7

I'm trying to use socat as a port mapper to map IPv4 connections to my OpenVPN server running behind a DS-Lite IPv6 cable connection.

//edit I tried with a non root user and root. But I get the same result with both users. //edit

Goal is to be able to connect from my mobile phone via OpenVPN to my (IPv4) smart home devices.

From the server running socat I can ping6 my router at home. IPv6 port forwarding is enabled as well and forwards 1194/udp to the raspberry running the OpenVPN server at home.

Problem is now that I'm seeing an error from socat as I try to connect OpenVPN from my mobile. 

root@scw-31f6c8:~/bin# socat -d -d UDP4-LISTEN:63530,fork UDP6:xxx.dynv6.net:1194
2017/12/27 13:53:01 socat[15428] N listening on UDP AF=2 0.0.0.0:63530
2017/12/27 13:53:07 socat[15428] N accepting UDP connection from AF=2 xx.xxx.xxx.xx:1319
2017/12/27 13:53:07 socat[15428] N forked off child process 15429
2017/12/27 13:53:07 socat[15428] N listening on UDP AF=2 0.0.0.0:63530
2017/12/27 13:53:07 socat[15429] N opening connection to AF=10 [2a02:810c:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx]:1194
2017/12/27 13:53:07 socat[15429] N successfully connected from local address AF=10 [2001:0bc8:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx]:41641
2017/12/27 13:53:07 socat[15429] N starting data transfer loop with FDs [5,5] and [6,6]
2017/12/27 13:53:07 socat[15429] E read(6, 0xf97acc0, 8192): Permission denied
2017/12/27 13:53:07 socat[15429] N exit(1)
2017/12/27 13:53:07 socat[15428] N childdied(): handling signal 17
2017/12/27 13:53:07 socat[15428] W waitpid(): child 15429 exited with status 1

On first sight everything looks good until it hits read(6, 0xf97acc0, 8192): Permission denied.

Currently I cannot identify if this is a socat error on the server running it, or if it is related to a communication issue from socat to my IPv6 endpoint at home.

Any pointer on how to find out what's wrong?

//edit

I tried it as well on different machines (uberspace, scaleway) To be sure it is not related to a bad server side configuration. Might be an indicator that something is wrong on my end. But currently I don't see it.

devployment
  • 181
  • 1
  • 3
  • I suppose you tried to run it with root privileges ? Does it work like that ? If so, it's a real `permission denied` problem, and your user might not have sufficient rights to access socat – Carpette Dec 27 '17 at 15:45
  • The log output is from a not root user. But I tried it with `root` as well but got the same result. That's why I'm confused as I don't think that it could be related to locale permission issues. – devployment Dec 27 '17 at 18:09
  • is it maybe a selinux related problem? – Tomáš Pospíšek Dec 27 '17 at 22:45
  • I'd expect you get that error message if your UDP6 packets to dst:1194 are being answered with "administratively prohibited" ICMPv6 packets. You may want `tcpdump -n icmp6` while you're doing that to see if that's what happening. – Stéphane Chazelas Aug 21 '21 at 13:14

1 Answers1

0

Had the same problem. It turned out that my Fritzbox for some reasons put a wrong (or maybe an old) IPv6 Adress to the port mapping which was not the VPN servers one. After fixing that it worked.

Edit: I can reproduce that log by changing the IPv6 address from xx8d to wrong xxd8 in the port mapping of my fritzbox.

$ socat -d -d UDP4-LISTEN:2194,fork UDP6:xxxxx.dynv6.net:2194
2021/07/14 22:30:14 socat[] N listening on UDP AF=2 0.0.0.0:2194
2021/07/14 22:30:28 socat[] N accepting UDP connection from AF=2 109.42.112.115:59217
2021/07/14 22:30:28 socat[] N forked off child process 10569
2021/07/14 22:30:28 socat[] N listening on UDP AF=2 0.0.0.0:2194
2021/07/14 22:30:28 socat[] N opening connection to AF=10 [2a00:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xx8d]:2194
2021/07/14 22:30:28 socat[] N successfully connected from local address AF=10 [2a03:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxbf]:50334
2021/07/14 22:30:28 socat[] N starting data transfer loop with FDs [5,5] and [6,6]
2021/07/14 22:30:28 socat[] E read(6, 0x55d9a7c15da0, 8192): Permission denied
2021/07/14 22:30:28 socat[] N exit(1)
2021/07/14 22:30:28 socat[] N childdied(): handling signal 17 here

After changing back to correct value xx8d it works again.

SKD
  • 1
  • 1