<span class="gmail_quote"><br></span>Hi all, I'm a newbie in ipsec issues, and I'm hanged up with a problem. I was able to configure the tunnel, but the tunnel is only working in one way. Let me show you the net topology and the configuration files:
<br><br>Network:<br><br><a href="http://10.1.2.0/24-------192.168.2.2====TUNNEL====192.168.2.1---------192.168.1.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.1.2.0/24-------192.168.2.2====TUNNEL====192.168.2.1---------192.168.1.0/24
</a><br><br><br>The left box is a Ubuntu linux with kernel 2.6.17 with NETKEY openswan version 2.4.7, the left box is an openwrt device with kernel 2.6.19 and KLIPS 2.4.7. The two machines are connected directly one to the other.
<br><br>I have a virtual interface in the left box with IP <a href="http://10.1.2.3" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.1.2.3</a>.<br><br>#################################<br>#IFCONFIG #
<br>########<br>eth1 Link encap:Ethernet HWaddr 00:16:17:C7:E4:EC<br> inet addr:<a href="http://192.168.2.2" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.2.2</a> Bcast:
<a href="http://192.168.2.255" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.2.255</a> Mask:<a href="http://255.255.255.0" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
255.255.255.0</a><br> inet6 addr: fe80::216:17ff:fec7:e4ec/64 Scope:Link<br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> RX packets:25332 errors:0 dropped:0 overruns:0 frame:0
<br> TX packets:359042 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:1000<br> RX bytes:3824929 (3.6 MiB) TX bytes:55525791 (52.9 MiB)<br> Interrupt:177
<br><br>eth1:1 Link encap:Ethernet HWaddr 00:16:17:C7:E4:EC<br> inet addr:<a href="http://10.1.2.3" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.1.2.3</a> Bcast:<a href="http://10.1.2.255" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
10.1.2.255</a> Mask:<a href="http://255.255.255.0" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> 255.255.255.0</a><br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
Interrupt:177<br><br>###################################<br><br>The RIGHT box has the following config <br><br><br>eth0.1 Link encap:Ethernet HWaddr 00:30:AB:28:38:9E<br> inet addr:
<a href="http://192.168.2.1" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.2.1</a> Bcast:<a href="http://192.168.2.255" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
192.168.2.255</a> Mask:<a href="http://255.255.255.0" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> 255.255.255.0</a><br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
RX packets:7485 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:2627 errors:0 dropped:0 overruns:0 carrier:0 <br> collisions:0 txqueuelen:5<br> RX bytes:2701698 (
2.5 MiB) TX bytes:1032886 (1008.6 KiB)<br><br>br-lan Link encap:Ethernet HWaddr 00:30:AB:28:38:9F<br> inet addr: <a href="http://192.168.1.1" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
192.168.1.1</a> Bcast:<a href="http://192.168.1.255" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.1.255</a> Mask:<a href="http://255.255.255.0" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
255.255.255.0</a><br> UP BROADCAST RUNNING MULTICAST MTU:2290 Metric:1 <br> RX packets:0 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
<br> collisions:0 txqueuelen:0<br> RX bytes:0 ( 0.0 B) TX bytes:0 (0.0 B)<br><br>The machine connected to the br-lan of the right box has the ip <a href="http://192.168.1.2" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
192.168.1.2</a>.<br><br>In the right and the left machine iptables are empty and their policies are ACCEPT by default. In the Right box I have ip_forward activated. <br><br>----------------------------------------------------------------------------
<br><br>Ok that's the network configuration, now I want to show you the ipsec.conf and the ipsec.secrets config files:<br><br>LEFT BOX: <br><br>#ipsec.conf<br>config setup<br> interfaces=%defaultroute<br> klipsdebug=none
<br> plutodebug=none<br><br>conn tunnconn<br> type=tunnel<br> left=<a href="http://192.168.2.2" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.2.2</a> <br> leftnexthop=
<a href="http://192.168.2.1" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.2.1</a><br> right=<a href="http://192.168.2.1" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
192.168.2.1</a><br> rightnexthop=<a href="http://192.168.2.2" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.2.2</a><br> leftsubnet=<a href="http://10.1.2.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
10.1.2.0/24</a><br> rightsubnet=<a href="http://192.168.1.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.1.0/24</a><br> esp=3des-md5-96<br> authby=secret<br> auto=start
<br><br>##############<br><br># ipsec.secrets<br><br><a href="http://192.168.2.2" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> 192.168.2.2</a> <a href="http://192.168.2.1" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
192.168.2.1</a>: PSK "test"<br><br>###################<br><br>The configuration in the left box is the same like this but now left* is right* and vice versa.<br><br>########### <br><br>Ok, well so with this escenary working having a look to /var/log/auth.log I can see how the tunnel is stablished between the two boxes, the first phase is succesful and the second is succesful too. And once stablished I made the first test, pinging from
<a href="http://10.1.2.3" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.1.2.3</a> to <a href="http://192.168.1.1" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.1.1
</a><br><br><br><br><br><br><br><br><br>