<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
Hello all<br>
<br>
I setup a gateway eth0 is WAN eth1 is LAN<br>
Enabled the ip_forward and do the masquerade using iptables rules.<br>
After that, the client connect to the LAN can surf internet normally.<br>
Then i started to build the ipsec tunnel between client and LAN<br>
<br>
client 10.1.1.2 ------ LAN(eth1) 10.1.1.1 ----- WAN(eth0) ----- internet<br>
<br>
IPSec tunnel seems ok when i using the ipsec eroute, ipsec whack
--status.<br>
I can see the tunnel is built.<br>
I had captured the ESP packet from eth1 when the client doing the ping
(but always got the time out).<br>
<br>
But the client can not surf the internet anymore, even can not ping the
LAN interface.<br>
I ran the ipsec verify and got some failed message.<br>
Any idea?<br>
<br>
/etc # ipsec verify<br>
Checking your system to see if IPsec got installed and started
correctly:<br>
Version check and ipsec on-path [OK]<br>
Linux Openswan U2.4.9/K2.4.7 (klips)<br>
Checking for IPsec support in kernel [OK]<br>
KLIPS detected, checking for NAT Traversal support [FAILED]<br>
Checking for RSA private key (/etc/ipsec.secrets)
[DISABLED]<br>
ipsec showhostkey: no default key in "/etc/ipsec.secrets"<br>
Checking that pluto is running [OK]<br>
Two or more interfaces found, checking IP forwarding [OK]<br>
<b><big>Checking NAT and MASQUERADEing<br>
Checking <a class="moz-txt-link-abbreviated" href="mailto:tun0x1020@10.1.1.2:10">tun0x1020@10.1.1.2:10</a> from 0.0.0.0/0:258 to 0.0.0.0/0 [FAILED]<br>
MASQUERADE from 0.0.0.0/0 to 0.0.0.0/0 kills tunnel 0.0.0.0/0 ->
0.0.0.0/0</big></b><br>
Checking for 'ip' command [OK]<br>
Checking for 'iptables' command [OK]<br>
Opportunistic Encryption Support
[DISABLED]<br>
<br>
<br>
/etc # ipsec eroute<br>
0 0.0.0.0/0:258 -> 0.0.0.0/0 =>
<a class="moz-txt-link-abbreviated" href="mailto:tun0x1022@10.1.1.2:10">tun0x1022@10.1.1.2:10</a><br>
<br>
<br>
/etc # ipsec whack --status<br>
000 interface ipsec0/eth1 10.1.1.1<br>
000 %myid = (none)<br>
000 debug
raw+crypt+parsing+emitting+control+lifecycle+klips+dns+oppo+controlmore+pfkey+nattraversal+x509<br>
000<br>
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64,
keysizemin=192, keysizemax=192<br>
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128,
keysizemin=128, keysizemax=256<br>
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,
keysizemin=128, keysizemax=128<br>
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,
keysizemin=160, keysizemax=160<br>
000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC,
keysizemin=128, keysizemax=128<br>
000<br>
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8,
keydeflen=192<br>
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16,
keydeflen=128<br>
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<br>
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<br>
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<br>
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072<br>
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<br>
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<br>
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192<br>
000<br>
000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0}
trans={0,0,0} attrs={0,0,0}<br>
000<br>
000 "conn_10.1.1.2": 0.0.0.0/0===10.1.1.1...10.1.1.2; erouted; eroute
owner: #29<br>
000 "conn_10.1.1.2": srcip=unset; dstip=unset; srcup=ipsec _updown;
dstup=ipsec _updown;<br>
000 "conn_10.1.1.2": ike_life: 28800s; ipsec_life: 86400s;
rekey_margin: 600s; rekey_fuzz: 100%; keyingtries: 15<br>
000 "conn_10.1.1.2": policy:
PSK+ENCRYPT+TUNNEL+DONTREKEY+failureDROP; prio: 32,0; interface: eth1;
encap: esp;<br>
000 "conn_10.1.1.2": dpd: action:clear; delay:10; timeout:15;<br>
000 "conn_10.1.1.2": newest ISAKMP SA: #28; newest IPsec SA: #29;<br>
000 "conn_10.1.1.2": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024<br>
000 "conn_10.1.1.2": ESP algorithms wanted: 3DES(3)_000-MD5(1);
flags=strict<br>
000 "conn_10.1.1.2": ESP algorithms loaded: 3DES(3)_000-MD5(1);
flags=strict<br>
000 "conn_10.1.1.2": ESP algorithm newest: 3DES_0-HMAC_MD5;
pfsgroup=<N/A><br>
000<br>
000 #13: "conn_10.1.1.2":500 STATE_QUICK_R2 (IPsec SA established);
EVENT_SA_EXPIRE in 22741s<br>
000 #13: "conn_10.1.1.2" <a class="moz-txt-link-abbreviated" href="mailto:esp.c1a98394@10.1.1.2">esp.c1a98394@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:esp.cb8d934f@10.1.1.1">esp.cb8d934f@10.1.1.1</a>
<a class="moz-txt-link-abbreviated" href="mailto:tun.1010@10.1.1.2">tun.1010@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:tun.100f@10.1.1.1">tun.100f@10.1.1.1</a><br>
000 #23: "conn_10.1.1.2":500 STATE_QUICK_R2 (IPsec SA established);
EVENT_SA_EXPIRE in 25994s<br>
000 #23: "conn_10.1.1.2" <a class="moz-txt-link-abbreviated" href="mailto:esp.18d03de8@10.1.1.2">esp.18d03de8@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:esp.cb8d9355@10.1.1.1">esp.cb8d9355@10.1.1.1</a>
<a class="moz-txt-link-abbreviated" href="mailto:tun.101c@10.1.1.2">tun.101c@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:tun.101b@10.1.1.1">tun.101b@10.1.1.1</a><br>
000 #16: "conn_10.1.1.2":500 STATE_QUICK_R2 (IPsec SA established);
EVENT_SA_EXPIRE in 23464s<br>
000 #16: "conn_10.1.1.2" <a class="moz-txt-link-abbreviated" href="mailto:esp.6ae0bf12@10.1.1.2">esp.6ae0bf12@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:esp.cb8d9351@10.1.1.1">esp.cb8d9351@10.1.1.1</a>
<a class="moz-txt-link-abbreviated" href="mailto:tun.1014@10.1.1.2">tun.1014@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:tun.1013@10.1.1.1">tun.1013@10.1.1.1</a><br>
000 #19: "conn_10.1.1.2":500 STATE_QUICK_R2 (IPsec SA established);
EVENT_SA_EXPIRE in 24182s<br>
000 #19: "conn_10.1.1.2" <a class="moz-txt-link-abbreviated" href="mailto:esp.452af3ba@10.1.1.2">esp.452af3ba@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:esp.cb8d9353@10.1.1.1">esp.cb8d9353@10.1.1.1</a>
<a class="moz-txt-link-abbreviated" href="mailto:tun.1018@10.1.1.2">tun.1018@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:tun.1017@10.1.1.1">tun.1017@10.1.1.1</a><br>
000 #29: "conn_10.1.1.2":500 STATE_QUICK_R2 (IPsec SA established);
EVENT_SA_EXPIRE in 28437s; newest IPSEC; eroute owner<br>
000 #29: "conn_10.1.1.2" <a class="moz-txt-link-abbreviated" href="mailto:esp.5af5ac65@10.1.1.2">esp.5af5ac65@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:esp.cb8d9358@10.1.1.1">esp.cb8d9358@10.1.1.1</a>
<a class="moz-txt-link-abbreviated" href="mailto:tun.1022@10.1.1.2">tun.1022@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:tun.1021@10.1.1.1">tun.1021@10.1.1.1</a><br>
000 #28: "conn_10.1.1.2":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA
established); EVENT_SA_EXPIRE in 237s; newest ISAKMP; nodpd<br>
000 #10: "conn_10.1.1.2":500 STATE_QUICK_R2 (IPsec SA established);
EVENT_SA_EXPIRE in 22023s<br>
000 #10: "conn_10.1.1.2" <a class="moz-txt-link-abbreviated" href="mailto:esp.15501ec1@10.1.1.2">esp.15501ec1@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:esp.cb8d934d@10.1.1.1">esp.cb8d934d@10.1.1.1</a>
<a class="moz-txt-link-abbreviated" href="mailto:tun.100c@10.1.1.2">tun.100c@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:tun.100b@10.1.1.1">tun.100b@10.1.1.1</a><br>
000 #3: "conn_10.1.1.2":500 STATE_QUICK_R2 (IPsec SA established);
EVENT_SA_EXPIRE in 19656s<br>
000 #3: "conn_10.1.1.2" <a class="moz-txt-link-abbreviated" href="mailto:esp.e933b482@10.1.1.2">esp.e933b482@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:esp.cb8d9349@10.1.1.1">esp.cb8d9349@10.1.1.1</a>
<a class="moz-txt-link-abbreviated" href="mailto:tun.1004@10.1.1.2">tun.1004@10.1.1.2</a> <a class="moz-txt-link-abbreviated" href="mailto:tun.1003@10.1.1.1">tun.1003@10.1.1.1</a><br>
000<br>
<br>
<br>
<br>
<br>
Best regards.<br>
<br>
</body>
</html>