The failing VPN connections turned out to be a problem with the way I load balance DNS over all available connections, so having (for the particular site) a DSL line, an iBurst and a 3G connection in place things are mostly resonable and we’ve usually got some options to try when things do bomb out (ie, a dsl line doesn’t fail, it simply keeps on coming up/going down constantly, half the time not even long enough for lcp-echo-interval and lcp-echo-failure to pick up on the problem. So what happens when you load balance the DNS over the available DNS servers (obviously pushing the requests over the correct devices) and _one_ of the three connections provides you with totally bogus DNS servers? Well, let me tell you: On average one out of three DNS requests fail. This means that on average once every three minutes the DNS request for the IPSec peer’s IP fail, causing the vpn to come tumbling down.

Now, on the GLUG mailing list the words WINS came up – which is totally bogus. In fact, it’s so bogus that initially I discarded (and iirc partially flamed) the guy that brought it up. In fact, WINS is so wrong that I have no idea how anybody initially got the idea, except perhaps for staring too long at too many pppd debug traces.

The bottom line is this: The firmware on the Huawei E220 (and by implication the E270 and probably aothers too) is broken. It passes some WINS servers to the pppd process running on the host. If these WINS options are NAKed then things start going totally pearshaped. In fact, it goes so pearshaped that in the last two weeks I didn’t obtain the correct DNS servers on a single instance. So I eventually decided it’s time to give the WINS thing a shot (The more I thought about it, the more disgusting the idea got). After about half an hour of cleaning up the patches that I could locate I finally managed to make it compile with pppd-2.4.4 (Gentoo variation) and install it. And immediately I managed to get the correct DNS servers, connection setup times came down (to a few seconds compared to near minute times).

Annoying. Highly annoying. Anyway, a working patch is available here. I’d like to actually add usepeerwins as well, which will allow for pulling the WINS servers from a pppd peer, and passing that on to ip-up that can reconfigure samba for winbind (mostly) purposes. But that’s the patch for another day.

UPDATE (2008/08/17):

I’ve just finished writing usepeerwins support for pppd, which functions closer to the usepeerdns option in that it requests the peer to send up to two wins servers, and then exports them to ip-up and ip-down vir environment variables WINS1 and WINS2, as well as setting USEPEERWINS=1. It doesn’t actually make any modifications to your smb.conf file. The patch itself can be downloaded here. You can update smb.conf using sed commands such as:

sed -re “s/^[[:space:]]*wins ?server.*/\0 ${LINKNAME}:${WINS1}/” -i /etc/samba/smb.conf

For adding (ip-up), and for removing (ip-down):

sed -re “s/^([[:space:]]*wins ?server.*) ${LINKNAME}:${WINS1//./\\.}/\1/’ -i /etc/samba/smb.conf

If you’re able to use either of these patches with success, please let me know. Please note that from playing around a LOT over the weekend in writing the latter of the patches it seems that the device is especially annoying when plugged in the first time, even without the patch I seem to be able to with quite high repeatability obtain the correct DNS server values by making pppd disconnect and reconnecting without unplugging the device.

UPDATE (2008/08/26):

For general information setting this up, please see this post on TLUG’s Wiki.

Share on Facebook