<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
Ok, we got the tunnel up and running by correcting the set up on the
RV042 (allowing it to use NAT), but we still get the "<small><font
face="Courier New">pluto_do_crypto: helper (0) is exiting</font></small>"
error messages. Any idea why?<br>
<br>
Regards,<br>
<br>
Nick<br>
<br>
On 05/04/2011 21:21, Nick Howitt wrote:
<blockquote cite="mid:4D9B79DA.9050106@gmail.com" type="cite">
<pre wrap="">Hi,
I am trying to help someone set up a tunnel between ClearOS 5.2/Openswan
2.6.21 and a Linksys RV042. The ClearOS box appears to be running
multiwan and the Linksys is behind a 1-1 NAT device with public IP
77.239.239.239 and private IP 10.162.33.69. The ipsec.conf is:
version 2.0
config setup
protostack=netkey
klipsdebug=none
plutodebug=none
interfaces=%defaultroute
oe=no
conn %default
authby=secret
type=tunnel
left=%defaultroute
leftsubnet=192.168.10.0/24
leftsourceip=192.168.10.11
conn Test
auto=add
right=77.239.239.239
rightsubnet=192.168.2.0/24
rightid=10.162.33.69
dpdtimeout=120
dpddelay=30
dpdaction=hold
rekey=no
The tunnel appears to come up and he can ping/tracert from the Linksys
LAN to the ClearOS LAN but not from the ClearOS LAN to the LAN IP of the
linksys. He is also getting the message "pluto_do_crypto: helper (0) is
exiting" a few times. This is his /var/log/secure:
Apr 5 17:28:59 gate ipsec__plutorun: Starting Pluto subsystem...
Apr 5 17:28:59 gate pluto[30912]: nss directory plutomain: /etc/ipsec.d
Apr 5 17:28:59 gate pluto[30912]: NSS Initialized
Apr 5 17:28:59 gate pluto[30912]: Non-fips mode set in
/proc/sys/crypto/fips_enabled
Apr 5 17:28:59 gate pluto[30912]: Non-fips mode set in
/proc/sys/crypto/fips_enabled
Apr 5 17:28:59 gate pluto[30912]: Starting Pluto (Openswan Version
2.6.21; Vendor ID OE~q\177kZNr}Wk) pid:30912
Apr 5 17:28:59 gate pluto[30912]: Setting NAT-Traversal port-4500
floating to off
Apr 5 17:28:59 gate pluto[30912]: port floating activation criteria
nat_t=0/port_float=1
Apr 5 17:28:59 gate pluto[30912]: including NAT-Traversal patch
(Version 0.6c) [disabled]
Apr 5 17:28:59 gate pluto[30912]: ike_alg_register_enc(): Activating
OAKLEY_TWOFISH_CBC_SSH: Ok (ret=0)
Apr 5 17:28:59 gate pluto[30912]: ike_alg_register_enc(): Activating
OAKLEY_TWOFISH_CBC: Ok (ret=0)
Apr 5 17:28:59 gate pluto[30912]: ike_alg_register_enc(): Activating
OAKLEY_SERPENT_CBC: Ok (ret=0)
Apr 5 17:28:59 gate pluto[30912]: ike_alg_register_enc(): Activating
OAKLEY_AES_CBC: Ok (ret=0)
Apr 5 17:28:59 gate pluto[30912]: ike_alg_register_enc(): Activating
OAKLEY_BLOWFISH_CBC: Ok (ret=0)
Apr 5 17:28:59 gate pluto[30912]: ike_alg_register_hash(): Activating
OAKLEY_SHA2_512: Ok (ret=0)
Apr 5 17:28:59 gate pluto[30912]: ike_alg_register_hash(): Activating
OAKLEY_SHA2_256: Ok (ret=0)
Apr 5 17:28:59 gate pluto[30912]: starting up 1 cryptographic helpers
Apr 5 17:28:59 gate pluto[30912]: main fd(10) helper fd(11)
Apr 5 17:28:59 gate pluto[30912]: started helper (thread)
pid=-1208890480 (fd:10)
Apr 5 17:28:59 gate pluto[30912]: Using Linux 2.6 IPsec interface code
on 2.6.18-194.8.1.v5 (experimental code)
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): WARNING: enc
alg=0 not found in constants.c:oakley_enc_names
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): Activating
<NULL>: Ok (ret=0)
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): WARNING: enc
alg=0 not found in constants.c:oakley_enc_names
Apr 5 17:29:00 gate pluto[30912]: ike_alg_add(): ERROR: Algorithm
already exists
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): Activating
<NULL>: FAILED (ret=-17)
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): WARNING: enc
alg=0 not found in constants.c:oakley_enc_names
Apr 5 17:29:00 gate pluto[30912]: ike_alg_add(): ERROR: Algorithm
already exists
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): Activating
<NULL>: FAILED (ret=-17)
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): WARNING: enc
alg=0 not found in constants.c:oakley_enc_names
Apr 5 17:29:00 gate pluto[30912]: ike_alg_add(): ERROR: Algorithm
already exists
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): Activating
<NULL>: FAILED (ret=-17)
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): WARNING: enc
alg=0 not found in constants.c:oakley_enc_names
Apr 5 17:29:00 gate pluto[30912]: ike_alg_add(): ERROR: Algorithm
already exists
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): Activating
<NULL>: FAILED (ret=-17)
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): WARNING: enc
alg=0 not found in constants.c:oakley_enc_names
Apr 5 17:29:00 gate pluto[30912]: ike_alg_add(): ERROR: Algorithm
already exists
Apr 5 17:29:00 gate pluto[30912]: ike_alg_register_enc(): Activating
<NULL>: FAILED (ret=-17)
Apr 5 17:29:00 gate pluto[30912]: Could not change to directory
'/etc/ipsec.d/cacerts': /
Apr 5 17:29:00 gate pluto[30912]: Could not change to directory
'/etc/ipsec.d/aacerts': /
Apr 5 17:29:00 gate pluto[30912]: Could not change to directory
'/etc/ipsec.d/ocspcerts': /
Apr 5 17:29:00 gate pluto[30912]: Could not change to directory
'/etc/ipsec.d/crls'
Apr 5 17:29:00 gate pluto[30912]: added connection description "Test"
Apr 5 17:29:00 gate pluto[30912]: listening for IKE messages
Apr 5 17:29:00 gate pluto[30912]: adding interface pptp1/pptp1
192.168.10.81:500
Apr 5 17:29:00 gate pluto[30912]: adding interface pptp0/pptp0
192.168.10.80:500
Apr 5 17:29:00 gate pluto[30912]: adding interface eth2/eth2
192.168.10.11:500
Apr 5 17:29:00 gate pluto[30912]: adding interface eth1/eth1
77.241.241.241:500
Apr 5 17:29:00 gate pluto[30912]: adding interface eth0/eth0
81.24.24.24:500
Apr 5 17:29:00 gate pluto[30912]: adding interface lo/lo 127.0.0.1:500
Apr 5 17:29:00 gate pluto[30912]: adding interface lo/lo ::1:500
Apr 5 17:29:00 gate pluto[30912]: loading secrets from "/etc/ipsec.secrets"
Apr 5 17:29:16 gate pluto[30912]: packet from 77.239.239.239:500:
received Vendor ID payload [Dead Peer Detection]
Apr 5 17:29:16 gate pluto[30912]: "Test" #1: responding to Main Mode
Apr 5 17:29:16 gate pluto[30912]: "Test" #1: transition from state
STATE_MAIN_R0 to state STATE_MAIN_R1
Apr 5 17:29:16 gate pluto[30912]: "Test" #1: STATE_MAIN_R1: sent MR1,
expecting MI2
Apr 5 17:29:16 gate pluto[30912]: pluto_do_crypto: helper (0) is exiting
Apr 5 17:29:16 gate pluto[30912]: "Test" #1: transition from state
STATE_MAIN_R1 to state STATE_MAIN_R2
Apr 5 17:29:16 gate pluto[30912]: "Test" #1: STATE_MAIN_R2: sent MR2,
expecting MI3
Apr 5 17:29:16 gate pluto[30912]: pluto_do_crypto: helper (0) is exiting
Apr 5 17:29:17 gate pluto[30912]: "Test" #1: Main mode peer ID is
ID_IPV4_ADDR: '10.162.33.69'
Apr 5 17:29:17 gate pluto[30912]: "Test" #1: transition from state
STATE_MAIN_R2 to state STATE_MAIN_R3
Apr 5 17:29:17 gate pluto[30912]: "Test" #1: STATE_MAIN_R3: sent MR3,
ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY
cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1536}
Apr 5 17:29:17 gate pluto[30912]: "Test" #1: Dead Peer Detection (RFC
3706): enabled
Apr 5 17:29:17 gate pluto[30912]: "Test" #1: the peer proposed:
192.168.10.0/24:0/0 -> 192.168.2.0/24:0/0
Apr 5 17:29:17 gate pluto[30912]: pluto_do_crypto: helper (0) is exiting
Apr 5 17:29:17 gate pluto[30912]: pluto_do_crypto: helper (0) is exiting
Apr 5 17:29:17 gate pluto[30912]: "Test" #2: responding to Quick Mode
proposal {msgid:ac547e8c}
Apr 5 17:29:17 gate pluto[30912]: "Test" #2: us:
192.168.10.0/24===77.241.241.241[+S=C]
Apr 5 17:29:17 gate pluto[30912]: "Test" #2: them:
77.239.239.239<77.239.239.239>[10.162.33.69,+S=C]===192.168.2.0/24
Apr 5 17:29:17 gate pluto[30912]: "Test" #2: transition from state
STATE_QUICK_R0 to state STATE_QUICK_R1
Apr 5 17:29:17 gate pluto[30912]: "Test" #2: STATE_QUICK_R1: sent QR1,
inbound IPsec SA installed, expecting QI2
Apr 5 17:29:17 gate pluto[30912]: "Test" #2: Dead Peer Detection (RFC
3706): enabled
Apr 5 17:29:17 gate pluto[30912]: "Test" #2: transition from state
STATE_QUICK_R1 to state STATE_QUICK_R2
Apr 5 17:29:17 gate pluto[30912]: "Test" #2: STATE_QUICK_R2: IPsec SA
established tunnel mode {ESP=>0x9c07f38b <0x33bfc5e0
xfrm=3DES_0-HMAC_MD5 NATOA=none NATD=none DPD=enabled}
Do you know why he is getting the error message and have you any idea
why ping/tracert only works in one direction? Could multiwan be messing
things up? In a multiwan environment is "interfaces=%defaultroute" a
good configuration statement?
Thanks,
Nick
_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a class="moz-txt-link-freetext" href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
</body>
</html>