-
Notifications
You must be signed in to change notification settings - Fork 51
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SDP Gateway not adding rules to FWKNOP_INPUT chain after receiving SPA packet from Clients #7
Comments
In my test environment, I've got below message at SDP Gateway just after receiving SPA from a client.
|
Hey, thank you for responding,first of all im running all this operation on local nat ips,once it works i will try it on different public ips,im testing using an apache web server(port 5002 instead of 80) that resides in the in the gateway VM protectecd by iptables drop all, Controller and Database seem fine,all the data is exchanged properly its just that when ever i connect a client(with fwknop -n service_gate -v) the gateway wont open a path for him in iptables ,but when i run the client comment manualy it works with minor problemes with this command : fwknop --verbose --sdp-id 301 -A tcp/5002 -a 192.168.1.11 -D 192.168.1.10 --use-hmac --key-base64-rijndael XXX == --key-base64-hmac XXX After revising the DB it worked ! the client (with fwknop -n service_gate -v) got access to the service for a brief moment and then it disconnects him even tho the connection is established Starting fwknopd main event loop. Gateway closed connections meeting the following criteria: Gateway closed the following invalid connection from SDP ID 301: Sending connection_update message (1 connections) to controller create_connection_item_from_line() Failed to find connection details in line: create_connection_item_from_line() Failed to find connection details in line: create_connection_item_from_line() Failed to find connection details in line: create_connection_item_from_line() Failed to find connection details in line: create_connection_item_from_line() Failed to find connection details in line: i thought maybe its about my Apache connection changing port with each connection so i Enabled Keep Alive in Apache KeepAlive: Enable/disable persistent connectionsKeepAlive On MaxKeepAliveRequests: How many requests to allow during a persistent connection.You can set it 0 for unlimited requests, but it is not recommended.MaxKeepAliveRequests 0 KeepAliveTimeout: Number of seconds to wait for the next request from thesame client on the same connection. Default is 5 secondsKeepAliveTimeout 800 but still dissconects my client after a brief moment.. Thank you for your time. |
Regarding the SDP Client, you need to use
Please find below for the results in my test environment.
To use SDP SPA packet you need to use
You can define services and related ports on the SDP Gateway in SDP Controler Database.
Hope it helps you. Feel free to ask me if more information needed. |
Ahh now i understand, Everythhing works perfectly fine thanks to you! Thank you |
Hi, thank you very much for sharing the table details. It helped a lot to configure the database. My setup is successfully running with service level permission. Now I want to assign permission based on the user/group. For an example I want Here are the detail tables ... MariaDB [sdp]> SELECT * FROM user;
2 rows in set (0.001 sec) MariaDB [sdp]> SELECT * FROM group;
1 row in set (0.000 sec) MariaDB [sdp]> SELECT * FROM user_group;
1 row in set (0.000 sec) MariaDB [sdp]> SELECT * FROM group_service;
1 row in set (0.000 sec) Please suggest me what should I do next. Thank you in advance! |
Hello, as explained in the title ! something is missing in this Gateway Output instead of "Added Rule to FWKNOP_INPUT for ..." i get nothing(Line 5 and 6)
Sniffing interface: ens33
PCAP filter is: 'udp port 62201'
Starting fwknopd main event loop.
(stanza #0) SPA Packet from IP: 192.168.1.11 received with access source match
(sdp_message.c:272) Received service or access data message
(sdp_ctrl_client.c:675) Access data update received
Warning: REQUIRE_SOURCE_ADDRESS not enabled for access stanza source: 'ANY'
Added access entry for SDP ID 301
Created 1 hash table nodes from 1 json stanzas
Succeeded in modifying access data.
Hoping I'm missing a simple configuration somewhere.
The text was updated successfully, but these errors were encountered: