Grrr!

[altivo]

Gotta go do chores in a few minutes because we're going to dinner and then to an Irish music performance and lecture.

Still I need to vent about lousy documentation, on three sides: Windows (nothing new there), Linux (you mean there even IS documentation?) and Watchguard Systems (no excuse there guys, people pay big bucks for your trash.)

A couple of years ago, I had VPN working from home to the Watchguard Firebox II at work. This let me log in over an encrypted tunnel to tweak things or check on a problem if someone called me, rather than having to drive 15 miles to work on my day off.

Last year the Firebox was upgraded to an X700. VPN has never worked since. I figured it was because the consultants never put my definitions back in, and didn't get around to it for a while because it's a tortuous process only partly described by Watchguard's documents. However, I finally decided I do need it, so this week I've been trying to reinstate it.

No joy. I've followed Watchguard's instructions step by step, defining the connection, enabling it, defining the user, loading all to the firewall box. Since they only provide client setup for Windows, I set up my test client at home on my mate's Windows XP. According to both Microsoft and Watchguard, everything is set up properly. Except, it won't connect. There's a negotiation all right, the Firebox opens a connection when requested, but after a couple of packets are exchanged, it shuts down. So far nothing appears in the log there. The debugging logs on the client station indicate that the connect request is acknowledged, a handshake is exchanged, and then the server closes the connection. I can't see that they even get as far as the authentication sequence. I thought the Norton Firewall on Gary's machine was perhaps interfering, so I disabled it briefly, but with the same result.

Windows produces an error number 619, which is supposed to mean that the port was not available. This makes no sense, because I can see the connection take place and then break. A port unavailable yields either no response or a single denial message.

The Linux VPN client (pptp-client) is messy to set up, but I do understand how it is supposed to work. It doesn't, though. Again, the debug log indicates that the server acknowledges the connection but then closes the socket before asking for authentication. Who knows what Watchguard is doing? I don't. I'm not sure they do either.

I've turned on the debug logging at the server end, but haven't been back there yet to see if it says anything. I don't have high expectations though. I can find several other people over the past two or three years posting similar questions on various linux and security forums. I have found no case where an answer was provided, or where the original poster came back and said he/she got it to work and here's how. As far as I can determine, Watchguard's RUVPN is just broken and doesn't work at all.

Comments

[corelog.livejournal.com]

How annoying! :P

[altivo.livejournal.com]

Yes. It's pretty clearly a Watchguard problem, since it doesn't even work with their supported clients (Windows XP or 2000). It also appears that the hardware itself, which was delivered just over a year ago, was already far behind in firmware version when delivered. I may be facing two or more successive upgrades to get this thing to where it should be.

I'm irritated at the poor quality of documentation for this particular Linux add-on (pptp-client) but the thing isn't much more than a beta that has been released too soon. They obviously tested it mostly against Linux servers, perhaps entirely so. Oddly enough, Watchguard runs Linux internally (as do most firewall appliances) but on the surface they only support Windows, and they try not to admit that they have a Linux kernel hidden under the red paint.

Microsoft's own firewall, with which I had some experience a few years ago, was incomprehensible. I never want to see that one again.

My own firewall at home, built entirely using iptables, is so much easier to understand and modify... Not only that, but it works perfectly. Of course you couldn't sell it as a "product" because 1) in order to use it, you have to actually understand what a firewall does, and how, and why; 2) you have to use command lines to construct or modify it; and 3) it's open source, and they give it away for free, so it couldn't possibly compare with something top secret, patented, trademarked, and that requires a $750 per year fee to keep operating. I'll never get mob psychology.

[kyhwana.livejournal.com]

Can you bypass the watchguard firewall and setup a SSH server on a linux box somewhere on the network? Then just tunnel (or setup that new fangled SSH-VPN thing) to the machines you need to over SSH?

[altivo.livejournal.com]

I could, but I don't want to do that. Then I'd be responsible for bypassing the entire network's security.

It appears that I'll have to upgrade the software on the firewall itself by at least a level or two. It's a known bug at the version that is installed.

[cabcat.livejournal.com]

"Windows produces an error number 619, which is supposed to mean that the port was not available. This makes no sense, because I can see the connection take place and then break. A port unavailable yields either no response or a single denial message."

Sounds like something is seeing it make the connection then shutting it off
A security feature one of the machines?

[altivo.livejournal.com]

Apparently not. I looked in the log at the server end tonight. It says the same thing that the client says. "The child process died for reasons unknown to us." The client reports that the host process closed the port unexpectedly.

It appears from Watchguard's support database that this is a known problem with the version of software currently running on our unit. The fix is to install the next release. I guess I'll have to do that. Ugh.

[kakoukorakos.livejournal.com]

Err, so what's the point of a VPN that won't let you login? Surely someone at the company is able to provide support, or do they just not want to sell any shiny, red Linux boxen?

[altivo.livejournal.com]

No, they do provide support, which we paid for but did not claim for a year. Now I've got a unit that is several software releases behind current, and the support database prescribes an upgrade to fix the problem. I'm going to have to do that before I start camping on support lines that probably go to India anyway.

[kakoukorakos.livejournal.com]

Ahhh, sounds like they may have had to add a fix for compatibility with the newer browsers then.

[altivo.livejournal.com]

Well, not browsers. They don't do anything with browsers other than block web sites if you turn that option on (we don't.) There's evidently a bug in their implementation of pptp. It looks as if the authentication and negotiations complete but then the actual communication daemon dies for some reason.