<div dir="ltr"><div dir="ltr"><br></div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jul 8, 2021 at 11:04 AM Paul Wouters <<a href="mailto:paul@nohats.ca">paul@nohats.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Thu, 8 Jul 2021, Dan Stromberg wrote:<br>
<br>
> $ ike-scan <a href="http://vpn.nohats.ca" rel="noreferrer" target="_blank">vpn.nohats.ca</a><br>
> Starting ike-scan 1.9.4 with 1 hosts (<a href="http://www.nta-monitor.com/tools/ike-scan/" rel="noreferrer" target="_blank">http://www.nta-monitor.com/tools/ike-scan/</a>)<br>
> <br>
> Ending ike-scan 1.9.4: 1 hosts scanned in 2.529 seconds (0.40 hosts/sec). 0 returned handshake; 0 returned notify<br>
> <br>
> Could someone not firewalled please run "ike-scan <a href="http://vpn.nohats.ca" rel="noreferrer" target="_blank">vpn.nohats.ca</a>" and send output to the list, for the sake of comparison?<br>
<br>
paul@bofh:~$ sudo ike-scan <a href="http://vpn.nohats.ca" rel="noreferrer" target="_blank">vpn.nohats.ca</a><br>
Starting ike-scan 1.9.4 with 1 hosts (<a href="http://www.nta-monitor.com/tools/ike-scan/" rel="noreferrer" target="_blank">http://www.nta-monitor.com/tools/ike-scan/</a>)<br>
<br>
Ending ike-scan 1.9.4: 1 hosts scanned in 2.616 seconds (0.38 hosts/sec). 0 returned handshake; 0 returned notify<br>
<br>
I guess we increased our security :)<br></blockquote><div>Thanks for checking it!</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Jul 8 13:58:50.834070: packet from <a href="http://193.110.157.194:500" rel="noreferrer" target="_blank">193.110.157.194:500</a>: initial Main Mode message received but no connection has been authorized with policy PSK<br>
<br>
<br>
I added a bogus IKEv1 connection to it. So now scanning it shows:<br>
<br>
paul@bofh:~$ sudo ike-scan <a href="http://vpn.nohats.ca" rel="noreferrer" target="_blank">vpn.nohats.ca</a><br>
Starting ike-scan 1.9.4 with 1 hosts (<a href="http://www.nta-monitor.com/tools/ike-scan/" rel="noreferrer" target="_blank">http://www.nta-monitor.com/tools/ike-scan/</a>)<br>
193.110.157.148 Notify message 14 (NO-PROPOSAL-CHOSEN) HDR=(CKY-R=d87781dc8be5eff1)<br>
<br>
Ending ike-scan 1.9.4: 1 hosts scanned in 0.274 seconds (3.65 hosts/sec). 0 returned handshake; 1 returned notify<br>
<br>
Note the "1 returned notify"<br>
<br>
> PS: I'm not sure if I'm happy or daunted by the possibility of this being because of a firewall, as I haven't set one up and fear it may be out of my<br>
> control.<br>
<br>
if you have firewalld running, you might just want to either remove it,<br>
or run:<br>
<br>
sudo firewall-cmd --zone=trusted --add-port=500/udp --permanent<br>
sudo firewall-cmd --zone=trusted --add-port=4500/udp --permanent<br>
sudo firewall-cmd --zone=trusted --add-protocol=50 --permanent<br>
sudo systemctl restart firewalld<br></blockquote><div><br></div><div>Now ike-scan of <a href="http://vpn.nohats.ca">vpn.nohats.ca</a> is giving me:</div><div><br></div><div>$ ike-scan --ikev2 <a href="http://vpn.nohats.ca">vpn.nohats.ca</a><br>Starting ike-scan 1.9.4 with 1 hosts (<a href="http://www.nta-monitor.com/tools/ike-scan/">http://www.nta-monitor.com/tools/ike-scan/</a>)<br>193.110.157.148 Notify message 14 (NO_PROPOSAL_CHOSEN) HDR=(CKY-R=ac594eee123b34c5, IKEv2)<br><br>Ending ike-scan 1.9.4: 1 hosts scanned in 0.469 seconds (2.13 hosts/sec). 0 returned handshake; 1 returned notify<br></div><div><br></div><div><br></div><div>Does this mean there's no firewall on my system? I don't see any occurrences of "firewall" in ps -ef, and iptables --list gives me:</div><div>Chain INPUT (policy ACCEPT)<br>target prot opt source destination <br><br>Chain FORWARD (policy ACCEPT)<br>target prot opt source destination <br><br>Chain OUTPUT (policy ACCEPT)<br>target prot opt source destination <br></div><div><br></div><div>I'm not 100% sure how to interpret this. If it's a firewall blocking my traffic, I don't think it's on my Debian system, nor do I think it's on my home router, but please help me interpret these results. It seems like if there's a firewall, it would have to be on my corporate network or the Fortigate system itself.</div><div><br></div><div>I'm still getting:<br></div><div>$ ike-scan --ikev2 1.1.1.1<br>below cmd output started 2021 Thu Jul 08 12:08:58 PM PDT<br>Starting ike-scan 1.9.4 with 1 hosts (<a href="http://www.nta-monitor.com/tools/ike-scan/">http://www.nta-monitor.com/tools/ike-scan/</a>)<br><br>Ending ike-scan 1.9.4: 1 hosts scanned in 2.438 seconds (0.41 hosts/sec). 0 returned handshake; 0 returned notify<br></div><div><br></div><div><br></div><div>I haven't found mtr tremendously accurate in the past, but maybe here it's worth looking at to form a guess about where udp/500 is getting blocked, if anywhere:</div><div>mtr --report --udp -4 --port 500 1.1.1.1<br></div><div>Start: 2021-07-08T12:18:56-0700<br>HOST: KS190924A Loss% Snt Last Avg Best Wrst StDev<br> 1.|-- <a href="http://dsldevice.attlocal.net">dsldevice.attlocal.net</a> 0.0% 10 0.8 0.8 0.8 0.9 0.0<br> 2.|-- 107-214-104-1.lightspeed. 0.0% 10 20.6 21.6 17.3 30.4 5.3<br> 3.|-- 64.148.105.178 0.0% 10 17.4 67.1 17.3 457.0 138.2<br> 4.|-- <a href="http://cr83.la2ca.ip.att.net">cr83.la2ca.ip.att.net</a> 0.0% 10 20.5 23.8 20.3 27.7 2.7<br> 5.|-- <a href="http://ggr2.la2ca.ip.att.net">ggr2.la2ca.ip.att.net</a> 0.0% 10 21.1 21.2 19.2 22.3 1.1<br> 6.|-- 192.205.37.26 0.0% 10 20.6 20.6 19.7 21.2 0.4<br> 7.|-- be-3402-cs04.losangeles.c 0.0% 10 20.3 21.4 20.3 22.2 0.6<br> 8.|-- 96.110.45.230 0.0% 10 28.5 28.2 26.3 35.0 2.5<br> 9.|-- <a href="http://ae-2-rur01.placerville.ca">ae-2-rur01.placerville.ca</a> 0.0% 10 32.2 32.0 31.6 32.5 0.3<br> 10.|-- ae-11-sur02.placerville.c 0.0% 10 31.0 31.5 31.0 32.2 0.4<br> 11.|-- 50.231.18.194 0.0% 10 32.1 32.3 32.0 33.5 0.5<br> 12.|-- ??? 100.0 10 0.0 0.0 0.0 0.0 0.0<br></div><div><br></div><div>This too seems to say that I'm not firewalling on my Debian system or home router.</div><div><br></div><div>Hop 11 appears to be a comcast host according to ipwhois.</div><div><br></div><div>My IT guy said that the Fortigate server is "in stealth mode", and he seems to be avoiding telling me what that means more specifically. If I had to guess, I'd say maybe he's turned off ICMP, since the server is not ping'able.</div><div><br></div><div>Any further thoughts folks?</div><div><br></div><div>Thanks!</div><div><br></div></div></div>