<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hi Nick<br>
<br>
Thanks for your reply.<br>
<br>
Have made the required changes, and still no go. Unfortunately I
need to have the Centos server establishing the connection. A lot
of the settings in the conf came from reading umpteen docs /
configs on the net - this isn't my usual area of specialty, I've
just been given the task :)<br>
<br>
New <b>ipsec.conf</b><br>
config setup<br>
klipsdebug=all<br>
plutodebug=all<br>
protostack=netkey<br>
interfaces=%defaultroute<br>
<br>
conn testconnection<br>
type=tunnel<br>
left=1.1.1.1<br>
leftsourceip=192.168.3.195<br>
leftsubnet=192.168.3.0/24<br>
right=3.3.3.3<br>
rightsubnet=192.168.3.0/24<br>
auth=esp<br>
keyexchange=ike<br>
auto=add<br>
pfs=yes<br>
rekey=no<br>
authby=secret<br>
<br>
Doing a tcpdump when doing the ipsec auto --add testconnection I
can see the server sending the request (thishost and endhost
replacing the actual hostnames)<br>
<br>
tcpdump -vv -x -X -s 1500 -i eth0 'port 500'<br>
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture
size 1500 bytes<br>
01:55:31.099277 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF],
proto UDP (17), length 520)<br>
thishost.isakmp > endhost.isakmp: [bad udp cksum afb2!]
isakmp 1.0 msgid 00000000 cookie
0a1a31b314914bbb->0000000000000000: phase 1 I ident:<br>
(sa: doi=ipsec situation=identity<br>
(p: #0 protoid=isakmp transform=12<br>
(t: #0 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=aes)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp2048)(type=keylen
value=0080))<br>
(t: #1 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=aes)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp2048)(type=keylen
value=0080))<br>
(t: #2 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=3des)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp2048))<br>
(t: #3 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=3des)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp2048))<br>
(t: #4 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=aes)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp1536)(type=keylen
value=0080))<br>
(t: #5 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=aes)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp1536)(type=keylen
value=0080))<br>
(t: #6 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=3des)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp1536))<br>
(t: #7 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=3des)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp1536))<br>
(t: #8 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=aes)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp1024)(type=keylen
value=0080))<br>
(t: #9 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=aes)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp1024)(type=keylen
value=0080))<br>
(t: #10 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=3des)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp1024))<br>
(t: #11 id=ike (type=lifetype
value=sec)(type=lifeduration value=0e10)(type=enc
value=3des)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp1024))))<br>
(vid: len=12)<br>
(vid: len=16)<br>
<br>
This is more of a 'test' as part of a bigger project, but wanted
to try and get everything ready first. I'm not sure of the end
requirements for the actual 'live' system - so may wait for those
and see how I go.<br>
<br>
Dave<br>
<br>
<br>
<br>
On 11/02/2014 4:42 PM, Nick Howitt wrote:<br>
</div>
<blockquote
cite="mid:024116e539408daddde1043f6f1ef0da@howitts.poweredbyclear.com"
type="cite">
<p>What settings do you have in the Draytek (including the
advanced settings)?</p>
<p>Can you check your subnets (although it is not the issue) as
your virtual_private subnets do not match te rightsubnet (/16 is
not 255.255.255.0). Anyway you should not need virtual_private
or nat_traversal.</p>
<p>In your conn, you will probably also want a leftsubet and
leftsoureceip. Also to get the tunnel up and running I'd remove
the esp line, change auto to add and have the Draytek initiate
the connection.</p>
<p>Have you opened the CentOS firewall to udp:500 and the esp
protocol? Is there any reason you are not using PFS?</p>
<p>Regards,</p>
<p>Nick</p>
<p>BTW I have a DrayTek 2710 and 2820 calling me (ClearOS).</p>
<p>On 2014-02-11 05:29, David Fowler wrote:</p>
<blockquote type="cite" style="padding-left:5px;
border-left:#1010ff 2px solid; margin-left:5px"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->Hi
all<br>
<br>
I'm having some issues getting Openswan running on a Centos6.5
box to connect to a Draytek router (or even another Centos box)
using an IPSec connection<br>
<br>
Here are all my settings (IP addresses have been changed - but
consistent here)<br>
1.1.1.1 - CentOS server<br>
2.2.2.2 - CentOS server bcast<br>
3.3.3.3 - router on the other end<br>
<br>
When I run an 'ipsec --up testconenction', I get the following<br>
<br>
ipsec auto --up testconnection<br>
104 "testconnection" #3: STATE_MAIN_I1: initiate<br>
010 "testconnection" #3: STATE_MAIN_I1: retransmission; will
wait 20s for response<br>
010 "testconnection" #3: STATE_MAIN_I1: retransmission; will
wait 40s for response<br>
<br>
The /var/log/secure file shows<br>
Feb 11 05:26:29 host pluto[31976]: | processing connection
testconnection<br>
Feb 11 05:26:29 host pluto[31976]: | handling event
EVENT_RETRANSMIT for 3.3.3.3 "testconnection" #3<br>
Feb 11 05:26:29 host pluto[31976]: | sending 592 bytes for
EVENT_RETRANSMIT through eth0:500 to 3.3.3.3:500 (using #3)<br>
<br>
Config files and outputs are below<br>
<br>
----------<br>
<strong>ifconfig</strong><br>
eth0 Link encap:Ethernet HWaddr 00:16:3E:38:7B:2C<br>
inet addr:1.1.1.1 Bcast:2.2.2.2 Mask:255.255.248.0<br>
<br>
-----------<br>
<strong>/etc/ipsec.conf</strong><br>
config setup<br>
klipsdebug=all<br>
plutodebug=all<br>
protostack=netkey<br>
nat_traversal=yes<br>
virtual_private=%v4:192.168.0.0/16,%v4:192.168.3.0/16<br>
interfaces=%defaultroute<br>
<br>
conn testconnection<br>
type=tunnel<br>
left=1.1.1.1<br>
right=3.3.3.3<br>
rightsubnet=192.168.3.0/255.255.255.0<br>
auth=esp<br>
esp=3des-168<br>
keyexchange=ike<br>
auto=start<br>
pfs=no<br>
rekey=no<br>
authby=secret<br>
<br>
----------<br>
<strong>/etc/ip.secrets</strong><br>
1.1.1.1 3.3.3.3: PSK "mykeyhere"<br>
<br>
----------<br>
<strong>ipsec verify</strong><br>
Checking your system to see if IPsec got installed and started
correctly:<br>
Version check and ipsec on-path
[OK]<br>
Linux Openswan U2.6.32/K2.6.32-431.3.1.el6.x86_64 (netkey)<br>
Checking for IPsec support in kernel
[OK]<br>
SAref kernel support
[N/A]<br>
NETKEY: Testing for disabled ICMP send_redirects
[OK]<br>
NETKEY detected, testing for disabled ICMP accept_redirects
[OK]<br>
Checking that pluto is running
[OK]<br>
Pluto listening for IKE on udp 500
[OK]<br>
Pluto listening for NAT-T on udp 4500
[OK]<br>
Checking for 'ip' command
[OK]<br>
Checking /bin/sh is not /bin/dash
[OK]<br>
Checking for 'iptables' command
[OK]<br>
<br>
----------<br>
<br>
Any help would be appreciated.<br>
<br>
Dave<br>
<br>
<br>
<br>
<br>
<!-- html ignored --><br>
<pre>_______________________________________________
<a moz-do-not-send="true" href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a>
<a moz-do-not-send="true" href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a moz-do-not-send="true" href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a moz-do-not-send="true" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a>
<a class="moz-txt-link-freetext" href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a class="moz-txt-link-freetext" href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<p class="" avgcert""="" color="#000000" align="left">No virus
found in this message.<br>
Checked by AVG - <a moz-do-not-send="true"
href="http://www.avg.com">www.avg.com</a><br>
Version: 2014.0.4259 / Virus Database: 3697/7081 - Release Date:
02/10/14</p>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
David Fowler
General Manager
Power Creations
Ph : 1300 737 268
Mb : 041 791 0960
Fx : 08 9386 8561
Wb : <a class="moz-txt-link-abbreviated" href="http://www.powercreations.com.au">www.powercreations.com.au</a>
Please note I am not in the office on Wednesdays. For anything urgent
please call the office or my mobile.
-----------------------------------------------------------------------
This Email may contain confidential and/or privileged information and
is intended solely for the addressee(s) named. If you have received
this information in error, or are advised that you have been posted
thisvEmail by accident, please notify the sender by return Email,
do not redistribute it, delete the Email and keep no copies.
-----------------------------------------------------------------------</pre>
</body>
</html>