Re: Softraid data recovery

2019-10-14 Thread Patrick Dohman


> On Oct 14, 2019, at 3:04 PM, Steven Surdock wrote:
> 
> root@host# more /var/backups/disklabel.sd1.backup
> # /dev/rsd1c:
> type: SCSI
> disk: SCSI disk
> label: SR RAID 1
> duid: 8ec2330eabf7cd26
> flags:
> bytes/sector: 512
> sectors/track: 63
> tracks/cylinder: 255
> sectors/cylinder: 16065
> cylinders: 486401
> total sectors: 7814036576
> boundstart: 64
> boundend: 7814036576
> drivedata: 0
> 
> 16 partitions:
> #size   offset  fstype [fsize bsize   cpg]
>  a:   2147488704   64  4.2BSD   8192 65536 1 # 
> /home/public/
>  c:   78140365760  unused
>  d:   5666547712   2147488768  4.2BSD   8192 65536 1 # 
> /home/Backups/
> 


A combination of revised partition lettering & a custom fstab may allow for 
mounting of the partitions without a software device.

For example:

$cat /etc/fstab
/dev/wd0a  /home ffs rw,nodev,nosuid 1 2
/dev/wd0d  /home/Backups/ ffs rw,nodev,nosuid 1 2

The device naming may take some massaging to work...
man fstab & disklabel for more info.

Regards
Patrick



Re: Misc i386 questions

2019-10-14 Thread Nick Holland
On 10/13/19 12:39 AM, Sean Kamath wrote:
> Doh!
> 
> set tty com0
> 
> Alix is coming along OK now.  Still have questions about i386 and
> SCSI. . .
> 
> Sean
> 
> 
>> On Oct 12, 2019, at 23:13, Sean Kamath 
>> wrote:
>> 
>> Hi.
>> 
>> In my odyssey to get larger disks on my Alix machines, I bought
>> some 16G CompactFlash cards. I put install65.fs on a card and tried
>> to boot it on the Alix, but it just reboots after it loads the
>> kernel.
>> 
>> Meanwhile, the VM I used to dd the install65.fs file to the CF card
>> is running 6.0, so figured I should update it (with a reinstall,
>> rather than updates).  I tried to boot bsd.rd and install 6.5, but
>> it didn’t see the SCSI drive on the VM (but 6.0 did with no
>> issue).  I even downloaded install65.iso and tried to install on a
>> brand new VM (VMware Fusion 11.5 on a Mac running Mojave) with a
>> SCSI drive, but nope.  IDE drives are seen just fine.
>> 
>> So. . . did I just miss something about i386 and SCSI support?

What SCSI hw are you emulating in your VM?
What happens if you change that?

And to be clear -- when you say it doesn't see the SCSI drive, how
are you not seeing it (i.e., what did you do to "see it" and what
was the result?).

Nick.



Re: Softraid data recovery

2019-10-14 Thread Steven Surdock
> -Original Message-
> From: Aaron Mason 
> Sent: Monday, October 14, 2019 7:13 PM
> To: Steven Surdock 
> Cc: misc@openbsd.org
> Subject: Re: Softraid data recovery
> 
> On Tue, Oct 15, 2019 at 7:34 AM Steven Surdock  net.com> wrote:
> >
> > I have a simple RAID1 configuration on wd0, wd1.  I was in the process
> of performing a rebuild on wd1, as it failed during some heavy reads.
> During the rebuild wd0 went into a failure state.  After some
> troubleshooting I decided to reboot and now my RAID disk, sd1, is
> unavailable.  Disks wd0 and wd1 don't show any errors, but I have a
> replacement disk.  I have backups for the critical data and I'd like to
> try and recover as much recent data as possible.  My thought was to
> create a disk image of the "/home/public" data and mount it using
> vnconfig, but I seem to be having issues with the appropriate 'dd'
> command to do that.
> >
> > How can I recover as much data as possible off the failed RAID array.
> > If I recreate the array, "bioctl -c 1 -l /dev/wd0d,/dev/wd1d
> softraid0", will the existing data be preserved?
> >
> > root@host# disklabel wd0
> > # /dev/rwd0c:
> > type: ESDI
> > disk: ESDI/IDE disk
> > label: WDC WD4001FAEX-0
> > duid: acce36f25df51c8c
> > flags:
> > bytes/sector: 512
> > sectors/track: 63
> > tracks/cylinder: 255
> > sectors/cylinder: 16065
> > cylinders: 486401
> > total sectors: 7814037168
> > boundstart: 64
> > boundend: 4294961685
> > drivedata: 0
> >
> > 16 partitions:
> > #size   offset  fstype [fsize bsize   cpg]
> >   c:   78140371680  unused
> >   d:   7814037104   64RAID
> >
> > root@host# more /var/backups/disklabel.sd1.backup # /dev/rsd1c:
> > type: SCSI
> > disk: SCSI disk
> > label: SR RAID 1
> > duid: 8ec2330eabf7cd26
> > flags:
> > bytes/sector: 512
> > sectors/track: 63
> > tracks/cylinder: 255
> > sectors/cylinder: 16065
> > cylinders: 486401
> > total sectors: 7814036576
> > boundstart: 64
> > boundend: 7814036576
> > drivedata: 0
> >
> > 16 partitions:
> > #size   offset  fstype [fsize bsize   cpg]
> >   a:   2147488704   64  4.2BSD   8192 65536 1 #
> /home/public/
> >   c:   78140365760  unused
> >   d:   5666547712   2147488768  4.2BSD   8192 65536 1 #
> /home/Backups/
> >
> 
> I think at this point you're far better off restoring from backup.
> You do have a backup, right?
> 
> As for the disks, ddrescue would be a better option than dd - it'll keep
> trying if it encounters another URE whereas dd will up and quit.
> Expect it to take several days on disks that big - it's designed to be
> gentle to dying disks.

I believe the disks are mostly healthy.  In fact I've tried several attempts at 
dd'ing the data from wd0 with no read issues.  It takes about 12 hours to read 
1TB.  I suspect I'm not aligning sectors properly and the filesystem is not 
readable.  I've tried making an image of /home/public (which is _mostly_ backed 
up), but fsck doesn't see a reasonable filesystem after I vnconfig the image.  
So, if anyone has some insight on 'dd if=/dev/wd0d of=public.img bs=512 
count=5666547712 skip=xx', it would be great.



Re: Softraid data recovery

2019-10-14 Thread Aaron Mason
On Tue, Oct 15, 2019 at 7:34 AM Steven Surdock
 wrote:
>
> I have a simple RAID1 configuration on wd0, wd1.  I was in the process of 
> performing a rebuild on wd1, as it failed during some heavy reads.  During 
> the rebuild wd0 went into a failure state.  After some troubleshooting I 
> decided to reboot and now my RAID disk, sd1, is unavailable.  Disks wd0 and 
> wd1 don't show any errors, but I have a replacement disk.  I have backups for 
> the critical data and I'd like to try and recover as much recent data as 
> possible.  My thought was to create a disk image of the "/home/public" data 
> and mount it using vnconfig, but I seem to be having issues with the 
> appropriate 'dd' command to do that.
>
> How can I recover as much data as possible off the failed RAID array.
> If I recreate the array, "bioctl -c 1 -l /dev/wd0d,/dev/wd1d softraid0", will 
> the existing data be preserved?
>
> root@host# disklabel wd0
> # /dev/rwd0c:
> type: ESDI
> disk: ESDI/IDE disk
> label: WDC WD4001FAEX-0
> duid: acce36f25df51c8c
> flags:
> bytes/sector: 512
> sectors/track: 63
> tracks/cylinder: 255
> sectors/cylinder: 16065
> cylinders: 486401
> total sectors: 7814037168
> boundstart: 64
> boundend: 4294961685
> drivedata: 0
>
> 16 partitions:
> #size   offset  fstype [fsize bsize   cpg]
>   c:   78140371680  unused
>   d:   7814037104   64RAID
>
> root@host# more /var/backups/disklabel.sd1.backup
> # /dev/rsd1c:
> type: SCSI
> disk: SCSI disk
> label: SR RAID 1
> duid: 8ec2330eabf7cd26
> flags:
> bytes/sector: 512
> sectors/track: 63
> tracks/cylinder: 255
> sectors/cylinder: 16065
> cylinders: 486401
> total sectors: 7814036576
> boundstart: 64
> boundend: 7814036576
> drivedata: 0
>
> 16 partitions:
> #size   offset  fstype [fsize bsize   cpg]
>   a:   2147488704   64  4.2BSD   8192 65536 1 # 
> /home/public/
>   c:   78140365760  unused
>   d:   5666547712   2147488768  4.2BSD   8192 65536 1 # 
> /home/Backups/
>

I think at this point you're far better off restoring from backup.
You do have a backup, right?

As for the disks, ddrescue would be a better option than dd - it'll
keep trying if it encounters another URE whereas dd will up and quit.
Expect it to take several days on disks that big - it's designed to be
gentle to dying disks.

-- 
Aaron Mason - Programmer, open source addict
I've taken my software vows - for beta or for worse



Re: How to dock laptop more easily

2019-10-14 Thread tom ryan
On 2019-10-14 19:33, Marcus MERIGHI wrote:
> j...@begriffs.com (Joe Nelson), 2019.10.14 (Mon) 04:32 (CEST):
>> I'd like to write a daemon to change machdep.lidaction and the xrandr output 
>> as
>> an external monitor or power is attached/detached from my laptop. Is there a
>> way to detect those events from a C program?
>  
> x-on-resize[1] might help with detecting plug/unplug events of external
> monitors.
> 
> [1]
> https://keithp.com/blogs/x-on-resize/
> git://people.freedesktop.org/~keithp/x-on-resize
> https://github.com/thedward/x-on-resize
> https://marc.info/?l=openbsd-misc=148839239518671

I was about to mention x-on-resize. I use it to invoke autorandr.

https://pypi.org/project/autorandr/

And for power there's already sensorsd

$ sysctl hw.sensors.acpibat0.raw0
hw.sensors.acpibat0.raw0=1 (battery discharging), OK

Not sure how you will transition from this state:

>> PowerMon  Open| SleepDisplay
>> --+--
>>  x| asleep

to this one:

>> xx| awakeexternal

I.e. wake up from standby when power is applied, without opening the
laptop - machdep.lidaction won't help with that.

t

> Marcus
> 
>> Here is how I want the sleep state and output display to change based on
>> whether power is connected, an external monitor is attached, and the laptop 
>> is
>> open:
>>
>> PowerMon  Open| SleepDisplay
>> --+--
>> xxx   | awakeboth
>> xx| awakeexternal
>> x x   | awakelaptop
>> x | asleep
>>  xx   | awakeboth
>>  x| asleep
>>   x   | awakelaptop
>>   | asleep
>>
>> -- 
>> Joe Nelson  https://begriffs.com
>>
> 



Softraid data recovery

2019-10-14 Thread Steven Surdock
I have a simple RAID1 configuration on wd0, wd1.  I was in the process of 
performing a rebuild on wd1, as it failed during some heavy reads.  During the 
rebuild wd0 went into a failure state.  After some troubleshooting I decided to 
reboot and now my RAID disk, sd1, is unavailable.  Disks wd0 and wd1 don't show 
any errors, but I have a replacement disk.  I have backups for the critical 
data and I'd like to try and recover as much recent data as possible.  My 
thought was to create a disk image of the "/home/public" data and mount it 
using vnconfig, but I seem to be having issues with the appropriate 'dd' 
command to do that.

How can I recover as much data as possible off the failed RAID array.
If I recreate the array, "bioctl -c 1 -l /dev/wd0d,/dev/wd1d softraid0", will 
the existing data be preserved?

root@host# disklabel wd0
# /dev/rwd0c:
type: ESDI
disk: ESDI/IDE disk
label: WDC WD4001FAEX-0
duid: acce36f25df51c8c
flags:
bytes/sector: 512
sectors/track: 63
tracks/cylinder: 255
sectors/cylinder: 16065
cylinders: 486401
total sectors: 7814037168
boundstart: 64
boundend: 4294961685
drivedata: 0

16 partitions:
#size   offset  fstype [fsize bsize   cpg]
  c:   78140371680  unused
  d:   7814037104   64RAID

root@host# more /var/backups/disklabel.sd1.backup
# /dev/rsd1c:
type: SCSI
disk: SCSI disk
label: SR RAID 1
duid: 8ec2330eabf7cd26
flags:
bytes/sector: 512
sectors/track: 63
tracks/cylinder: 255
sectors/cylinder: 16065
cylinders: 486401
total sectors: 7814036576
boundstart: 64
boundend: 7814036576
drivedata: 0

16 partitions:
#size   offset  fstype [fsize bsize   cpg]
  a:   2147488704   64  4.2BSD   8192 65536 1 # 
/home/public/
  c:   78140365760  unused
  d:   5666547712   2147488768  4.2BSD   8192 65536 1 # 
/home/Backups/



Re: Certain size packets not passing through a L2 over L3 IPsec tunnel

2019-10-14 Thread Russell Sutherland
Ok... I've updated both ends of the tunnel to OpenBSD 6.5 and the same problem 
exists when trying to pass packets of a certain size.

Any ideas on how to fix or work around this issue?

Thanks in advance.

Russell P. Sutherland   Email: russell . sutherland @ utoronto dawt ca
Network Engineer, I+TS   Voice: +1.416.978.0470
4 Bancroft Ave., Rm. 102  Cell: +1.416.803.0080
University of TorontoFax:   +1.416.978.6620
Toronto, ON  M5S 1C1

From: Russell Sutherland
Sent: Thursday, October 10, 2019 16:25
To: misc@openbsd.org 
Subject: Certain size packets not passing through a L2 over L3 IPsec tunnel

I've set up a L2overL3 tunnel using the template as found in "man etherip". I 
am running OpenBSD 5.9, which I believe is the first version to support the 
etherip interface.

I find the bridge/tunnel does not pass a small range of specific sized packets.

E.g. if 1.2.3.4 is at the far end of the tunnel and I am pinging from the local 
end:

ping -s 1388 1.2.3.4 works
ping -s 1396 1.2.3.4 works

All other sizes, 1389 to 1395 inclusive fail.

Is there some way to remedy this?


Thanks in advance.

Russell P. Sutherland   Email: russell . sutherland @ utoronto dawt ca
Network Engineer, I+TS   Voice: +1.416.978.0470
4 Bancroft Ave., Rm. 102  Cell: +1.416.803.0080
University of TorontoFax:   +1.416.978.6620
Toronto, ON  M5S 1C1


Re: relayd: Binding to port range

2019-10-14 Thread Norman Golisz
On Thu Oct 10 2019 20:27, Klemens Nanni wrote:
> On Thu, Oct 10, 2019 at 04:45:37PM +0200, Norman Golisz wrote:
> > it seems relayd's configuration syntax does not allow specifying port
> > ranges, like 9740:10200. Am I correct?
> Depends on where;  search for "range" in relayd.conf(5).

Thanks!

Unfortunately, it does not support ranges in relay mode. I'd have loved
to replace haproxy. ;-)



Re: 6.5 crashing on an old Thinkpad 600X

2019-10-14 Thread Riccardo Mottola

Hi,

I have a 600X! It is a super-vintage machine with a wonderful keyboard.

Gwen Nelson wrote:

Hi all, I've been trying to fix up an old Thinkpad, a 600X model with a
Pentium III and 64mb RAM, I get some errors in the AML code:

https://imgur.com/gallery/IRrpgmk

Unfortunately I can't obtain a dmesg as the machine has no networking and
I've managed to kill the bootloader while trying to update.

Any ideas?


You need to disable acpi:

boot -c and "disable acpi".

If that works, test it. I think 64MB should be enough for a login, but 
for X you are pushing the limits. You can put more RAM and with a light 
WM, you can use it for terminal and Xterm work easily.
Finding a woking PCMCIA WiFi card is not so easy, but wired ethernet is 
easy.


Riccardo



Re: 6.5 crashing on an old Thinkpad 600X

2019-10-14 Thread Riccardo Mottola

Hi,

Stuart Henderson wrote:

First I'd try a snapshot, if that doesn't help then I'd try "boot -c"
and "disable acpitz". If you can get it booting, the acpi tables
generated in the report by running sendbug as root might help track
it down.



I also have a 600X with that issue. I totally disable acpi, not just the 
tz, which is your suggestion, I suppose.

I will try if it helps!

Riccardo



Re: NPPPD Server behind a firewall

2019-10-14 Thread Damian McGuckin

On Mon, 14 Oct 2019, Stefan Sperling wrote:


On Mon, Oct 14, 2019 at 05:55:58PM +1100, Damian McGuckin wrote:

Because I had a working L2TP server setup on $L2TP, I was not going to
go into its pf.conf, ipsec.conf, or anything else. But here is npppd.conf

ike passive esp transport \
proto udp from egress to any port 1701 \
main auth "hmac-sha1" enc "3des" group modp1024 \
quick auth "hmac-sha1" enc "3des" group modp1024 \
psk "MYSECRET"


As an aside, you should avoid use of 3des because it is effecively 
plaintext.


I take your point about 3des but I was starting from a known configuration 
which works (albiet with the external interface hacing a Public IP)



There are ways to make even Windows clients use actual crypto with IPsec if
needed, though last I checked it could not be done from the GUI but required
powershell commands. (I don't have a URL handy, sorry, but this information
wasn't very hard to find when I needed it.)


Thanks. I will investigate. This has to work with iPads as well. Yuk!


You could try to pin-point the problem a bit more, starting with diagnostics
at the IPsec layer. Check debug logs from isakmpd, check ipsectl -sa, etc.


OK.


I suspect getting IPsec SAs going with both peers behind NAT is tricky.


I agree.

See my subsequent post where I replaced 'egress' above with the external 
IP (of the subsequently NAT'd npppd server). Closer. But not quite there.


Thanks - Damian



Re: NPPPD Server behind a firewall

2019-10-14 Thread Damian McGuckin



I changed /etc/ipsec.conf to have 'ike' reflect the external IP

ike passive esp transport \
proto udp from $L2TPX to any port 1701 \
main auth "hmac-sha1" enc "aes" group modp2048 \
quick auth "hmac-sha1" enc "aes" group modp2048 \
psk "MYSECRET"

and restarted isakmpd and reloaded ipsec.conf.

On the inside of the NPPPD server, the only errors I get are

isakmpd[46608]: attribute_unacceptable: GROUP_DESCRIPTION: got ECP_384, 
expected MODP_2048
isakmpd[46608]: attribute_unacceptable: GROUP_DESCRIPTION: got ECP_256, 
expected MODP_2048

and I believe it should negotiate the groups. It should also negotiate "3des"
and my earlier "modp1024" but I wanted to minimize lines of errors.

While this is happening

ipsecctl -s flow (shows)

flow esp in proto udp from REMOTE-FW port l2tp to $L2TPI port l2tp peer
REMOTE-FW srcid $L2TPI/32 dstid 192.168.0.146/32 type use
flow esp out proto udp from $L2TPI port l2tp to REMOTE-FW port l2tp peer
REMOTE-FW srcid $L2TPI/32 dstid 192.168.0.146/32 type require

Note that there are only 2 lines above. I

Which reflects the network

[laptop-192.168.0.146]<->REMOTE-FW --internet-- FIRE<->SERVER-IP=$L2TPI)

and the firewall FIRE nats $L2TPX->$L2TPI

But, the VPN is never established, eventually

ipsecctl -s flow (shows)



Still at a loss.  Any suggestions?

Regards - Damian

Pacific Engineering Systems International, 277-279 Broadway, Glebe NSW 2037
Ph:+61-2-8571-0847 .. Fx:+61-2-9692-9623 | unsolicited email not wanted here
Views & opinions here are mine and not those of any past or present employer



Re: Do OpenBSD developers approve Isotop?

2019-10-14 Thread Stefan Sperling
On Sun, Oct 13, 2019 at 10:31:55PM -0300, Clark Block wrote:
> Do OpenBSD developers approve Isotop?
> 
> If not, why OpenBSD developers don't approve Isotop?
> 
> Reference Isotop: https://3hg.fr/Isos/isotop/

OpenBSD code is free for anyone to use for any purpose. We don't stamp
a seal of approval onto anything anyone else does with the code.

Whether or not you want to make use of isotop is your own decision.

If you're asking whether OpenBSD developers would want to support people
who are running into problems with isotop, the answer will in general be
"No" because there is already enough work to do.



Re: How to dock laptop more easily

2019-10-14 Thread Marcus MERIGHI
j...@begriffs.com (Joe Nelson), 2019.10.14 (Mon) 04:32 (CEST):
> I'd like to write a daemon to change machdep.lidaction and the xrandr output 
> as
> an external monitor or power is attached/detached from my laptop. Is there a
> way to detect those events from a C program?
 
x-on-resize[1] might help with detecting plug/unplug events of external
monitors.

[1]
https://keithp.com/blogs/x-on-resize/
git://people.freedesktop.org/~keithp/x-on-resize
https://github.com/thedward/x-on-resize
https://marc.info/?l=openbsd-misc=148839239518671

Marcus

> Here is how I want the sleep state and output display to change based on
> whether power is connected, an external monitor is attached, and the laptop is
> open:
> 
> PowerMon  Open| SleepDisplay
> --+--
> xxx   | awakeboth
> xx| awakeexternal
> x x   | awakelaptop
> x | asleep
>  xx   | awakeboth
>  x| asleep
>   x   | awakelaptop
>   | asleep
> 
> -- 
> Joe Nelson  https://begriffs.com
> 



Re: NPPPD Server behind a firewall

2019-10-14 Thread Stefan Sperling
On Mon, Oct 14, 2019 at 05:55:58PM +1100, Damian McGuckin wrote:
> Because I had a working L2TP server setup on $L2TP, I was not going to
> go into its pf.conf, ipsec.conf, or anything else. But here is npppd.conf
> 
> ike passive esp transport \
> proto udp from egress to any port 1701 \
> main auth "hmac-sha1" enc "3des" group modp1024 \
> quick auth "hmac-sha1" enc "3des" group modp1024 \
> psk "MYSECRET"

As an aside, you should avoid use of 3des because it is effecively plaintext.
There are ways to make even Windows clients use actual crypto with IPsec if
needed, though last I checked it could not be done from the GUI but required
powershell commands. (I don't have a URL handy, sorry, but this information
wasn't very hard to find when I needed it.)
 
> Now I want to move the machine to a new site behind a new OpenBSD firewall,
> say FIRE. The difference is that now, $L2TP will have an unroutable address,
> say 10.200.100.200, or $L2TPI, as the IP on its external interface.  It will
> obviously have an external address, $L2TPX, but that will be exposed through
> FIRE, the external firewall. I want to binat from L2TPX->L2TPI.

> Any suggestions on what I have done wrong or what I need to do right.

You could try to pin-point the problem a bit more, starting with diagnostics
at the IPsec layer. Check debug logs from isakmpd, check ipsectl -sa, etc.
I suspect getting IPsec SAs going with both peers behind NAT is tricky.
I believe it should be possile in theory but I cannot confirm whether our
implementation can do this easily. It will certainly involve UDP traffic
since AH/ESP cannot pass through NAT.

If your IPsec SAs already work for other traffic, but npppd won't work,
that would imply that npppd has a limitation related to NAT; perhaps it
encodes the end-point IPs it is seeing in the L2TP protocol, which would
not match the actual layer 3 addresses used by IPsec?



NPPPD Server behind a firewall

2019-10-14 Thread Damian McGuckin



I have a L2TP NPPPD server machine with IP $L2TP sitting behind an OpenBSD 
firewall, say FIRET. 'T' for temporary because it will move. $L2TP is an 
externally routable IP. $Ext, the external interface of FIRET, allows

traffic into $L2TP. A snippet of pf.conf is

begin snippet-0
ipsecIN = "{ iskmpd, ipsec-nat-t, l2tp }"

pass in quick on $Ext inet proto udp from any to $L2TP port $ipsecIN keep state
pass in quick on $Ext inet proto esp from any to $L2TP
pass in quick on $Ext inet proto ah from any to $L2TP
end snippet-0

It all went wonderfully. It worked. I have done it before.

Because I had a working L2TP server setup on $L2TP, I was not going to
go into its pf.conf, ipsec.conf, or anything else. But here is npppd.conf

ike passive esp transport \
proto udp from egress to any port 1701 \
main auth "hmac-sha1" enc "3des" group modp1024 \
quick auth "hmac-sha1" enc "3des" group modp1024 \
psk "MYSECRET"

Now I want to move the machine to a new site behind a new OpenBSD firewall,
say FIRE. The difference is that now, $L2TP will have an unroutable address,
say 10.200.100.200, or $L2TPI, as the IP on its external interface.  It will
obviously have an external address, $L2TPX, but that will be exposed through
FIRE, the external firewall. I want to binat from L2TPX->L2TPI.

So on FIRE, where we will call the external interface, $Ext, again. I 
first binat things on FIRE.


match on $Ext from $L2TPI to any binat to $L2TPX

Because BINAT'ing is done before 'pass' rules are processed, the rules must
refer to the external interface.  Just to be sure, I will ensure that I can
SSH to $L2TPI, on FIRE I have a pf.conf with

pass in quick on $Ext inet proto tcp from any to $L2TPI port ssh\
flags S/SA modulate state

Yes, that works. I can SSH to $L2TPX and get all the way through FIRE and
get in through the interface $L2TPI of the NPPPD server.

OK, now I need to let the other protocols through. I think I want all 
traffic, once it gets onto $Ext, to be allowed through to the internal 
network on which $L2TPI sits with its IP 10.200.100.200.


begin snippet-1

ipsecIN = "{ iskmpd, ipsec-nat-t, l2tp }"

pass in quick on $Ext inet proto udp from any to $L2TPI port $ipsecIN keep state
pass in quick on $Ext inet proto esp from any to $L2TPI
pass in quick on $Ext inet proto ah from any to $L2TPI

end snippet-1

I can see traffic destined to 10.200.100.200 coming in through the external
interface of FIRE and going out to 10.200.100.200 and then, from within this
machine, i.e. the NPPPD Server, I see traffic coming in, admittedly on port
ipsec-nat-t, i.e. 4500. But it fails.

Any suggestions on what I have done wrong or what I need to do right.

Thanks - Damian



Re: Do OpenBSD developers approve Isotop?

2019-10-14 Thread pierre1.bardou
Hello,

It seems there is a man/FAQ in english :
https://3hg.fr/Isos/isotop/isotop.man.html


--
Cordialement,
Pierre BARDOU

-Message d'origine-
De : owner-m...@openbsd.org  De la part de Stuart 
Longland Envoyé : lundi 14 octobre 2019 07:57 À : misc@openbsd.org Objet : Re: 
Do OpenBSD developers approve Isotop?

On 14/10/19 11:31 am, Clark Block wrote:
> Do OpenBSD developers approve Isotop?
> 
> If not, why OpenBSD developers don't approve Isotop?

Is there an English translation for those of us who don't speak French?
--
Stuart Longland (aka Redhatter, VK4MSL)

I haven't lost my mind...
   ...it's backed up on a tape somewhere.


_

Ce message et ses pieces jointes peuvent contenir des informations 
confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce 
message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages 
electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou 
falsifie. Merci.

This message and its attachments may contain confidential or privileged 
information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete 
this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been 
modified, changed or falsified.
Thank you.