Re: VPN connections in NetworkManager have strange behaviour

[Dan Williams <dcbw redhat com>]

On Thu, 2009-05-14 at 16:08 +0200, Axel wrote:
> Hello
> 
> I have a problem when using NetworkManager to connect to VPN 
> connections, on an up to date fedora 11 system.
> Packages versions are :
> NetworkManager-gnome-0.7.1-4.git20090414.fc11.i586
> NetworkManager-vpnc-0.7.0.99-1.fc11.i586
> NetworkManager-0.7.1-4.git20090414.fc11.i586
> NetworkManager-openvpn-0.7.0.99-1.fc11.i586
> NetworkManager-pptp-0.7.0.99-1.fc11.i586
> NetworkManager-glib-0.7.1-4.git20090414.fc11.i586
> NetworkManager-glib-devel-0.7.1-4.git20090414.fc11.i586
> NetworkManager-devel-0.7.1-4.git20090414.fc11.i586
> 
> I previously (ubuntu gutsy) used to connect to a vpnc (VPN Compatible 
> Cisco) server with the command line tool.
> 
> Using the command line still works with Fedora 11. When I try to switch 
> to the NetworkManager builtin VPN manager, I manage to connect to the 
> remote VPN server, but no network activity can be made. It s maybe a 
> problem with the routes.
> 
> When connecting to the VPN with the vpnc command line tool, no specific 
> configuration (but the group & user login/password) is defined. No 
> specific routing configuration has been made.
> 
> 192.168.246.254 is the gateway of the LAN.
> 62.39.X.X is the remote VPN server.
> 

Is the remote VPN server passing the netmask down to the client?  vpnc
should export the netmask in the environment of the handler it runs
after connecting, in the INTERNAL_IP4_NETMASK variable.
NetworkManager-vpnc looks for that, and if its found, it will use that
value.  So it could be a misconfiguration of your vpn concentrator.

If that value is *not* present, NM will default to a /24, which could be
what's happening here.  That may be wrong, yes.  But first lets verify
what the VPN client is returning.  One way to do this is to
move /usr/libexec/nm-vpnc-service-vpnc-helper
to /usr/libexec/nm-vpnc-service-vpnc-helper.ORIG, then put a small
wrapper script at /usr/libexec/nm-vpnc-service-vpnc-helper that contains
something like:

#!/bin/sh
env > /tmp/vpn-env
/usr/libexec/nm-vpnc-service-vpnc-helper.ORIG $@

and make that script executable, then connect.  That should dump the
environment to the file /tmp/vpn-env which will allow us to figure this
out.

Dan