Hundreds of connections from WinGate proxy serv host machine

Sep 21 05 6:44 pm

My Wingate proxy server host machine is giving hundreds of connections. Also, Memory & CPU usage is near to 100%.

I am not able to restart or stop wingate service. It gives error message

Could not stop the Qbik WinGate Engine service on Local Computer.

Error 1053: The service did not respond to the start or control request in a timely fashion.

This is the configuration report for my Wingate host machine :

WINGATE CONFIGURATION REPORT
1.02 Wednesday, September 21, 2005, 10:41
1.03
1.04 ---------------------------------------------
1.05 WinGate Engine
1.06 ---------------------------------------------
1.07 WinGate 6.0.4 (Build 1025)
1.08 Operating System: Windows 2000 (NT 5.0)
1.09 Language:
1.10 User database: WinGate
1.11 Num. users: 3
1.12
1.13
2.01 ---------------------------------------------
2.02 Licence keys
2.03 ---------------------------------------------
2.04 License Key 1: XXX-5UUDMEK6-U07TE1HR-U03JU720
2.05
3.01 ---------------------------------------------
3.02 Licence details
3.03 ---------------------------------------------
3.04 License Key 1
3.05 Version: WinGate 6 Professional 50 concurrent users
3.06 Expiry: None
3.07
4.01 ---------------------------------------------
4.02 Dialer information
4.03 ---------------------------------------------
4.04 Dialer is disabled
4.05
5.01 ---------------------------------------------
5.02 Network Interfaces
5.03 ---------------------------------------------
5.04 Internal (Ethernet) internal
5.05 External (Ethernet) external
5.06 MS TCP Loopback interface (Loopback)
5.07
6.01 ---------------------------------------------
6.02 Services
6.03 ---------------------------------------------
6.04
6.05 System Policies
6.06 ---------------------------------------------
6.07 Default System Access Rights:
6.08 Everyone - Unrestricted rights
6.09 Default Start/Stop Rights:
6.10 Administrators - Unrestricted rights
6.11 Default Edit Rights:
6.12 Administrators - Unrestricted rights
6.13
6.14 Telnet Proxy server (Telnet Proxy server)
6.15 ---------------------------------------------
6.16 Session Timeout: 60
6.17 Port: 23
6.18 Startup: Automatic start/stop
6.19 Access Rights: Defaults: are ignored
6.20 Start/Stop Rights: Defaults: may be used instead
6.21 Edit Rights: Defaults: may be used instead
6.22
6.23 WWW Proxy server (WWW Proxy server)
6.24 ---------------------------------------------
6.25 Session Timeout: 60
6.26 Port: 80
6.27 Startup: Automatic start/stop
6.28 Access Rights: Defaults: may be used instead
6.29 Start/Stop Rights: Defaults: may be used instead
6.30 Edit Rights: Defaults: may be used instead
6.31
6.32 DHCP Service (DHCP Service)
6.33 ---------------------------------------------
6.34 Session Timeout: 60
6.35 Port: 67
6.36 Startup: Automatic start/stop
6.37 Access Rights: Defaults: may be used instead
6.38 Everyone - Unrestricted rights
6.39 Start/Stop Rights: Defaults: may be used instead
6.40 Edit Rights: Defaults: may be used instead
6.41
6.42 Winsock Redirector Service (Winsock Redirector Service)
6.43 ---------------------------------------------
6.44 Session Timeout: 600
6.45 Port: 2080
6.46 Startup: Automatic start/stop
6.47 Access Rights: Defaults: may be used instead
6.48 Start/Stop Rights: Defaults: may be used instead
6.49 Edit Rights: Defaults: may be used instead
6.50
6.51 FTP Proxy server (FTP Proxy server)
6.52 ---------------------------------------------
6.53 Session Timeout: 60
6.54 Port: 21
6.55 Startup: Automatic start/stop
6.56 Access Rights: Defaults: may be used instead
6.57 Start/Stop Rights: Defaults: may be used instead
6.58 Edit Rights: Defaults: may be used instead
6.59
6.60 SOCKS Proxy server (SOCKS Proxy server)
6.61 ---------------------------------------------
6.62 Session Timeout: 60
6.63 Port: 1080
6.64 Startup: Automatic start/stop
6.65 Access Rights: Defaults: may be used instead
6.66 Start/Stop Rights: Defaults: may be used instead
6.67 Edit Rights: Defaults: may be used instead
6.68
6.69 POP3 Server (POP3 Server)
6.70 ---------------------------------------------
6.71 Session Timeout: 120
6.72 Port: 110
6.73 Startup: Disabled
6.74 Access Rights: Defaults: may be used instead
6.75 Start/Stop Rights: Defaults: may be used instead
6.76 Edit Rights: Defaults: may be used instead
6.77
6.78 SMTP Server (SMTP Server)
6.79 ---------------------------------------------
6.80 Session Timeout: 300
6.81 Port: 25
6.82 Startup: Disabled
6.83 Access Rights: Defaults: may be used instead
6.84 Start/Stop Rights: Defaults: may be used instead
6.85 Edit Rights: Defaults: may be used instead
6.86
6.87 GDP Service (GDP Service)
6.88 ---------------------------------------------
6.89 Session Timeout: 60
6.90 Port: 368
6.91 Startup: Automatic start/stop
6.92 Access Rights: Defaults: may be used instead
6.93 Start/Stop Rights: Defaults: may be used instead
6.94 Edit Rights: Defaults: may be used instead
6.95
6.96 DNS Service (DNS Service)
6.97 ---------------------------------------------
6.98 Session Timeout: 60
6.99 Port: 53
6.100 Startup: Disabled
6.101 Access Rights: Defaults: may be used instead
6.102 Start/Stop Rights: Defaults: may be used instead
6.103 Edit Rights: Defaults: may be used instead
6.104
6.105 WWW Server for viewing log files (Logfile Server)
6.106 ---------------------------------------------
6.107 Session Timeout: 60
6.108 Port: 8010
6.109 Startup: Automatic start/stop
6.110 Access Rights: Defaults: may be used instead
6.111 Start/Stop Rights: Defaults: may be used instead
6.112 Edit Rights: Defaults: may be used instead
6.113
6.114 Remote Control Service (Remote Control Service)
6.115 ---------------------------------------------
6.116 Session Timeout: 60
6.117 Port: 808
6.118 Startup: Automatic start/stop
6.119 Access Rights: Defaults: may be used instead
6.120 Start/Stop Rights: Defaults: may be used instead
6.121 Edit Rights: Defaults: may be used instead
6.122
7.01 ---------------------------------------------
7.02 System Route Table
7.03 ---------------------------------------------
7.04 Current Route Table:
7.05 ---------------------------------------------
7.06 Network Mask Gateway Interface Metric
7.07 0.0.0.0 0.0.0.0 203.124.159.25 203.124.159.27 1
7.08 0.0.0.0 0.0.0.0 203.124.159.27 192.168.100.21 1
7.09 69.57.130.0 255.255.255.248 203.124.159.25 203.124.159.27 1
7.10 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
7.11 192.168.100.0 255.255.255.0 192.168.100.21 192.168.100.21 1
7.12 192.168.100.21 255.255.255.255 127.0.0.1 127.0.0.1 1
7.13 192.168.100.255 255.255.255.255 192.168.100.21 192.168.100.21 1
7.14 203.124.159.24 255.255.255.248 203.124.159.27 203.124.159.27 1
7.15 203.124.159.27 255.255.255.255 127.0.0.1 127.0.0.1 1
7.16 203.124.159.255 255.255.255.255 203.124.159.27 203.124.159.27 1
7.17 224.0.0.0 224.0.0.0 192.168.100.21 192.168.100.21 1
7.18 224.0.0.0 224.0.0.0 203.124.159.27 203.124.159.27 1
7.19 255.255.255.255 255.255.255.255 203.124.159.27 203.124.159.27 1
7.20
8.01 ---------------------------------------------
8.02 Enhanced Network Support
8.03 ---------------------------------------------
8.04 Enhanced Network Support: Qbik NDIS Hook 6.0 - Installed and active
8.05 Driver: Enabled
8.06 NAT: Enabled
8.07 Router: Enabled
8.08 Firewall level: Disabled
8.09
8.10 Routing
8.11 ---------------------------------------------
8.12 Multiple default routes: Enabled
8.13 Relay UDP broadcast packets: Enabled
8.100
8.101 Port Security
8.102 ---------------------------------------------
8.103
8.104 Security for: External TCP
8.105 Action: Allow Port: 113 - AUTH
8.106 Action: Allow Port: 1024 - 4096 - External
8.107
8.108 Security for: External UDP
8.109
8.110 Security for: Internal TCP
8.111 Action: Allow Port: 21 - Hole for FTP Proxy server (Auto)
8.112 Action: Allow Port: 23 - Hole for Telnet Proxy server (Auto)
8.113 Action: Allow Port: 80 - Hole for WWW Proxy server (Auto)
8.114 Action: Allow Port: 808 - Hole for Remote Control Service (Auto)
8.115 Action: Allow Port: 1080 - Hole for SOCKS Proxy server (Auto)
8.116 Action: Allow Port: 2080 - Hole for Winsock Redirector Service (Auto)
8.117 Action: Allow Port: 8010 - Hole for Logfile Server (Auto)
8.118
8.119 Security for: Internal UDP
8.120 Action: Allow Port: 0 - Hole for Dialer Monitor (Auto)
8.121 Action: Allow Port: 67 - Hole for DHCP Service (Auto)
8.122 Action: Allow Port: 368 - Hole for GDP Service (Auto)
8.123
8.124 Security for: NAT TCP
8.125 Action: Redirect Port: 23 - Intercepted by Telnet Proxy server
8.126 Action: Redirect Port: 80 - Intercepted by WWW Proxy server
8.127 Action: Redirect Port: 82 - Intercepted by WWW Proxy server
8.128 Action: Redirect Port: 1080 - Intercepted by WWW Proxy server
8.129 Action: Redirect Port: 2080 - Intercepted by WWW Proxy server
8.130 Action: Redirect Port: 8088 - Intercepted by WWW Proxy server
8.131
8.132 Security for: NAT UDP
8.133
8.134 Security for: DMZ TCP
8.135
8.136 Security for: DMZ UDP
8.137
8.138 Security for: (unknown)
8.139
8.140 Security for: (unknown)
8.500
9.01 ---------------------------------------------
9.02 END OF CONFIGURATION REPORT

Sep 21 05 7:35 pm

My guess is your second default route screws things up - remove it from your adapters settings

7.08 0.0.0.0 0.0.0.0 203.124.159.27 192.168.100.21 1

Sep 21 05 8:44 pm

1. Also, are you using Active Directory?
2. Do you see endless DNS requests in the Activity Windows of GateKeeper? (GateKeeper --> Veiw menu --> Activity)
3. Where is the DNS server located?

* Some AD info is available in our KnowledgeBase: http://support.qbik.com/index.php?_a=kn ... ubcat&_i=1

Sep 21 05 10:06 pm

genie wrote:My guess is your second default route screws things up - remove it from your adapters settings

7.08 0.0.0.0 0.0.0.0 203.124.159.27 192.168.100.21 1

nope.. everything was working fine till yesterday...

Ani.

Sep 21 05 10:08 pm

So what's changed since yesterday? Any configuration parameters whether system or Wingate?

Sep 22 05 1:27 am

genie wrote:So what's changed since yesterday? Any configuration parameters whether system or Wingate?

Nothing has changed actually... that's the weirdest part of it all.

What we've done now is, we've enabled the firewall and opened only those ports that are required. That seems to have taken care of the problem for the time being. Let's see how things go.

Thanks.

Ani.

Sep 22 05 3:44 am

Now most of the things seem to be working fine since we enabled the firewall, except for:

1. Messages on MSN are either getting dropped or are being delivered after some delay.
2. We cannot make a connection to a secure FTP server hosted at the client site. We are SSL Implicit connection on port 990, with passive mode disabled. the same settings work fine when the firewall is disabled but not when enabled. The problem is that while the SSL exchange is being handled successfully, the connection is getting stuck when it tries to display the file/folder list on the remote server.

Any clues?

Thanks.

Ani.