Hey guys,<br><br>first of all my english is not the best ;)<br><br><br>Well i've got a huge IPSec-Problem....<br><br>I've tried to set up the following scenario:<br><br><br>client1: 192.168.240.50 ----> vpn-router1: 82.144.x.130 -->|-------TUNNEL-------|<-- vpn-router2: 82.113.x.27 ----> client2: 82.113.x.65<br>
<br>My vpn-router1 has 3 network-cards:<br><br>eth0 with 10.254.0.1<br>eth1 with 10.254.0.2<br>eth2 with 82.144.x.130<br><br><br>Note: I don't have any access on vpn-router2, because it is a router from a different network.<br>
<br>The Tunnel between vpn-router1 and vpn-router2 is setup correctly, because i'll get an "ISAKMP SA established" - Message.<br><br>So i tried to ping from my vpn-router1 to vpn-router2 and it works, BUT as i did a traceroute to vpn-router2, i noticed<br>
that all the traffic goes through the internet and not through the ipsec-tunnel. I believe this is an routing issue, but i can't figure what<br>is going wrong.<br><br>So any help will preciated ;)<br><br>Here are my configs:<br>
<br>/etc/ipsec.d/vpn-conf:<br><br>conn o2<br> authby=secret<br> left=82.144.x.130<br> leftsubnet=<a href="http://192.168.240.50/32">192.168.240.50/32</a><br> #<br> right=82.113.x.27<br> rightsubnet=82.113.x.65/32<br>
rightnexthop=<br> #<br> ike=3des-sha1<br> esp=3des-sha1<br> pfsgroup=modp1024<br> #<br> auto=add<br><br><br>Output from "route -n":<br><br>Kernel-IP-Routentabelle<br>
Ziel Router Genmask Flags Metric Ref Use Iface<br>82.113.x.65 0.0.0.0 255.255.255.255 UH 0 0 0 eth2<br>192.168.240.1 10.254.0.6 255.255.255.255 UGH 0 0 0 eth0<br>
192.168.240.2 0.0.0.0 255.255.255.255 UH 0 0 0 eth2<br>192.168.200.44 10.254.0.4 255.255.255.255 UGH 0 0 0 eth0<br>192.168.240.45 10.254.0.6 255.255.255.255 UGH 0 0 0 eth0<br>
192.168.225.1 10.254.0.4 255.255.255.255 UGH 0 0 0 eth0<br>192.168.200.1 10.254.0.4 255.255.255.255 UGH 0 0 0 eth0<br>10.254.0.11 10.254.0.2 255.255.255.255 UGH 0 0 0 eth0<br>
212.6.x.0 0.0.0.0 255.255.255.240 U 0 0 0 eth2<br>82.144.x.128 0.0.0.0 255.255.255.240 U 0 0 0 eth2<br>192.168.240.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2<br>
192.168.7.0 10.254.0.11 255.255.255.0 UG 0 0 0 eth0<br>192.168.100.0 10.254.0.11 255.255.255.0 UG 0 0 0 eth0<br>192.168.6.0 10.254.0.11 255.255.255.0 UG 0 0 0 eth0<br>
192.168.225.0 10.254.0.4 255.255.255.0 UG 0 0 0 eth0<br>192.168.5.0 10.254.0.11 255.255.255.0 UG 0 0 0 eth0<br>192.168.4.0 10.254.0.11 255.255.255.0 UG 0 0 0 eth0<br>
192.168.210.0 10.254.0.6 255.255.255.0 UG 0 0 0 eth0<br>192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2<br>192.168.245.0 10.254.0.6 255.255.255.0 UG 0 0 0 eth0<br>
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 dummy0<br>192.168.230.0 10.254.0.8 255.255.255.0 UG 30 0 0 eth0<br>192.168.0.0 10.254.0.5 255.255.255.0 UG 0 0 0 eth0<br>
192.168.200.0 10.254.0.4 255.255.255.0 UG 0 0 0 eth0<br>10.254.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0<br>10.254.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1<br>
192.168.120.0 10.254.0.8 255.255.255.0 UG 20 0 0 eth0<br>10.254.4.0 10.254.0.7 255.255.255.0 UG 20 0 0 eth0<br>10.10.0.0 10.254.0.8 255.255.248.0 UG 0 0 0 eth0<br>
0.0.0.0 82.144.x.129 0.0.0.0 UG 100 0 0 eth2<br><br><br>The Output from ipsec auto --up vpn-conf:<br><br>root@vpn-router1:~# ipsec auto --up vpn-conf<br>104 "o2" #1: STATE_MAIN_I1: initiate<br>
003 "o2" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] method set to=108<br>106 "o2" #1: STATE_MAIN_I2: sent MI2, expecting MR2<br>003 "o2" #1: received Vendor ID payload [Cisco-Unity]<br>
003 "o2" #1: received Vendor ID payload [Dead Peer Detection]<br>003 "o2" #1: ignoring unknown Vendor ID payload [aa9f2d2a2ca9c8697632c1290dfa7179]<br>003 "o2" #1: received Vendor ID payload [XAUTH]<br>
003 "o2" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected<br>108 "o2" #1: STATE_MAIN_I3: sent MI3, expecting MR3<br>004 "o2" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}<br>
117 "o2" #2: STATE_QUICK_I1: initiate<br>003 "o2" #2: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME<br>004 "o2" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x490d945d <0x35ccf61f xfrm=3DES_0-HMAC_SHA1 NATD=none DPD=none}<br>
<br><br>Output from "iptables-save":<br><br>root@vpn-router1:~# iptables-save<br># Generated by iptables-save v1.4.1.1 on Fri Oct 9 20:34:10 2009<br>*nat<br>:PREROUTING ACCEPT [12356738:1126281944]<br>:POSTROUTING ACCEPT [199775:13301675]<br>
:OUTPUT ACCEPT [39239:3256355]<br>:or10er - [0:0]<br>-A PREROUTING -p tcp -m tcp --dport 22022 -j DNAT --to-destination <a href="http://192.168.240.130:22">192.168.240.130:22</a><br>-A PREROUTING -p tcp -m tcp --dport 22023 -j DNAT --to-destination <a href="http://192.168.240.131:22">192.168.240.131:22</a><br>
-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 8081 -j DNAT --to-destination <a href="http://192.168.210.210:8081">192.168.210.210:8081</a><br>-A PREROUTING -d <a href="http://192.168.2.4/32">192.168.2.4/32</a> -j DNAT --to-destination 192.168.0.4<br>
-A PREROUTING -d <a href="http://192.168.2.3/32">192.168.2.3/32</a> -j DNAT --to-destination 192.168.0.3<br>-A PREROUTING -d <a href="http://192.168.2.5/32">192.168.2.5/32</a> -j DNAT --to-destination 192.168.0.5<br>-A PREROUTING -d <a href="http://192.168.2.10/32">192.168.2.10/32</a> -j DNAT --to-destination 192.168.0.10<br>
-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 17971 -j DNAT --to-destination <a href="http://192.168.240.94:80">192.168.240.94:80</a><br>-A PREROUTING -d <a href="http://192.168.2.150/32">192.168.2.150/32</a> -j DNAT --to-destination 192.168.245.150<br>
-A PREROUTING -d <a href="http://192.168.2.151/32">192.168.2.151/32</a> -j DNAT --to-destination 192.168.245.151<br>-A PREROUTING -d <a href="http://192.168.2.235/32">192.168.2.235/32</a> -j DNAT --to-destination 192.168.240.235<br>
-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 21 -j DNAT --to-destination <a href="http://192.168.240.50:21">192.168.240.50:21</a><br>-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 20 -j DNAT --to-destination <a href="http://192.168.240.50:20">192.168.240.50:20</a><br>
-A PREROUTING -i eth2 -p tcp -m tcp --dport 2000:30000 -j DNAT --to-destination 192.168.0.10<br>-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination <a href="http://192.168.0.10:80">192.168.0.10:80</a><br>
-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 4434 -j DNAT --to-destination <a href="http://192.168.0.10:4434">192.168.0.10:4434</a><br>-A POSTROUTING -s 212.6.x.0/28 -d <a href="http://192.168.245.0/24">192.168.245.0/24</a> -j MASQUERADE<br>
-A POSTROUTING -s <a href="http://192.168.3.0/24">192.168.3.0/24</a> -d <a href="http://192.168.0.0/24">192.168.0.0/24</a> -j MASQUERADE<br>-A POSTROUTING -o eth2 -j MASQUERADE<br>-A POSTROUTING -d <a href="http://192.168.240.94/32">192.168.240.94/32</a> -j MASQUERADE<br>
-A POSTROUTING -d <a href="http://192.168.0.10/32">192.168.0.10/32</a> -o eth0 -j MASQUERADE<br>-A POSTROUTING -d <a href="http://192.168.0.10/32">192.168.0.10/32</a> -o eth1 -j MASQUERADE<br>COMMIT<br># Completed on Fri Oct 9 20:34:10 2009<br>
# Generated by iptables-save v1.4.1.1 on Fri Oct 9 20:34:10 2009<br>*mangle<br>:PREROUTING ACCEPT [1579535223:989589268388]<br>:INPUT ACCEPT [13365691:2167215608]<br>:FORWARD ACCEPT [1565049027:987281194415]<br>:OUTPUT ACCEPT [2091035:339136033]<br>
:POSTROUTING ACCEPT [1566938084:987591423846]<br>COMMIT<br># Completed on Fri Oct 9 20:34:10 2009<br># Generated by iptables-save v1.4.1.1 on Fri Oct 9 20:34:10 2009<br>*filter<br>:INPUT ACCEPT [13329201:2164008631]<br>
:FORWARD ACCEPT [1564853173:987158653555]<br>:OUTPUT ACCEPT [1888870:310192555]<br>COMMIT<br># Completed on Fri Oct 9 20:34:10 2009<br><br><br>I hope you can help me with this problem...<br><br><br>Greetz to you<br><br>Steven<br>