SoftEther VPN server → client ping stops working after 30 seconds

I'm setting up a VPN server for a project where clients need to be able to contact each other and the services on the server.

Most works fine and dandy, and all clients can ping each other. The strange part is that after connecting, the server is able to ping the client for about 30 seconds, and then stops. See example below (ran server-side).

$ ping 10.0.0.10 PING 10.0.0.10 (10.0.0.10) 56(84) bytes of data. 64 bytes from 10.0.0.10: icmp_seq=1 ttl=64 time=48.2 ms 64 bytes from 10.0.0.10: icmp_seq=2 ttl=64 time=24.6 ms 64 bytes from 10.0.0.10: icmp_seq=3 ttl=64 time=22.9 ms 64 bytes from 10.0.0.10: icmp_seq=4 ttl=64 time=23.7 ms ^C --- 10.0.0.10 ping statistics --- 48 packets transmitted, 4 received, 91.6667% packet loss, time 48044ms rtt min/avg/max/mdev = 22.948/29.857/48.190/10.599 ms 

So pinging works fine until it suddenly stops. Pinging client to server remains functional. Same behaviour for both Linux and Windows clients and other traffic such as HTTP. Works for a short time and then stops. The routes present in both clients and server seem okay to me (see below).

The SoftEther VPN server is running in docker as a privileged container and host networking mode. It has a TAP adapter called tap_soft with a systemd-networkd configuration. The SoftEther virtual DHCP server is enabled and serves IP's between 10.0.0.10 and 10.0.0.200, subnet 255.255.255.0 where the virtual host itself has 10.0.0.1.

networkd tap conf (/etc/systemd/network/tap_soft.netdev):

[NetDev] Name=tap_soft Kind=tap 

networkd network conf (/etc/systemd/network/tap_soft.network):

[Match] Name=tap_soft [Address] Address=10.0.0.1/24 

docker-compose:

version: '3' services: softether: container_name: softether image: siomiz/softethervpn:4.38-alpine volumes: - ./vpn_server.config:/usr/vpnserver/vpn_server.config restart: always ports: # L2TP/IPSec - "500:500/udp" - "4500:4500/udp" - "1701:1701/tcp" # OpenVPN - "1194:1194/udp" - "443:443/tcp" # Over https # SoftEther VPN - "5555:5555/tcp" - "992:992/tcp" network_mode: host environment: - PSK=${IPSec_PSK} - SPW=${server_management_password} cap_add: - NET_ADMIN privileged: true ... 

Routes:
Sever: 10.0.0.0/24 dev tap_soft proto kernel scope link src 10.0.0.1
Client: 10.0.0.0/24 dev vpn_vpn proto kernel scope link src 10.0.0.10
(These are automatically created upon connecting it seems)

Does anyone have any idea where the problem lies? Any help is welcome!

TIFU installing 1Gbps uplink switches

I recently designed the network infrastructure for a new build and installed all Cisco 9300 switches with 1Gbps uplinks. There are 4 IDFs each with their own 5 switch stack so the intention was to MLAG the uplinks to the core to allow scalability as internal traffic rarely ever got over 1Gbps.

This was also working fine and everyone was happy until just today I get told they’ve kitted out the whole building with Crestron AV kit. Specifically, NVX encoders and decoders for sending AV around the building to and from numerous rooms. I wasn’t made aware of that at the design stage but now I’m absolutely ruined because EACH encoder uses 1Gbps and multicasts. I’ve now got about 15Gbps constantly flying around the entire network to reach the decoders.

Lucky for me I got the modular uplink model switches so I just need to swap out the modules for 10Gbps but it was a very bad time when those encoders were switched on.

Golang ssh client - scrapligo vs gornir

Hello All,

I have just started to get my feet wet in Golang. I think I know its basic data structure, file IO operation, conditional logic etc.. I am ready to start interacting with network devices using Go. How are you guys making ssh connection to network devices? I see two packages gornir and scapligo. Any preference? I am leaning towards using gornir, as scapligo says "this is a work in progress, use with caution!" I also understand that gornir is sort of framework so gornir vs scapligo is not apple to apple comparison. At this stage I am just exploring and would like to found out what other community members are using ?

Thanks,

BGP between two switch VPCs at different DCs

Hey All,

I am trying to share routes over BGP between two DCs.

The connectivity between the DCs is two L2 DCI links configured with point to point networks.

The switches are Nexus 9ks and have a few server networks running HSRP in the VPC.

What I'm trying to achieve in terms of sharing routes between DCs: https://i.imgur.com/13xeB6i.png

Is this the design https://i.imgur.com/R1LZ7hR.png that would be required in terms of individual device peering?

Looking at this document https://www.cisco.com/c/en/us/support/docs/ip/ip-routing/217099-ebgp-peering-over-vpc-on-nexus.html it kinda matches what I'm thinking is required in that second diagram I made.

So on the firewall there would be two separate iBGP peers as you would treat each switch as if they are standalone routers and not in a VPC.

If this was the design that would be required, how would the iBGP peering between the Nexus switches inside the VPC be done?

Would I need a new L3 connection between the Nexus switches? Currently the peer link is a trunked port-channel of two ports. So would I need to create a new transit VLAN on that peer link with SVIs on each switch which I can then use to peer between the two switches?

Would there be any issues in using the same VLAN currently in use between the firewall and the Nexus switches?

I could also technically remove HSRP in this VLAN as well once the BGP routing is implemented.

Are there any other things to consider when setting up this kind of configuration?

There also shouldn't be any reason I couldn't enable ECMP on the Nexus switches either to load-balance between the two DCI links. Right?

We also have VXLAN enabled to extend one of the VLANs between both VPCs, not sure if that would affect anything.

Would be great to hear from anyone who has implemented this type of configuration before and has any advice relating to this scenario or just in general about BGP on VPCs.

Thanks!

Effective ways of measuring packet loss rate

Hi, sorry this might be a dumb question, but I would like to know what do you think are the effective ways of measuring the packet loss rate of a network when TCP is used. Thank you very much in advance!

Essentially, I am simulating a linear network topology using Mininet, where two users at the two ends of the network are transmitting data through TCP using iPerf. To measure the packet loss rate, I am thinking either I can use Wireshark that sniffs at some point in the network, so I can get the number of packets that are not delivered successfully and the number of packets that are delivered. The loss rate is simply their ratio. However, if I understand correctly, the Wireshark will output all its monitored data to the disk, and given the simulated link has a bandwidth of 1gbps, the disk in my laptop (the device I use for simulation) should quickly go full. If I would like to run the simulation for hours, I guess Wireshark may not be a good solution. Or I am thinking maybe I can do some logging in the TCP kernel, so whenever the TCP receives an ack or a timeout/transmission is triggered, I can log correspondingly. In the end, I can just count the number of log lines. However, I think this might also be unnecessary and there should be a better solution for my case.

WPA2-Enterprise vs 802.1x

Is there any real different between those above two ? When I add wireless profile in windows 10 , those two option are listed as well.

Secondly , I remember for all 802.1x wireless authentication , we require to manually add the wifi SSID profile. Is this been changed in windows 10 ? Because I tested to just click connect the SSID , and key in username /password, it works as well.

Any explanation is welcomed

Wireless bridge or fiber for offices 300m apart?

Hi all,

I am building a Wi-Fi network for a location which has an upper office and a lower office about 300m apart. I am planning to have two or three Eero Pros providing Wi-Fi at each office, with the two offices connected by either hand-laid fiber—it is in a forested area of California and I reckon i could dig a trough between the two sites and lay fiber—or use a wireless bridge.

Internet will be provided by Starlink, but I would like the network to be able to handle up to about 1Gbps in case Starlink delivers on its promise of increased speeds.

I have a few questions:

1. If I were to go with fiber, what goes in between the RJ45 cable and the fiber cable? Is it a switch with ports for both types of cable ?

2. I have also heard GigaBeams are good. Would a GigaBeam or other Ubiquity wireless bridge be appropriate for this—and less of a headache than fiber?

Any guidance much appreciated!

What should I learn?

Goal : To interface with Cisco ,Junipe or Vendor agnosticr Routers and switches and get network Data ( this i am able to do barely using python and their native libraries but Just have that data in raw format only. ).

And build a website that displays real time data pulled from these Devices on Demand and real time also using SNMP/Telemetry, that can possibly also sit in a database somewhere. ......

What courses do I need to learn?. This seems a lot of resources, I would love a structured approach.

TOP, Dr.Angela 100 days python course, React course , freecodecamp, fullstackopen.

I understand it's a very vague question without the knowledge of what kind of data etc.

Note : I have other things in my list like telegraph, grafana, Prometheus ,influx DB which I'm also learning, it feels like a tutorial hell right now with all these things.

Moronic Monday!

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

How to set priority or apply qos for voice and audio on cisco 3850 switch?

There will be an important meeting via zoom and I want to make sure everything works fine (audio, video, no delays etc). I was gonna create a policy map and set police to 10 mb. Is there something else that I should do? If so, please share. The switch the laptops will connect to is 3850 and ios 16.3.