<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-family: Arial,Helvetica,sans-serif'>
<p>What settings do you have in the Draytek (including the advanced settings)?</p>
<p>Can you check your subnets (although it is not the issue) as your virtual_private subnets do not match te rightsubnet (/16 is not 255.255.255.0). Anyway you should not need virtual_private or nat_traversal.</p>
<p>In your conn, you will probably also want a leftsubet and leftsoureceip. Also to get the tunnel up and running I'd remove the esp line, change auto to add and have the Draytek initiate the connection.</p>
<p>Have you opened the CentOS firewall to udp:500 and the esp protocol? Is there any reason you are not using PFS?</p>
<p>Regards,</p>
<p>Nick</p>
<p>BTW I have a DrayTek 2710 and 2820 calling me (ClearOS).</p>
<p>On 2014-02-11 05:29, David Fowler wrote:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->Hi all<br /><br /> I'm having some issues getting Openswan running on a Centos6.5 box to connect to a Draytek router (or even another Centos box) using an IPSec connection<br /><br /> Here are all my settings (IP addresses have been changed - but consistent here)<br /> 1.1.1.1 - CentOS server<br /> 2.2.2.2 - CentOS server bcast<br /> 3.3.3.3 - router on the other end<br /><br /> When I run an 'ipsec --up testconenction', I get the following<br /><br /> ipsec auto --up testconnection<br /> 104 "testconnection" #3: STATE_MAIN_I1: initiate<br /> 010 "testconnection" #3: STATE_MAIN_I1: retransmission; will wait 20s for response<br /> 010 "testconnection" #3: STATE_MAIN_I1: retransmission; will wait 40s for response<br /><br /> The /var/log/secure file shows<br /> Feb 11 05:26:29 host pluto[31976]: | processing connection testconnection<br /> Feb 11 05:26:29 host pluto[31976]: | handling event EVENT_RETRANSMIT for 3.3.3.3 "testconnection" #3<br /> Feb 11 05:26:29 host pluto[31976]: | sending 592 bytes for EVENT_RETRANSMIT through eth0:500 to 3.3.3.3:500 (using #3)<br /><br /> Config files and outputs are below<br /><br /> ----------<br /><strong>ifconfig</strong><br /> eth0 Link encap:Ethernet HWaddr 00:16:3E:38:7B:2C<br /> inet addr:1.1.1.1 Bcast:2.2.2.2 Mask:255.255.248.0<br /><br /> -----------<br /><strong>/etc/ipsec.conf</strong><br /> config setup<br /> klipsdebug=all<br /> plutodebug=all<br /> protostack=netkey<br /> nat_traversal=yes<br /> virtual_private=%v4:192.168.0.0/16,%v4:192.168.3.0/16<br /> interfaces=%defaultroute<br /><br /> conn testconnection<br /> type=tunnel<br /> left=1.1.1.1<br /> right=3.3.3.3<br /> rightsubnet=192.168.3.0/255.255.255.0<br /> auth=esp<br /> esp=3des-168<br /> keyexchange=ike<br /> auto=start<br /> pfs=no<br /> rekey=no<br /> authby=secret<br /><br /> ----------<br /><strong>/etc/ip.secrets</strong><br /> 1.1.1.1 3.3.3.3: PSK "mykeyhere"<br /><br /> ----------<br /><strong>ipsec verify</strong><br /> Checking your system to see if IPsec got installed and started correctly:<br /> Version check and ipsec on-path [OK]<br /> Linux Openswan U2.6.32/K2.6.32-431.3.1.el6.x86_64 (netkey)<br /> Checking for IPsec support in kernel [OK]<br /> SAref kernel support [N/A]<br /> NETKEY: Testing for disabled ICMP send_redirects [OK]<br /> NETKEY detected, testing for disabled ICMP accept_redirects [OK]<br /> Checking that pluto is running [OK]<br /> Pluto listening for IKE on udp 500 [OK]<br /> Pluto listening for NAT-T on udp 4500 [OK]<br /> Checking for 'ip' command [OK]<br /> Checking /bin/sh is not /bin/dash [OK]<br /> Checking for 'iptables' command [OK]<br /><br /> ----------<br /><br /> Any help would be appreciated.<br /><br /> Dave<br /><br /><br /><br /><br /><!-- html ignored --><br />
<pre>_______________________________________________
<a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a>
<a href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
</body></html>