Chrissy   Filed under: Networking, Security, Virtualization 2 Comments
20Jan/100

Asynchronously mirroring a SharePoint Content Database between Two Farms

Recently, I triumphantly setup an asynchronous content mirror between two separate SharePoint farms.

My SharePoint architecture consists of two separate farms in two different cities (San Diego and Las Vegas), both accessible over a corporate intranet.  Each farm is unique and the configuration and administration databases contain unique information that cannot be mirrored from one site to another. The technique outlined below works, however, because the content databases are identical between the two sites and that is the only information that must be mirrored. One farm is a fail over for the other farm, so each farm contains the same sites.  

After searching the Internet for information on how to mirror SharePoint data, I only found one MSDN article which stated that it should be done either with SQL Server clustering or with synchronous mirroring requiring a witness server.  Eventually I found a picture in the MSDN showing a way to mirror only the SharePoint content databases between two farms asynchronously.  

This picture outlined what I wanted, but I knew SharePoint well enough to know it was going to cause problems. I decided to try my hand at a solution, nevertheless. I started on the primary farm in Las Vegas, where I set up mirroring on the Sharepoint_Content database and mirrored it to the Sharepoint_Content database in San Diego, which was designated as the backup farm.  By design, the San Diego content database was inaccessible while the mirroring was in place, so I had little chance of the backup farm actually loading up any pages. This was acceptable, however, because the backup farm did not need to work unless I failed over to it.  I made some changes to my primary farm by adding a few announcements to a web part on a site and attached a picture to it.  After some time, I decided to remove mirroring from the primary database.  The reason I removed mirroring instead of doing a fail over, is because I could not have downtime on the primary farm.  Nor did I want to take any chances breaking the database by reversing the mirroring if my technique did not work.

After breaking the mirror, the mirrored database showed as "Restoring.." until I ran the command:  RESTORE DATABASE [SharePoint_Content] WITH RECOVERY.

This method is used to make the mirror available again as a stand-alone database.  Once the database was available, I loaded up my SharePoint site on the fail over farm with my fingers crossed.  As the page loaded, I saw a dreaded "Error 400 - Bad Request."  I figured this would happen, as things are rarely straightforward with SharePoint. I didn't have time to address the issue so I decided to just restore from my most recent backup and put my experiment on hold.  After issuing a restore command using stsadm, I saw a peculiar error which stated that it could not restore my site because no content databases were associated and suggested that I add a content database before proceeding.

Perhaps this could work after all! I loaded up the administration panel, found at http://servername:8080, and navigated to Content Databases under Application Management.  The Sharepoint_Content database was listed as it should have been but I figured since it was not working as desired anyway, I could remove the SharePoint_Content database from the configurations and re-add it.  First, I removed the content database and re-added a new content database with the same name and selected my SQL Server from the drop-down menu.  I clicked OK and SharePoint updated its configuration.  Soon the new content database was listed.

I hurried back to my site, refreshed the browser and to my delight, the page loaded and the announcements I had added in Las Vegas were displayed on the site running in San Diego. It was at this moment when I realized that this instance of making the impossible possible would be perfect fodder for my first blog post on netnerds.net.

Posted by: Brandon   Filed under: SQL Server, SharePoint No Comments
20Jan/100

Welcome, Brandon!

This blog has been modified to accommodate postings by my right hand tech companion of over 13 years, Brandon Abshire. Brandon has always been a part of NetNerds but only recently has decided to become more visible. Brandon has been working primarily at Qualcomm Inc for the past 7 years but starting this month, will begin a new endeavor as a SQL Server DBA at Sharp Healthcare in San Diego.

Brandon's posts are initially likely to focus around Android application development, SQL Server and SharePoint. You can view Brandon's resume here.

Posted by: Chrissy   Filed under: General No Comments
17Jan/100

OpenWRT: iptables-based Firewall Rules for PPTP and IPsec

Just a handy little reference for myself.

#Internal PPTP Server
vpnserver="172.16.1.10"
iptables -N pptp
iptables -A pptp -p tcp --destination-port 1723 --dst $vpnserver -j ACCEPT
iptables -A pptp -p gre --dst $vpnserver -j ACCEPT
iptables -I FORWARD -j pptp
iptables -t nat -N pptp
iptables -t nat -A pptp -i $WAN -p tcp --dport 1723 -j DNAT --to $vpnserver
iptables -t nat -A pptp -i $WAN -p 47 -j DNAT --to $vpnserver
iptables -t nat -A PREROUTING -j pptp

### Gateway Router-based IPSEC VPN
# allow IPSEC
iptables -A input_rule -p esp -j ACCEPT
# allow ISAKMP
iptables -A input_rule -p udp -m udp --dport 500 -j ACCEPT
# allow NAT-T
iptables -A input_rule -p udp -m udp --dport 4500 -j ACCEPT
# disable NAT for communications with remote LAN
iptables -t nat -A postrouting_rule -d 172.16.0.0/24     -j ACCEPT
# Allow any traffic between tunnel LANs
iptables -A forwarding_rule -i $LAN -o ipsec0 -j ACCEPT
iptables -A forwarding_rule -i ipsec0 -o $LAN -j ACCEPT
Posted by: Chrissy   Filed under: Linux, Networking, Security No Comments
14Jan/101

Free SQL Server eBooks available

Brad McGehee just published what's sure to be another incredibly informative ebook on SQL Server Maintenance Plans. A list of free eBooks, including the SQL Server Tackle Box, can be found on Brad's blog. Check it, one time.

Posted by: Chrissy   Filed under: SQL Server 1 Comment
14Jan/101

Setting Up a Site-to-Site VPN using a Linksys RV082 and OpenWrt/Openswan on a WRT54GS

After a week of trying out several different types of VPNs (PPTP, SSTP, IPSEC) at my new office, I finally figured out a solution to setup a WAN between my Linksys WRT54GSv3 and a Linksys RV082 business router. The solution was initially presented by Joe Kelly at NerdBoys.com but I couldn't get it to actually work until tonight.

Being a big fan of DD-WRT, I was hoping that I would be able to use it for my IPSEC VPN but DD-WRT only supports OpenVPN, not Openswan, which is what I need to connect to the remote RV082 router.

The techniques provided by Joe worked but the software did not. Apparently, I had to downgrade to OpenWrt from his suggested RC6 to RC4. With RC6, I could establish a tunnel successfully, but I could not ping and traffic did not go through either side. I thought it was my routing table but RC4 has the same routing table and it works perfectly.

Setting up a tunnel is actually easier than I expected -- I had to modify just 3 files on my OpenWrt install and add one tunnel to my RV082. So here's what my network looks like:

  OpenWRT (LFT) RV082 (ATX)
External IP 24.0.175.222 4.2.2.2
External Gateway 24.0.175.221 4.2.2.1
Internal IP 172.16.1.1 172.16.0.1
Internal Subnet 172.16.1.0 172.16.0.0
Internal Subnet Mask 255.255.255.0 255.255.255.0


File 1: /etc/ipsec.conf

version 2.0     # conforms to second version of ipsec.conf specification
# basic configuration
config setup
        plutodebug="none"
        klipsdebug="none"
        nat_traversal=no
        interfaces=%defaultroute

# Add connections here
conn LFT-to-ATX
        authby=secret
        keyexchange=ike
        ikelifetime=480m
        keylife=60m
        pfs=yes
        left=24.0.175.222
        leftsubnet=172.16.1.0/24
        leftsourceip=172.16.1.1
        leftnexthop=24.0.175.221
        right=4.2.2.2
        rightsubnet=172.16.0.0/24
        rightnexthop=4.2.2.1
        auto=start
        dpddelay=10
        dpdtimeout=30
        dpdaction=hold

#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf


File 2: /etc/ipsec.secrets

: PSK "mybigolsecret"


I appended the following on file 3: /etc/firewall.user

### IPSec VPN
# allow IPSEC
iptables -A input_rule -p esp -j ACCEPT
# allow ISAKMP
iptables -A input_rule -p udp -m udp --dport 500 -j ACCEPT
# allow NAT-T
iptables -A input_rule -p udp -m udp --dport 4500 -j ACCEPT
# disable NAT for communications with remote LAN
iptables -t nat -A postrouting_rule -d 172.16.0.0/24     -j ACCEPT
# Allow any traffic between tunnel LANs
iptables -A forwarding_rule -i $LAN -o ipsec0 -j ACCEPT
iptables -A forwarding_rule -i ipsec0 -o $LAN -j ACCEPT


After restarting ipsec on OpenWrt (ipsec setup restart), the following routing table was produced:

Destination Gateway Genmask Flags Metric Ref Use Iface
24.0.175.220 0.0.0.0 255.255.255.252 U 0 0 0 ipsec0
24.0.175.220 0.0.0.0 255.255.255.252 U 0 0 0 vlan1
172.16.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
172.16.0.0 24.0.175.221 255.255.255.0 UG 0 0 0 ipsec0
0.0.0.0 24.0.175.221 0.0.0.0 UG 0 0 0 vlan1

As for the configuration on the RV082 side, it looks like this:


Click

The RV082's routing table looks like so:

Destination IP Address Subnet Mask Default Gateway Hop Count Interface
4.2.2.0 255.255.255.248 * 40 ixp1
4.2.2.0 255.255.255.248 * 45 ipsec0
172.16.1.0 255.255.255.0 4.2.2.1 10 ipsec0
172.16.0.0 255.255.255.0 * 50 ixp0
default 0.0.0.0 4.2.2.1 40 ixp1

And voila! A secure, perma-VPN is born. There are big ol gaps in information here, but Joe's fab post fills in much of that if you need it.

Posted by: Chrissy   Filed under: Networking 1 Comment