Dockered Accel-ppp with vlan_mon

2021-03-09T16:55:58.671000Z

Hello All,

I have been working to have accel-ppp in a dockerized environment. I was able to establish a ppp session inside the docker container without using the "vlan_mon" driver.
Now my goal is to add the vlan filtering functionality also inside the docker environment.

The issue that I see while building accel-ppp with vlan_mon in docker is:

The accel-ppp vlan_mon module and the kernel vlan_mon driver can not talk (The netlink call fails) because of the docker NetNs isolation.
-- The only way that I was able to use vlan_mon and create vlan interfaces was by providing the container the host network.
* problem doing that: 1. I cannot run multiple accel-ppp instances.
2. Increase the vulnerability of my host machine.
It will be a great help if I get a little guidance on how can I use vlan_mon from the docker network namespace?

I am already running the accel-ppp container with:

--cap-add=NET_ADMIN
--cap-add=SYS_ADMIN

and the volumes mounted:

--device /dev/ppp:/dev/ppp
-v /sbin/modprobe:/sbin/modprobe
-v /lib/modules:/lib/modules

Logs from accel-ppp:

[2021-03-03 17:43:02.679] open ns (null)
[2021-03-03 17:43:02.681] libnetlink: RTNETLINK answers: No such device
[2021-03-03 17:43:02.682] vlan_mon: nl_add_vlan_mon: error talking to kernel
[2021-03-03 17:43:02]: debug: libnetlink: RTNETLINK answers: No such device
[2021-03-03 17:43:02]: error: vlan_mon: nl_add_vlan_mon: error talking to kernel

Accel-ppp: PPTP fsm timeout issue

2016-04-30T17:49:37.085000Z

Hi,

I am having issues with PPTP protocol on mobile data only. Once I am on my home or office wifi I can connect, but while on mobile it is giving me errors:

Apr 30 12:37:17 free accel-pppd: pppoe: no configuration, disabled...
Apr 30 12:37:17 free accel-pppd: accel-ppp version 1.9.0
Apr 30 12:37:17 free accel-pppd: send [RADIUS(1) Accounting-Request id=1 <Acct-S tatus-Type="" Accounting-On=""> <NAS-Identifier "accel-ppp"=""> <NAS-IP-Address 50.31.1.5="" 8="">]
Apr 30 12:37:23 free accel-pppd: message repeated 2 times: [ send [RADIUS(1) Acc
ounting-Request id=1 <Acct-Status-Type Accounting-On=""> <NAS-Identifier "accel-ppp="" "=""> <NAS-IP-Address 50.31.1.58="">]]
Apr 30 12:37:30 free accel-pppd: pptp: new connection from 80.76.171.17
Apr 30 12:37:30 free accel-pppd: :: recv [PPTP Start-Ctrl-Conn-Request <Version 1=""> <Framing 3=""> <Bearer 3=""> <Max-Chan 1="">]
Apr 30 12:37:30 free accel-pppd: :: send [PPTP Start-Ctrl-Conn-Reply <Version 1="">
<Result 1=""> <Error 0=""> <Framing 3=""> <Bearer 3=""> <Max-Chan 1="">]
Apr 30 12:37:31 free accel-pppd: :: recv [PPTP Outgoing-Call-Request <Call-ID 34="" b4=""> <Call-Serial a8b5=""> <Min-BPS 1000=""> <Max-BPS 100000000=""> <Bearer 3=""> <Framing 3="">
<Window-Size 8192=""> <Delay 0="">]
Apr 30 12:37:31 free accel-pppd: :: send [PPTP Outgoing-Call-Reply <Call-ID 21="">
<Peer-Call-ID 34b4=""> <Result 1=""> <Error 0=""> <Cause 0=""> <Speed 100000000=""> <Window-Siz e="" 8192=""> <Delay 0=""> <Channel 0="">]
Apr 30 12:37:31 free accel-pppd: ppp0:: connect: ppp0 <--> pptp(80.76.171.17)
Apr 30 12:37:31 free accel-pppd: ppp0:: lcp_layer_init
Apr 30 12:37:31 free accel-pppd: ppp0:: auth_layer_init
Apr 30 12:37:31 free accel-pppd: ppp0:: ccp_layer_init
Apr 30 12:37:31 free accel-pppd: ppp0:: ipcp_layer_init
Apr 30 12:37:31 free accel-pppd: ppp0:: ipv6cp_layer_init
Apr 30 12:37:31 free accel-pppd: ppp0:: ppp established
Apr 30 12:37:31 free accel-pppd: ppp0:: lcp_layer_start
Apr 30 12:37:31 free accel-pppd: ppp0:: send [LCP ConfReq id=1 <auth MSCHAP-v2="">
<mru 1400=""> <magic 6b8b4567="">]
Apr 30 12:37:34 free accel-pppd: ppp0:: fsm timeout 9
Apr 30 12:37:34 free accel-pppd: ppp0:: send [LCP ConfReq id=1 <auth MSCHAP-v2="">
<mru 1400=""> <magic 6b8b4567="">]
Apr 30 12:37:37 free accel-pppd: ppp0:: fsm timeout 8
Apr 30 12:37:37 free accel-pppd: ppp0:: send [LCP ConfReq id=1 <auth MSCHAP-v2="">
<mru 1400=""> <magic 6b8b4567="">]
Apr 30 12:37:40 free accel-pppd: ppp0:: fsm timeout 7
Apr 30 12:37:40 free accel-pppd: ppp0:: send [LCP ConfReq id=1 <auth MSCHAP-v2="">
<mru 1400=""> <magic 6b8b4567="">]
Apr 30 12:37:43 free accel-pppd: ppp0:: fsm timeout 6
Apr 30 12:37:43 free accel-pppd: ppp0:: send [LCP ConfReq id=1 <auth MSCHAP-v2="">
<mru 1400=""> <magic 6b8b4567="">]
Apr 30 12:37:46 free accel-pppd: ppp0:: fsm timeout 5
Apr 30 12:37:46 free accel-pppd: ppp0:: send [LCP ConfReq id=1 <auth MSCHAP-v2="">
<mru 1400=""> <magic 6b8b4567="">]
Apr 30 12:37:49 free accel-pppd: ppp0:: fsm timeout 4
Apr 30 12:37:49 free accel-pppd: ppp0:: send [LCP ConfReq id=1 <auth MSCHAP-v2="">
<mru 1400=""> <magic 6b8b4567="">]
Apr 30 12:37:52 free accel-pppd: ppp0:: fsm timeout 3
Apr 30 12:37:52 free accel-pppd: ppp0:: send [LCP ConfReq id=1 <auth MSCHAP-v2="">
<mru 1400=""> <magic 6b8b4567="">]
Apr 30 12:37:55 free accel-pppd: ppp0:: fsm timeout 2
Apr 30 12:37:55 free accel-pppd: ppp0:: send [LCP ConfReq id=1 <auth MSCHAP-v2="">
<mru 1400=""> <magic 6b8b4567="">]
Apr 30 12:37:58 free accel-pppd: ppp0:: fsm timeout 1
Apr 30 12:37:58 free accel-pppd: ppp0:: send [LCP ConfReq id=1 <auth MSCHAP-v2="">
<mru 1400=""> <magic 6b8b4567="">]
Apr 30 12:38:01 free accel-pppd: ppp0:: fsm timeout 0
Apr 30 12:38:01 free charon: 08[KNL] interface ppp0 deleted
Apr 30 12:38:01 free accel-pppd: ppp0:: lcp_layer_finished
Apr 30 12:38:01 free accel-pppd: ppp0:: terminate
Apr 30 12:38:01 free accel-pppd: ppp0:: lcp_layer_finish
Apr 30 12:38:01 free accel-pppd: ppp0:: lcp_layer_free
Apr 30 12:38:01 free accel-pppd: ppp0:: auth_layer_free
Apr 30 12:38:01 free accel-pppd: ppp0:: ccp_layer_free
Apr 30 12:38:01 free accel-pppd: ppp0:: ipcp_layer_free
Apr 30 12:38:01 free accel-pppd: ppp0:: ipv6cp_layer_free
Apr 30 12:38:01 free accel-pppd: ppp0:: ppp destablished
Apr 30 12:38:01 free accel-pppd: ppp0:: pptp: ppp finished
Apr 30 12:38:01 free accel-pppd: ppp0:: send [PPTP Call-Disconnect-Notify <Call- ID="" b434=""> <Result 3=""> <Error 0=""> <Cause 0="">]
Apr 30 12:38:01 free accel-pppd: ppp0:: send [PPTP Stop-Ctrl-Conn-Request <Reaso n="" 0="">]
Apr 30 12:38:01 free accel-pppd: ppp0:: send [PPTP Echo-Request <Identifier 327b="" 23c6="">]
Apr 30 12:38:02 free accel-pppd: ppp0:: pptp: disconnect by peer
Apr 30 12:38:02 free accel-pppd: ppp0:: pptp: disconnect
Apr 30 12:38:02 free accel-pppd: ppp0:: disconnected

Here is my code block:

# modules required for accel-ppp
[modules]
log_file
log_syslog
pptp
l2tp
pppoe
auth_mschap_v2
radius
ippool

# core module only
[core]
log-error=/var/log/accel-ppp/core.log
thread-count=4

# module for ppp. required.
[ppp]
verbose=3
min-mtu=1280
mtu=1400
mru=1400
mppe=prefer
ipv4=require
ipv6=deny
# echo interval in seconds
lcp-echo-interval=20
# echo timeout after n seconds
lcp-echo-timeout=120    

[pptp]
# bind to a specific ip address
bind=152.152.58.47  
# echo interval in seconds
echo-interval=30    
# prefer mpppe. required.
mppe=prefer 
# pool of client ip. see [ip-pool] module belore for reference. required.
ip-pool=pool1       
# log verbosity
verbose=3

[l2tp]
# bind to a specific ip address
bind=152.152.58.47  
#dictionary=/usr/local/share/accel-ppp/l2tp/dictionary
# ping client every n seconds
hello-interval=60
# prefer mppe. required.
mppe=prefer     
# pool of client ip. see [ip-pool] module belore for reference. required.
ip-pool=pool2       
# log verbosity
verbose=3       

[dns]
dns1=8.8.8.8
dns2=8.8.4.4

[radius]
# dictionary for radius. required.
dictionary=/usr/local/share/accel-ppp/radius/dictionary
# nas name in radius. required.
nas-identifier=accel-ppp    
# nas ip address. required.
nas-ip-address=152.152.58.47
#main radius server details
server=128.23.168.125,5xMaP,auth-port=1812,acct-port=1813,req-limit=0,fail-time=0   
# CoA server details.required.
dae-server=152.152.58.47:3799,5dsowmwo220
# verbosity of radius logs
verbose=1       

[client-ip-range]
# client ip range must be from %any. required.
0.0.0.0/0       

[ip-pool]
# gw ip address. required.
gw-ip-address=10.0.0.1  
# connection for client pool for pptp module. required.
10.31.3.3-254,pool1 
# connection for client pool for l2tp module. required.
10.31.4.3-254,pool2 

# log settings only. for debugging. make sure to logrotate.
[log]
log-file=/var/log/accel-ppp/accel-ppp.log
log-emerg=/var/log/accel-ppp/emerg.log
log-fail-file=/var/log/accel-ppp/auth-fail.log
level=5

can anyone help me?

Recent posts to Discussion

Dockered Accel-ppp with vlan_mon

Accel-ppp: PPTP fsm timeout issue