<div dir="ltr"><div><div><div>It indeed doesn't have anything to do with DDNS, why they name it that way I don't know. I found this:<br><a href="http://www.archivum.info/users@openswan.org/2009-07/00161/%28Openswan-Users%29-Problem-with-ipsec-connection.html">http://www.archivum.info/users@openswan.org/2009-07/00161/%28Openswan-Users%29-Problem-with-ipsec-connection.html</a><br>
<br></div>There it was a NAT problem. You can try the forceencaps=yes option.<br><br></div>I would recommend using Libreswan, it is more actively being developed at the moment. The older version has a vulnerability that has been resolved in the newest version of Libreswan. The test incomplete message is normal, I get that as well.<br>
<br>Greetings,<br><br></div>Bart<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-02-19 15:35 GMT+01:00 Sean Smith <span dir="ltr"><<a href="mailto:ssmith@nanb.nb.ca" target="_blank">ssmith@nanb.nb.ca</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div link="blue" vlink="purple" lang="EN-CA"><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">No … I am not using DDNS. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Do you think I should continue down the libreswan path or try and use the same version of openSwan I had been successful with?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I can send the configuration file for openSwan … I have not touched any libresawn config files. I am going to go have a read about libreswan now.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I was also concerned with the NAT problem during verify but had no luck searching the net on this.<u></u><u></u></span></p>
<div class=""><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal">Checking NAT and MASQUERADEing [TEST INCOMPLETE]<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p></div><div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"" lang="EN-US">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"" lang="EN-US"> Bart Smink [mailto:<a href="mailto:bartsmink@gmail.com" target="_blank">bartsmink@gmail.com</a>] <br>
<b>Sent:</b> February-19-14 10:24 AM<br><b>To:</b> Sean Smith<br><b>Cc:</b> <a href="mailto:users@lists.openswan.org" target="_blank">users@lists.openswan.org</a><br><b>Subject:</b> Re: [Openswan Users] Problem with newly rebuilt Centos box and open Swan<u></u><u></u></span></p>
</div><div><div class="h5"><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Hello Sean,<u></u><u></u></p><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">Could you send the config files of Libreswan? It seems to be a problem with DDNS. Are you using that on your server for a dynamic WAN IP address? <u></u><u></u></p>
</div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">You're using libreswan, not Openswan, its a newer fork of Openswan and has a different mailing list. Don't know whether you'll get much response here. <u></u><u></u></p>
</div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">Greetings,<u></u><u></u></p></div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">Bart<u></u><u></u></p></div>
<div><p class="MsoNormal"><br>On Wednesday, February 19, 2014, Sean Smith <<a href="mailto:ssmith@nanb.nb.ca" target="_blank">ssmith@nanb.nb.ca</a>> wrote:<u></u><u></u></p><div><div><p class="MsoNormal">Hi all. I recently have been rebuilding a new Centos serer to replace an existing one. <u></u><u></u></p>
<p class="MsoNormal">I use this server as a backup device and then push my backups to a remote spot via and IPSec VPN tunnel.<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">It has been working. However, my newly built box using the same configuration file will not connect.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">My IPSec verify is below.<u></u><u></u></p><p class="MsoNormal">-------<u></u><u></u></p><p class="MsoNormal">Verifying installed system and configuration files<br>
<br>Version check and ipsec on-path [OK]<br>Libreswan 3.7 (netkey) on 3.12.7-200.fc19.x86_64<br>Checking for IPsec support in kernel [OK]<br> NETKEY: Testing XFRM related proc values<br>
ICMP default/send_redirects [OK]<br> ICMP default/accept_redirects [OK]<br> XFRM larval drop [OK]<br>Pluto ipsec.conf syntax [OK]<br>
Hardware random device [N/A]<br>Two or more interfaces found, checking IP forwarding [OK]<br>Checking rp_filter [OK]<br>Checking that pluto is running [OK]<br>
Pluto listening for IKE on udp 500 [OK]<br> Pluto listening for IKE/NAT-T on udp 4500 [OK]<br> Pluto ipsec.secret syntax [OK]<br>Checking NAT and MASQUERADEing [TEST INCOMPLETE]<br>
Checking 'ip' command [OK]<br>Checking 'iptables' command [OK]<br>Checking 'prelink' command does not interfere with FIPS [PRESENT]<br>Checking for obsolete ipsec.conf options [OK]<br>
Opportunistic Encryption [DISABLED]<br>--------<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Also, in the secure and messages files I can see that Phase 1 completes, but it seems to get stuck on EVENT_PENDING_DDNS. It does queue up EVENT_PENDING_PHASE2 but never gets by the DDNS.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Any suggestions are greatl appreciated.<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Feb 19 09:45:31 localhost pluto[8835]: | * processed 0 messages from cryptographic helpers<br>
Feb 19 09:45:31 localhost pluto[8835]: | next event EVENT_PENDING_DDNS in 59 seconds<br>Feb 19 09:45:31 localhost pluto[8835]: | next event EVENT_PENDING_DDNS in 59 seconds<br>Feb 19 09:45:31 localhost pluto[8835]: |<br>Feb 19 09:45:31 localhost pluto[8835]: | *received whack message<br>
Feb 19 09:45:31 localhost pluto[8835]: initiating all conns with alias='aliantVPN'<br>Feb 19 09:45:31 localhost pluto[8835]: | * processed 0 messages from cryptographic helpers<br>Feb 19 09:45:31 localhost pluto[8835]: | next event EVENT_PENDING_DDNS in 59 seconds<br>
Feb 19 09:45:31 localhost pluto[8835]: | next event EVENT_PENDING_DDNS in 59 seconds<br>Feb 19 09:45:31 localhost pluto[8835]: | reaped addconn helper child<u></u><u></u></p></div></div></div><p class="MsoNormal"><br><br>
-- <br><span style="font-size:10.5pt;font-family:"Calibri","sans-serif"">**** DISCLAIMER ****<br><br>"This e-mail and any attachment thereto may contain information which is confidential and/or protected by intellectual property rights and are intended for the sole use of the recipient(s) named above. <br>
Any use of the information contained herein (including, but not limited to, total or partial reproduction, communication or distribution in any form) by other persons than the designated recipient(s) is prohibited. <br>If you have received this e-mail in error, please notify the sender either by telephone or by e-mail and delete the material from any computer".<br>
<br>Thank you for your cooperation.</span><u></u><u></u></p></div></div></div><p align="left"><font><font><font face="Tahoma"><font color="#800000"><strong>------------------</strong></font></font></font></font></p>
<p align="left"><font><font face="Tahoma"><font color="#800000"><strong><u>Nurses Association of New Brunswick<br></u></strong></font></font></font><font><font face="Tahoma"><font color="#800000"><strong><u>Association des infirmières et infirmiers du Nouveau-Brunswick</u></strong></font></font></font></p>
<p align="left"><strong><font color="#800000" face="Tahoma" size="1">165 Regent Street / 165, rue Regent<br>Fredericton, N.B. / Fredericton, N.-B.<br>E3B 7B4<br>Tel. /. Tél.: <a href="tel:506-458-8731" value="+15064588731" target="_blank">506-458-8731</a><br>
</font></strong><font color="#800000" face="Tahoma" size="1"><a href="http://www.nanb.nb.ca" target="_blank">www.nanb.nb.ca</a> / <a href="http://www.aiinb.nb.ca" target="_blank"><strong>www.aiinb.nb.ca</strong></a></font></p>
<p align="left"><font face="Tahoma" size="1">This email message (including any attachments, if any) is confidential and may be privileged. Any unauthorized distribution or disclosure is prohibited. If you have received this e-mail in error, please notify us and delete it and any attachments from your computer systems and records.<br>
</font><font face="Tahoma" size="1"><br>Ce courriel (y compris les pièces jointes) est confidentiel et peut être protégé. La distribution ou la divulgation non autorisée de ce courriel est interdite. Si vous avez reçu ce courriel par erreur, veuillez nous en aviser et supprimer ce courriel, ainsi que les pièces jointes, de votre système informatique et de vos dossiers.<br>
</font></p><font><font><font color="#800000" face="Tahoma" size="1"><strong></strong></font></font></font>
<p align="left"><font><font><font color="#800000" face="Tahoma" size="1"><strong>19/2/2014</strong></font></font></font></p>
<p align="left"><font><font color="#0000ff"><font><font color="#0000ff"><font face="Tahoma"><font><font><font face="Tahoma"><font color="#800000"><strong>------------------</strong></font></font></font></font></font></font></font></font></font></p>
<font color="#007f00" face="Calibri"><em><font color="#007f00"></font></em></font><a title="gfidisc.nanb.nb.ca" href="#1444a926cd034df2_"> </a></div></blockquote></div><br><br clear="all"><br>-- <br><span style="font-family:Calibri,sans-serif;font-size:14px;border-collapse:collapse">**** DISCLAIMER ****<br>
<br>"This e-mail and any attachment thereto may contain information which is confidential and/or protected by intellectual property rights and are intended for the sole use of the recipient(s) named above. <br>Any use of the information contained herein (including, but not limited to, total or partial reproduction, communication or distribution in any form) by other persons than the designated recipient(s) is prohibited. <br>
If you have received this e-mail in error, please notify the sender either by telephone or by e-mail and delete the material from any computer".<br><br>Thank you for your cooperation.</span>
</div>