<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Rescued from the Spam bucket. Please remember to subscribe to the mailing list before posting to it.<br class=""><div><br class=""><div class=""><div class=""><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(127, 127, 127, 1.0);" class=""><b class="">Date: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">December 27, 2014 at 9:29:59 AM GMT-5<br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(127, 127, 127, 1.0);" class=""><b class="">From: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">klas <<a href="mailto:oslist@k.flum.net" class="">oslist@k.flum.net</a>><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(127, 127, 127, 1.0);" class=""><b class="">To: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><a href="mailto:users@lists.openswan.org" class="">users@lists.openswan.org</a><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(127, 127, 127, 1.0);" class=""><b class="">Subject: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><b class="">ip xfrm confusion</b><br class=""></span></div><br class=""><br class="">I'm trying to connect my linux/openswan client to a server through<br class="">ipsec/l2tp using netkey.<br class=""><br class="">The client with IP 192.168.0.145 is connected to the gateway<br class="">192.168.0.10 and the server IP is 1.1.1.1.<br class=""><br class="">192.168.0.145 <-> 192.168.0.10/2.2.2.2 <-> 1.1.1.1.<br class=""><br class="">ipsec connection seems ok.<br class=""><br class="">However, xl2tpd fails to get any connection over ipsec.<br class=""><br class="">If I set lns to 10.200.101.15, the ipsec transport is ignored and<br class="">tcpdump udp port 1701 will see the packages.<br class=""><br class="">If I use 1.1.1.1 instead, I see no packages with tcp dump, but I still<br class="">don't get any contact with the server.<br class=""><br class="">I've had this working in the past with 10.200.101.15 as lns.<br class="">I suppose the problems is how ip xfrm is set up. But I must admit<br class="">that I don't really understand what ip xfrm state/policy tells me nor<br class="">how to add other routes.<br class=""><br class=""><br class="">ipsec.conf:<br class="">config setup<br class=""> nat_traversal=yes<br class=""> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8<br class=""> oe=off<br class=""> protostack=netkey<br class=""><br class="">conn my-vpn<br class=""> authby=secret<br class=""> pfs=no<br class=""> rekey=yes<br class=""> keyingtries=3<br class=""> type=transport<br class=""> left=192.168.0.145<br class=""> leftnexthop=192.168.0.10<br class=""> leftprotoport=17/1701<br class=""> right=1.1.1.1<br class=""> <a href="mailto:rightid=@VPN01.serverplace.local" class="">rightid=@VPN01.serverplace.local</a><br class=""> rightprotoport=17/1701<br class=""> auto=add<br class=""><br class=""><br class="">A few warning here.<br class="">002 "my-vpn" #1: initiating Main Mode<br class="">104 "my-vpn" #1: STATE_MAIN_I1: initiate<br class="">003 "my-vpn" #1: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY<br class="">00000004] <br class="">003 "my-vpn" #1: ignoring Vendor ID payload [FRAGMENTATION]<br class="">003 "my-vpn" #1: received Vendor ID payload<br class="">[draft-ietf-ipsec-nat-t-ike-02_n] method set to=106 <br class="">002 "my-vpn" #1: enabling possible NAT-traversal with method<br class="">draft-ietf-ipsec-nat-t-ike-05 <br class="">002 "my-vpn" #1: transition from state STATE_MAIN_I1 to state<br class="">STATE_MAIN_I2 <br class="">106 "my-vpn" #1: STATE_MAIN_I2: sent MI2, expecting MR2 <br class="">003 "my-vpn" #1: NAT-Traversal: Result using<br class="">draft-ietf-ipsec-nat-t-ike-02/03: both are NATed <br class="">002 "my-vpn" #1: transition from state STATE_MAIN_I2 to state<br class="">STATE_MAIN_I3 <br class="">108 "my-vpn" #1: STATE_MAIN_I3: sent MI3, expecting MR3 <br class="">002 "my-vpn" #1: Main mode peer ID is ID_FQDN:<br class="">'@VPN01.serverplace.local' <br class="">002 "my-vpn" #1: transition from state STATE_MAIN_I3 to state<br class="">STATE_MAIN_I4 <br class="">004 "my-vpn" #1: STATE_MAIN_I4: ISAKMP SA established<br class="">{auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha<br class="">group=modp1024} <br class="">002 "my-vpn" #2: initiating Quick Mode<br class="">PSK+ENCRYPT+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:3bb07674<br class="">proposal=defaults pfsgroup=no-pfs} <br class="">117 "my-vpn" #2: STATE_QUICK_I1: initiate<br class="">002 "my-vpn" #2: IKE message has the Commit Flag set but Pluto doesn't<br class="">implement this feature; ignoring flag <br class="">003 "my-vpn" #2: ignoring informational payload, type<br class="">IPSEC_RESPONDER_LIFETIME msgid=3bb07674 <br class="">003 "my-vpn" #2: our client subnet returned doesn't match my proposal -<br class="">us:192.168.0.145/32 vs them:2.2.2.2/32 <br class="">003 "my-vpn" #2: Allowing questionable proposal anyway<br class="">[ALLOW_MICROSOFT_BAD_PROPOSAL] <br class="">000 "my-vpn" #2: peer client type is FQDN 003 "my-vpn" #2: peer client<br class="">subnet returned doesn't match my proposal - us:1.1.1.1/32 vs<br class="">them:2.2.2.2/32 <br class="">003 "my-vpn" #2: Allowing questionable proposal anyway<br class="">[ALLOW_MICROSOFT_BAD_PROPOSAL] 003 "my-vpn" #2: IDcr was FQDN:<br class="">VPN01.serverplace.local\203, using NAT_OA=10.200.101.15/32 as IDcr <br class="">002 "my-vpn" #2: netlink_raw_eroute: WARNING: that_client port 0 and<br class="">that_host port 1701 don't match. Using that_client port. <br class="">002 "my-vpn" #2: transition from state STATE_QUICK_I1 to state<br class="">STATE_QUICK_I2 <br class="">004 "my-vpn" #2: STATE_QUICK_I2: sent QI2, IPsec SA established<br class="">transport mode {ESP=>0xabababab <0xbcbcbcbc xfrm=3DES_0-HMAC_SHA1<br class="">NATOA=10.200.101.15 NATD=1.1.1.1:4500 DPD=none}<br class=""><br class=""><br class=""><br class="">ip xfrm state<br class="">src 1.1.1.1 dst 192.168.0.145<br class=""> proto esp spi 0xb2b7c283 reqid 16385 mode transport<br class=""> replay-window 32 <br class=""> auth-trunc hmac(sha1) 0x35... 96<br class=""> enc cbc(des3_ede) 0x20...<br class=""> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0<br class=""> sel src 10.200.101.15/32 dst 192.168.0.145/32 proto udp dport<br class="">1701 src 192.168.0.145 dst 1.1.1.1<br class=""> proto esp spi 0xccc4890a reqid 16385 mode transport<br class=""> replay-window 32 <br class=""> auth-trunc hmac(sha1) 0x71... 96<br class=""> enc cbc(des3_ede) 0xc4...<br class=""> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0<br class=""> sel src 192.168.0.145/32 dst 10.200.101.15/32 proto udp sport<br class=""> 1701<br class=""><br class="">ip xfrm policy<br class="">src 192.168.0.145/32 dst 1.1.1.1/32 proto udp sport 1701 <br class=""> dir out priority 2080 <br class=""> tmpl src 0.0.0.0 dst 0.0.0.0<br class=""> proto esp reqid 16385 mode transport<br class="">src 10.200.101.15/32 dst 192.168.0.145/32 proto udp dport 1701 <br class=""> dir in priority 2080 <br class=""> tmpl src 0.0.0.0 dst 0.0.0.0<br class=""> proto esp reqid 16385 mode transport<br class="">src ::/0 dst ::/0 <br class=""> socket out priority 0 <br class="">src ::/0 dst ::/0 <br class=""> socket in priority 0 <br class="">src 0.0.0.0/0 dst 0.0.0.0/0 <br class=""> socket out priority 0 <br class="">src 0.0.0.0/0 dst 0.0.0.0/0 <br class=""> socket in priority 0 <br class="">src 0.0.0.0/0 dst 0.0.0.0/0 <br class=""> socket out priority 0 <br class="">src 0.0.0.0/0 dst 0.0.0.0/0 <br class=""> socket in priority 0 <br class="">src 0.0.0.0/0 dst 0.0.0.0/0 <br class=""> socket out priority 0 <br class="">src 0.0.0.0/0 dst 0.0.0.0/0 <br class=""> socket in priority 0 <br class="">src 0.0.0.0/0 dst 0.0.0.0/0 <br class=""> socket out priority 0 <br class="">src 0.0.0.0/0 dst 0.0.0.0/0 <br class=""> socket in priority 0<br class=""><br class=""><br class=""></div></div></div><br class=""></body></html>