UDP 500 and 4500 are open through the EC2 security group and I'm running a standard Ubuntu image that by default does not lock down any ports, something just has to be listening there. I think we've found the actual problem in that no traffic is being NAT'ed through 4500, but I'm still at a loss as to how to make it happen.<div>
<br></div><div>My verify looks good:</div><div><div>Version check and ipsec on-path [OK]</div><div>Linux Openswan U2.6.23/K2.6.32-317-ec2 (netkey)</div><div>Checking for IPsec support in kernel [OK]</div>
<div>NETKEY detected, testing for disabled ICMP send_redirects [OK]</div><div>NETKEY detected, testing for disabled ICMP accept_redirects [OK]</div><div>Checking for RSA private key (/etc/ipsec.secrets) [OK]</div>
<div>Checking that pluto is running [OK]</div><div>Pluto listening for IKE on udp 500 [OK]</div><div>Pluto listening for NAT-T on udp 4500 [OK]</div>
<div>Two or more interfaces found, checking IP forwarding [OK]</div><div>Checking NAT and MASQUERADEing</div><div>Checking for 'ip' command [OK]</div><div>Checking for 'iptables' command [OK]</div>
<div>Opportunistic Encryption Support [DISABLED]</div><div><br></div>My netstat isn't showing anything from 500 or 4500- should it?</div><div><div>tcp 0 0 <a href="http://0.0.0.0:22">0.0.0.0:22</a> 0.0.0.0:* LISTEN</div>
<div>tcp6 0 0 :::22 :::* LISTEN</div><div>unix 2 [ ACC ] STREAM LISTENING 53519 /var/run/pluto/pluto.ctl</div><div>unix 2 [ ACC ] STREAM LISTENING 53521 /var/run/pluto/<a href="http://pluto.info">pluto.info</a></div>
<div>unix 2 [ ACC ] STREAM LISTENING 5670 /var/run/dbus/system_bus_socket</div><div>unix 2 [ ACC ] STREAM LISTENING 3614 @/com/ubuntu/upstart</div><div><br></div><div>Finally, for posterity's sake, here's my iptables as they currently stand:</div>
<div><div>Chain INPUT (policy ACCEPT)</div><div>target prot opt source destination</div><div>ACCEPT udp -- anywhere anywhere udp spt:isakmp dpt:isakmp</div><div>ACCEPT udp -- anywhere anywhere udp spt:isakmp dpt:isakmp</div>
<div>ACCEPT udp -- anywhere anywhere udp spt:4500 dpt:4500</div><div><br></div><div>Chain FORWARD (policy ACCEPT)</div><div>target prot opt source destination</div><div><br></div>
<div>Chain OUTPUT (policy ACCEPT)</div><div>target prot opt source destination</div><div>ACCEPT udp -- anywhere anywhere udp spt:isakmp dpt:isakmp</div><div>ACCEPT udp -- anywhere anywhere udp spt:4500 dpt:4500</div>
</div><div><br></div><div>nat iptable:</div><div><div>Chain PREROUTING (policy ACCEPT)</div><div>target prot opt source destination</div><div><br></div><div>Chain POSTROUTING (policy ACCEPT)</div><div>target prot opt source destination</div>
<div>MASQUERADE all -- anywhere anywhere</div><div><br></div><div>Chain OUTPUT (policy ACCEPT)</div><div>target prot opt source destination</div></div><div><br></div><div><br></div><div><br>
</div><div class="gmail_quote">On Fri, Sep 23, 2011 at 11:27 PM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">On Fri, 23 Sep 2011, James Nelson II wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Those answers are unfortunately yes, yes, and yes.<br>
</blockquote>
<br></div>
Ahh, but:<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
004 "ec2check" #7: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP/NAT=>0xbcd53ec2 <0x6981795a<br>
xfrm=3DES_0-HMAC_MD5 NATOA=none NATD=none DPD=none}<br>
</blockquote></blockquote></blockquote>
<br></div>
Note it does say "ESP/NAT". check if UDP 4500 is open? Note that this means<br>
you might need to allow 4500 -> random high port and randomin high<br>
port -> 4500<br><font color="#888888">
<br>
Paul<br>
</font></blockquote></div><br><br clear="all"><div><br></div>-- <br>-----------------------<br>James Nelson II<br>630-334-0177<br><a href="mailto:james.nelson.ii@gmail.com">james.nelson.ii@gmail.com</a><br>
</div>