<div dir="ltr">BTW: I also tried removing the disallowed subnet but it didn't seem to help<div><br></div><div><div>000 virtual_private (%priv):</div><div>000 - allowed 3 subnets: <a href="http://10.0.0.0/8">10.0.0.0/8</a>, <a href="http://192.168.0.0/16">192.168.0.0/16</a>, <a href="http://172.16.0.0/12">172.16.0.0/12</a></div><div>000 - disallowed 0 subnets:</div><div>000 WARNING: Disallowed subnets in virtual_private= is empty. If you have</div><div>000 private address space in internal use, it should be excluded!</div></div><div><br></div><div>Thanx!</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div style="color:rgb(0,0,0);font-family:Georgia;font-size:medium;float:left"><img src="https://www.gravatar.com/avatar/6343d4d073c5c9309ffc802b1150f258"></div><div style="color:rgb(0,0,0);font-family:Georgia;font-size:medium;margin-left:90px"><div style="font-weight:bold;font-family:helvetica;font-size:14px">Richard Hurt</div><div style="margin-top:5px"><a href="http://www.facebook.com/rnhurt" target="_blank"><img src="https://dl.dropboxusercontent.com/u/124205/Web/facebookicon.png"></a> <a href="http://www.twitter.com/rnhurt" target="_blank"><img src="https://dl.dropboxusercontent.com/u/124205/Web/twittericon.png"></a> <a href="http://www.linkedin.com/in/rnhurt" target="_blank"><img src="https://dl.dropboxusercontent.com/u/124205/Web/linkedinicon.png"></a> <a href="http://github.com/rnhurt" target="_blank"><img src="https://dl.dropboxusercontent.com/u/124205/Web/githubicon.png"></a></div></div><div style="color:rgb(0,0,0);font-family:Georgia;font-size:medium;margin-left:90px"></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Tue, Nov 24, 2015 at 9:50 AM, Richard Hurt <span dir="ltr"><<a href="mailto:rnhurt@gmail.com" target="_blank">rnhurt@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Well, I was trying to get a RoadWarrior VPN solution using native clients and not forcing the end user to install anything. :/ However, it looks like that might be a pipe dream, and after looking at the OpenVPN clients, they don't seem so bad.</div><div><br></div><div>As for searching for an answer, I've almost used up all of my Google-fu looking for solutions to this problem. One issue I'm having is that there are lots of answers that aren't quite what I need; either they are for older versions of OpenSWAN, or for IPSec/LP2P configs, or they are for StrongSWAN / LibreSWAN which have different arguments, keywords, etc. *sigh*</div><div><br></div><div>Just for due diligence and maybe help someone else that is having the problem (possibly even myself in the future) I would like to make this work with OpenSWAN, even if I end up using OpenVPN. To that end I will answer your questions as best I can.</div><div><br></div>I confirmed that IP forwarding is enabled on the EC2 instance:<div><br></div><div> [ec2-user@ip-10-223-6-20 ~]$ cat /proc/sys/net/ipv4/ip_forward</div><div> 1</div><div><br></div><div>Interestingly, I *can* see traffic (ICMP) from my laptop to the EC2 instance while the tunnel is up. I starting pinging the EC2 instance from my laptop and, turned the tunnel on after 5-6 pings, let it ping some more, then turned the tunnel off again. Here is the output I captured.</div><div><br></div><div>My laptop terminal showed this:</div><div>=======================================================</div><div><div>64 bytes from <a href="http://52.91.120.247" target="_blank">52.91.120.247</a>: icmp_seq=0 ttl=49 time=41.208 ms</div><div>64 bytes from <a href="http://52.91.120.247" target="_blank">52.91.120.247</a>: icmp_seq=1 ttl=49 time=37.734 ms</div><div>64 bytes from <a href="http://52.91.120.247" target="_blank">52.91.120.247</a>: icmp_seq=2 ttl=49 time=36.369 ms</div><div>64 bytes from <a href="http://52.91.120.247" target="_blank">52.91.120.247</a>: icmp_seq=3 ttl=49 time=36.782 ms</div><div>64 bytes from <a href="http://52.91.120.247" target="_blank">52.91.120.247</a>: icmp_seq=4 ttl=49 time=36.169 ms</div><div>64 bytes from <a href="http://52.91.120.247" target="_blank">52.91.120.247</a>: icmp_seq=5 ttl=49 time=37.556 ms</div><div>64 bytes from <a href="http://52.91.120.247" target="_blank">52.91.120.247</a>: icmp_seq=6 ttl=49 time=38.315 ms</div><div>Request timeout for icmp_seq 7</div><div>Request timeout for icmp_seq 8</div><div>Request timeout for icmp_seq 9</div><div>Request timeout for icmp_seq 10</div><div>Request timeout for icmp_seq 11</div><div>Request timeout for icmp_seq 12</div><div>Request timeout for icmp_seq 13</div><div>Request timeout for icmp_seq 14</div><div>Request timeout for icmp_seq 15</div><div>Request timeout for icmp_seq 16</div><div>64 bytes from <a href="http://52.91.120.247" target="_blank">52.91.120.247</a>: icmp_seq=17 ttl=49 time=36.393 ms</div><div>64 bytes from <a href="http://52.91.120.247" target="_blank">52.91.120.247</a>: icmp_seq=18 ttl=49 time=36.817 ms</div><div>64 bytes from <a href="http://52.91.120.247" target="_blank">52.91.120.247</a>: icmp_seq=19 ttl=49 time=36.426 ms</div><div>64 bytes from <a href="http://52.91.120.247" target="_blank">52.91.120.247</a>: icmp_seq=20 ttl=49 time=36.642 ms</div></div><div>=======================================================<br></div><div><br></div><div>tcpdump running on the EC2 server showed this:</div><div>=======================================================<br></div><div><div>14:36:54.439756 IP h250.222.196.69.ip.windstream.net.38579 > ip-10-223-6-20.ec2.internal.ssh: Flags [.], ack 777025463, win 4094, options [nop,nop,TS val 359672833 ecr 81189522], length 0</div><div>14:36:54.451286 IP h250.222.196.69.ip.windstream.net.38579 > ip-10-223-6-20.ec2.internal.ssh: Flags [.], ack 101, win 4092, options [nop,nop,TS val 359672844 ecr 81189525], length 0</div><div>14:36:54.451371 IP h250.222.196.69.ip.windstream.net.38579 > ip-10-223-6-20.ec2.internal.ssh: Flags [.], ack 201, win 4089, options [nop,nop,TS val 359672844 ecr 81189525], length 0</div><div>14:36:58.109023 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 0, length 64</div><div>14:36:59.112374 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 1, length 64</div><div>14:37:00.115146 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 2, length 64</div><div>14:37:01.116225 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 3, length 64</div><div>14:37:02.117449 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 4, length 64</div><div>14:37:03.122333 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 5, length 64</div><div>14:37:03.984302 IP h250.222.196.69.ip.windstream.net.mumps > ip-10-223-6-20.ec2.internal.isakmp: isakmp: phase 1 I ident</div><div>14:37:04.022022 IP h250.222.196.69.ip.windstream.net.mumps > ip-10-223-6-20.ec2.internal.isakmp: isakmp: phase 1 I ident</div><div>14:37:04.073863 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: NONESP-encap: isakmp: phase 1 I ident[E]</div><div>14:37:04.111414 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I #6[E]</div><div>14:37:04.126681 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 6, length 64</div><div>14:37:04.156728 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I #6[E]</div><div>14:37:04.156818 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I #6[E]</div><div>14:37:04.219067 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I oakley-quick[E]</div><div>14:37:04.255946 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I oakley-quick[E]</div><div>14:37:04.551836 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x1), length 84</div><div>14:37:04.552245 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x2), length 84</div><div>14:37:04.552331 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x3), length 84</div><div>14:37:05.129169 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 7, length 64</div><div>14:37:05.647239 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x4), length 84</div><div>14:37:05.647295 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x5), length 84</div><div>14:37:05.647313 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x6), length 84</div><div>14:37:06.129422 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 8, length 64</div><div>14:37:06.737323 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x7), length 84</div><div>14:37:06.737416 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x8), length 84</div><div>14:37:06.737470 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x9), length 84</div><div>14:37:07.131034 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 9, length 64</div><div>14:37:07.826947 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0xa), length 84</div><div>14:37:07.827003 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0xb), length 84</div><div>14:37:07.827372 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0xc), length 84</div><div>14:37:08.132200 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 10, length 64</div><div>14:37:08.925846 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0xd), length 84</div><div>14:37:08.925901 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0xe), length 84</div><div>14:37:08.925997 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0xf), length 84</div><div>14:37:09.137240 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 11, length 64</div><div>14:37:10.022946 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x10), length 84</div><div>14:37:10.023001 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x11), length 84</div><div>14:37:10.023365 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x12), length 84</div><div>14:37:10.138907 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 12, length 64</div><div>14:37:11.117192 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x13), length 84</div><div>14:37:11.117651 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x14), length 84</div><div>14:37:11.117708 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x15), length 84</div><div>14:37:11.144060 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 13, length 64</div><div>14:37:12.146011 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 14, length 64</div><div>14:37:12.215087 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x16), length 84</div><div>14:37:12.215140 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x17), length 84</div><div>14:37:12.215342 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x18), length 84</div><div>14:37:13.147701 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 15, length 64</div><div>14:37:13.313867 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x19), length 84</div><div>14:37:13.313920 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x1a), length 84</div><div>14:37:13.313954 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x1b), length 84</div><div>14:37:14.148266 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 16, length 64</div><div>14:37:14.313849 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x1c), length 84</div><div>14:37:14.313903 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x1d), length 84</div><div>14:37:14.313921 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: UDP-encap: ESP(spi=0x96948f8d,seq=0x1e), length 84</div><div>14:37:14.838958 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I inf[E]</div><div>14:37:14.839303 IP h250.222.196.69.ip.windstream.net.22908 > ip-10-223-6-20.ec2.internal.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I inf[E]</div><div>14:37:15.150626 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 17, length 64</div><div>14:37:16.154236 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 18, length 64</div><div>14:37:17.155627 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 19, length 64</div><div>14:37:18.156524 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 20, length 64</div><div>14:37:19.160484 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 21, length 64</div><div>14:37:20.161891 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 22, length 64</div><div>14:37:21.166881 IP <a href="http://h250.222.196.69.ip.windstream.net" target="_blank">h250.222.196.69.ip.windstream.net</a> > ip-10-223-6-20.ec2.internal: ICMP echo request, id 48122, seq 23, length 64</div></div><div>=======================================================<br></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div style="color:rgb(0,0,0);font-family:Georgia;font-size:medium;float:left"><img src="https://www.gravatar.com/avatar/6343d4d073c5c9309ffc802b1150f258"></div><span class="HOEnZb"><font color="#888888"><div style="color:rgb(0,0,0);font-family:Georgia;font-size:medium;margin-left:90px"><div style="font-weight:bold;font-family:helvetica;font-size:14px">Richard Hurt</div><div style="margin-top:5px"><a href="http://www.facebook.com/rnhurt" target="_blank"><img src="https://dl.dropboxusercontent.com/u/124205/Web/facebookicon.png"></a> <a href="http://www.twitter.com/rnhurt" target="_blank"><img src="https://dl.dropboxusercontent.com/u/124205/Web/twittericon.png"></a> <a href="http://www.linkedin.com/in/rnhurt" target="_blank"><img src="https://dl.dropboxusercontent.com/u/124205/Web/linkedinicon.png"></a> <a href="http://github.com/rnhurt" target="_blank"><img src="https://dl.dropboxusercontent.com/u/124205/Web/githubicon.png"></a></div></div><div style="color:rgb(0,0,0);font-family:Georgia;font-size:medium;margin-left:90px"></div></font></span></div></div></div></div></div></div><div><div class="h5">
<br><div class="gmail_quote">On Mon, Nov 23, 2015 at 4:07 PM, Daniel Cave <span dir="ltr"><<a href="mailto:dan.cave@me.com" target="_blank">dan.cave@me.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hmm ok. A couple of things to try a bit at a time<br>
<br>
Have you got ip_forwarding enabled on the ec2 instance?<br>
<br>
Can you see the traffic coming from your client through the ec2 instance using tcpdump?<br>
<br>
Like. tcpdump -li eth0 <yourClientIp><br>
<br>
And try a ping test<br>
<br>
2. I noticed that the output of the IPSec status it says it's disallowed your ec2 client subnet.. You don't normally see that. What happens if you allow it, do t forget you have to restart IPSec if you make Conf changes<br>
<br>
Fwiw I usually use openVpn Ssl UDP tunnelling instead of IPSec as its so problematic to setup for road warriors<br>
<br>
Try googling for IPSec road warrior using aws of you get stuck.<br>
<br>
Sent from my iPhone<br>
<div><div><br>
> On 23 Nov 2015, at 20:57, Richard Hurt <<a href="mailto:rnhurt@gmail.com" target="_blank">rnhurt@gmail.com</a>> wrote:<br>
><br>
> Neither the server nor my laptop have a firewall enabled and the EC2<br>
> security group is set to allow all traffic from <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> (while<br>
> testing :) Also, at some point in the past 3 days of trying things I<br>
> *was* able to ping the server from my laptop, however I couldn't ping<br>
> anything else. :/<br>
><br>
><br>
> Below is the output of "ipsec auto status" while the tunnel is running<br>
> and my computer is connected. This part looks interesting, but I<br>
> don't know how to decode it:<br>
><br>
> 000 "roadwarrior"[6]:<br>
> <a href="http://10.223.0.0/16===10.223.6.20" rel="noreferrer" target="_blank">10.223.0.0/16===10.223.6.20</a><10.223.6.20>[MS+XS+S=C]...69.196.222.250[192.168.59.26,+MC+XC+S=C];<br>
> erouted; eroute owner: #6<br>
><br>
> =================================================<br>
> 000 using kernel interface: netkey<br>
> 000 interface lo/lo ::1<br>
> 000 interface lo/lo 127.0.0.1<br>
> 000 interface lo/lo 127.0.0.1<br>
> 000 interface eth0/eth0 10.223.6.20<br>
> 000 interface eth0/eth0 10.223.6.20<br>
> 000 %myid = (none)<br>
> 000 debug none<br>
> 000<br>
> 000 virtual_private (%priv):<br>
> 000 - allowed 3 subnets: <a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">10.0.0.0/8</a>, <a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">192.168.0.0/16</a>, <a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">172.16.0.0/12</a><br>
> 000 - disallowed 1 subnet: <a href="http://10.223.0.0/16" rel="noreferrer" target="_blank">10.223.0.0/16</a><br>
> 000<br>
> 000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64,<br>
> keysizemax=64<br>
> 000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8,<br>
> keysizemin=192, keysizemax=192<br>
> 000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8,<br>
> keysizemin=40, keysizemax=128<br>
> 000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8,<br>
> keysizemin=40, keysizemax=448<br>
> 000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0,<br>
> keysizemin=0, keysizemax=0<br>
> 000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8,<br>
> keysizemin=128, keysizemax=256<br>
> 000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8,<br>
> keysizemin=160, keysizemax=288<br>
> 000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8,<br>
> keysizemin=128, keysizemax=256<br>
> 000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8,<br>
> keysizemin=128, keysizemax=256<br>
> 000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8,<br>
> keysizemin=128, keysizemax=256<br>
> 000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8,<br>
> keysizemin=128, keysizemax=256<br>
> 000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8,<br>
> keysizemin=128, keysizemax=256<br>
> 000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8,<br>
> keysizemin=128, keysizemax=256<br>
> 000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8,<br>
> keysizemin=128, keysizemax=256<br>
> 000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8,<br>
> keysizemin=128, keysizemax=256<br>
> 000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8,<br>
> keysizemin=128, keysizemax=256<br>
> 000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,<br>
> keysizemin=128, keysizemax=128<br>
> 000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,<br>
> keysizemin=160, keysizemax=160<br>
> 000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256,<br>
> keysizemin=256, keysizemax=256<br>
> 000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384,<br>
> keysizemin=384, keysizemax=384<br>
> 000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512,<br>
> keysizemin=512, keysizemax=512<br>
> 000 algorithm ESP auth attr: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD,<br>
> keysizemin=160, keysizemax=160<br>
> 000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC,<br>
> keysizemin=128, keysizemax=128<br>
> 000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0<br>
> 000<br>
> 000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131<br>
> 000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8,<br>
> keydeflen=192<br>
> 000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16,<br>
> keydeflen=128<br>
> 000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>
> 000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>
> 000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<br>
> 000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<br>
> 000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<br>
> 000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072<br>
> 000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<br>
> 000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<br>
> 000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192<br>
> 000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024<br>
> 000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048<br>
> 000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048<br>
> 000<br>
> 000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0}<br>
> trans={0,0,0} attrs={0,0,0}<br>
> 000<br>
> 000 "roadwarrior":<br>
> <a href="http://10.223.0.0/16===10.223.6.20" rel="noreferrer" target="_blank">10.223.0.0/16===10.223.6.20</a><10.223.6.20>[MS+XS+S=C]...%virtual[+MC+XC+S=C]===?;<br>
> unrouted; eroute owner: #0<br>
> 000 "roadwarrior": myip=unset; hisip=unset;<br>
> 000 "roadwarrior": ike_life: 3600s; ipsec_life: 28800s;<br>
> rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0<br>
> 000 "roadwarrior": policy:<br>
> PSK+ENCRYPT+TUNNEL+DONTREKEY+MODECFGPULL+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD;<br>
> prio: 16,32; interface: eth0;<br>
> 000 "roadwarrior": newest ISAKMP SA: #0; newest IPsec SA: #0;<br>
> 000 "roadwarrior"[6]:<br>
> <a href="http://10.223.0.0/16===10.223.6.20" rel="noreferrer" target="_blank">10.223.0.0/16===10.223.6.20</a><10.223.6.20>[MS+XS+S=C]...69.196.222.250[192.168.59.26,+MC+XC+S=C];<br>
> erouted; eroute owner: #6<br>
> 000 "roadwarrior"[6]: myip=unset; hisip=unset;<br>
> 000 "roadwarrior"[6]: ike_life: 3600s; ipsec_life: 28800s;<br>
> rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0<br>
> 000 "roadwarrior"[6]: policy:<br>
> PSK+ENCRYPT+TUNNEL+DONTREKEY+MODECFGPULL+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD;<br>
> prio: 16,32; interface: eth0;<br>
> 000 "roadwarrior"[6]: newest ISAKMP SA: #5; newest IPsec SA: #6;<br>
> 000 "roadwarrior"[6]: IKE algorithm newest: AES_CBC_256-SHA1-MODP1024<br>
> 000<br>
> 000 #6: "roadwarrior"[6] <a href="http://69.196.222.250:61652" rel="noreferrer" target="_blank">69.196.222.250:61652</a> STATE_QUICK_R2 (IPsec SA<br>
> established); EVENT_SA_EXPIRE in 3573s; newest IPSEC; eroute owner;<br>
> isakmp#5; idle; imp<br>
> ort:not set<br>
> 000 #6: "roadwarrior"[6] 69.196.222.250 <a href="mailto:esp.52c66d2@69.196.222.250" target="_blank">esp.52c66d2@69.196.222.250</a><br>
> <a href="mailto:esp.cacb569a@10.223.6.20" target="_blank">esp.cacb569a@10.223.6.20</a> <a href="mailto:tun.0@69.196.222.250" target="_blank">tun.0@69.196.222.250</a> <a href="mailto:tun.0@10.223.6.20" target="_blank">tun.0@10.223.6.20</a> ref=0<br>
> refhim=4294901761<br>
> 000 #5: "roadwarrior"[6] <a href="http://69.196.222.250:61652" rel="noreferrer" target="_blank">69.196.222.250:61652</a> STATE_MODE_CFG_R1<br>
> (ModeCfg Set sent, expecting Ack); EVENT_SA_REPLACE in 28502s; newest<br>
> ISAKMP; lastdpd=8s(seq i<br>
> n:0 out:0); idle; import:not set<br>
> 000<br>
> =================================================<br>
> Richard Hurt<br>
><br>
><br>
><br>
>> On Mon, Nov 23, 2015 at 3:46 PM, Daniel Cave <<a href="mailto:dan.cave@me.com" target="_blank">dan.cave@me.com</a>> wrote:<br>
>> If you run. IPSec auto status on the ec2 instance when your tunnel is up what does it say?<br>
>><br>
>> Have you got rules in your security groups to allow routing between your client and the host and rest of the traffic as well as rules on the ec2 Linux instances that are blocking traffic going through the box ??<br>
>><br>
>> Sent from my iPhone<br>
>><br>
>>> On 23 Nov 2015, at 17:29, Richard Hurt <<a href="mailto:rnhurt@gmail.com" target="_blank">rnhurt@gmail.com</a>> wrote:<br>
>>><br>
>>> I'm trying to use OpenSwan (Linux Openswan<br>
>>> U2.6.37/K4.1.10-17.31.amzn1.x86_64 (netkey)) to build a VPN between an<br>
>>> EC2 VPC and my laptop. It seems to almost work (authentication works,<br>
>>> not logging any errors, etc.) but the routing is just not happing<br>
>>> properly. The EC2 server is in the <a href="http://10.223.0.0/16" rel="noreferrer" target="_blank">10.223.0.0/16</a> block (10.223.6.20<br>
>>> in this case) and my local machine is behind a NAT in the<br>
>>> <a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">192.168.0.0/16</a> block (192.168.59.26 in this case). I'm running Mac OS<br>
>>> X 10.11 and bringing the VPN connection up using the native IPSec<br>
>>> Cisco VPN client causes all packets to stop flowing everywhere.<br>
>>> Playing around with the IPSec settings on the server I was able to get<br>
>>> packets to flow to the server from my laptop but everything else was<br>
>>> blocked (DNS, ping, etc.)<br>
>>><br>
>>> Basically, I want everything to stay out of the VPN except for traffic<br>
>>> to <a href="http://10.223.0.0/16" rel="noreferrer" target="_blank">10.223.0.0/16</a>. What am I doing wrong? One thing that looks really<br>
>>> weird to me is that when I bring the tunnel up I see this in my<br>
>>> ifconfig (0.2.0.4 doesn't look like a valid IP address to me):<br>
>>><br>
>>> utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280<br>
>>> inet 0.2.0.4 --> 0.2.0.4 netmask 0xffffffff<br>
>>> nd6 options=1<PERFORMNUD><br>
>>><br>
>>> ===============================================<br>
>>> # /etc/ipsec.conf<br>
>>> version 2.0<br>
>>> config setup<br>
>>> protostack=netkey<br>
>>> nat_traversal=yes<br>
>>> virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!10.223.0.0/16" rel="noreferrer" target="_blank">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!10.223.0.0/16</a><br>
>>> oe=off<br>
>>><br>
>>> include /etc/ipsec.d/*.conf<br>
>>> ===============================================<br>
>>><br>
>>><br>
>>> ===============================================<br>
>>> # /etc/ipsec.d/roadwarrior.conf<br>
>>> conn roadwarrior<br>
>>> type=tunnel<br>
>>> authby=secret<br>
>>> auto=add<br>
>>> rekey=no<br>
>>> pfs=no<br>
>>> forceencaps=yes<br>
>>><br>
>>> # Setup local side<br>
>>> left=10.223.6.20<br>
>>> leftsubnet=<a href="http://10.223.0.0/16" rel="noreferrer" target="_blank">10.223.0.0/16</a><br>
>>> leftxauthserver=yes<br>
>>> leftmodecfgserver=yes<br>
>>><br>
>>> # Setup remote side<br>
>>> right=%any<br>
>>> rightsubnet=vhost:%priv,%no<br>
>>> rightxauthclient=yes<br>
>>> rightmodecfgclient=yes<br>
>>><br>
>>> # Config MODE<br>
>>> modecfgpull=yes<br>
>>> modecfgdns1=8.8.8.8<br>
>>> modecfgdns2=8.8.4.4<br>
>>> ===============================================<br>
>>><br>
>>><br>
>>> ===============================================<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 ipsec__plutorun: Starting Pluto subsystem...<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: nss directory plutomain:<br>
>>> /etc/ipsec.d<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: NSS Initialized<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: Non-fips mode set in<br>
>>> /proc/sys/crypto/fips_enabled<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: Starting Pluto (Openswan<br>
>>> Version 2.6.37; Vendor ID OEu\134d\134jy\134\134ap) pid:15882<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: Non-fips mode set in<br>
>>> /proc/sys/crypto/fips_enabled<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: LEAK_DETECTIVE support [disabled]<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: OCF support for IKE [disabled]<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: SAref support [disabled]:<br>
>>> Protocol not available<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: SAbind support<br>
>>> [disabled]: Protocol not available<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: NSS support [enabled]<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: HAVE_STATSD notification<br>
>>> support not compiled in<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: Setting NAT-Traversal<br>
>>> port-4500 floating to on<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: port floating<br>
>>> activation criteria nat_t=1/port_float=1<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: NAT-Traversal support [enabled]<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_register_enc():<br>
>>> Activating OAKLEY_AES_CBC: Ok (ret=0)<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: starting up 1 cryptographic helpers<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: started helper (thread)<br>
>>> pid=140240508929792 (fd:8)<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: Using Linux 2.6 IPsec<br>
>>> interface code on 4.1.10-17.31.amzn1.x86_64 (experimental code)<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_register_enc():<br>
>>> Activating aes_ccm_8: Ok (ret=0)<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_add(): ERROR:<br>
>>> Algorithm already exists<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_register_enc():<br>
>>> Activating aes_ccm_12: FAILED (ret=-17)<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_add(): ERROR:<br>
>>> Algorithm already exists<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_register_enc():<br>
>>> Activating aes_ccm_16: FAILED (ret=-17)<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_add(): ERROR:<br>
>>> Algorithm already exists<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_register_enc():<br>
>>> Activating aes_gcm_8: FAILED (ret=-17)<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_add(): ERROR:<br>
>>> Algorithm already exists<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_register_enc():<br>
>>> Activating aes_gcm_12: FAILED (ret=-17)<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_add(): ERROR:<br>
>>> Algorithm already exists<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: ike_alg_register_enc():<br>
>>> Activating aes_gcm_16: FAILED (ret=-17)<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: Could not change to<br>
>>> directory '/etc/ipsec.d/cacerts': /<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: Could not change to<br>
>>> directory '/etc/ipsec.d/aacerts': /<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: Could not change to<br>
>>> directory '/etc/ipsec.d/ocspcerts': /<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: Could not change to<br>
>>> directory '/etc/ipsec.d/crls'<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: added connection<br>
>>> description "roadwarrior"<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: listening for IKE messages<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: adding interface<br>
>>> eth0/eth0 <a href="http://10.223.6.20:500" rel="noreferrer" target="_blank">10.223.6.20:500</a><br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: adding interface<br>
>>> eth0/eth0 <a href="http://10.223.6.20:4500" rel="noreferrer" target="_blank">10.223.6.20:4500</a><br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: adding interface lo/lo<br>
>>> <a href="http://127.0.0.1:500" rel="noreferrer" target="_blank">127.0.0.1:500</a><br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: adding interface lo/lo<br>
>>> <a href="http://127.0.0.1:4500" rel="noreferrer" target="_blank">127.0.0.1:4500</a><br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: adding interface lo/lo ::1:500<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: loading secrets from<br>
>>> "/etc/ipsec.secrets"<br>
>>> Nov 23 17:15:24 ip-10-223-6-20 pluto[15882]: loading secrets from<br>
>>> "/etc/ipsec.d/road-warrior.secrets"<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: received Vendor ID payload [RFC 3947] method set<br>
>>> to=109<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: received Vendor ID payload<br>
>>> [draft-ietf-ipsec-nat-t-ike] method set to=110<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: ignoring unknown Vendor ID payload<br>
>>> [8f8d83826d246b6fc7a8a6a428c11de8]<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: ignoring unknown Vendor ID payload<br>
>>> [439b59f8ba676c4c7737ae22eab8f582]<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: ignoring unknown Vendor ID payload<br>
>>> [4d1e0e136deafa34c4f3ea9f02ec7285]<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: ignoring unknown Vendor ID payload<br>
>>> [80d0bb3def54565ee84645d4c85ce3ee]<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: ignoring unknown Vendor ID payload<br>
>>> [9909b64eed937c6573de52ace952fa6b]<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: received Vendor ID payload<br>
>>> [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 110<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: received Vendor ID payload<br>
>>> [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 110<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: received Vendor ID payload<br>
>>> [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method<br>
>>> 110<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: received Vendor ID payload [XAUTH]<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: received Vendor ID payload [Cisco-Unity]<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: ignoring Vendor ID payload [FRAGMENTATION 80000000]<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>: received Vendor ID payload [Dead Peer Detection]<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[1]<br>
>>> 69.196.222.250 #1: responding to Main Mode from unknown peer<br>
>>> 69.196.222.250<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[1]<br>
>>> 69.196.222.250 #1: transition from state STATE_MAIN_R0 to state<br>
>>> STATE_MAIN_R1<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[1]<br>
>>> 69.196.222.250 #1: STATE_MAIN_R1: sent MR1, expecting MI2<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[1]<br>
>>> 69.196.222.250 #1: NAT-Traversal: Result using<br>
>>> draft-ietf-ipsec-nat-t-ike (MacOS X): both are NATed<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[1]<br>
>>> 69.196.222.250 #1: transition from state STATE_MAIN_R1 to state<br>
>>> STATE_MAIN_R2<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[1]<br>
>>> 69.196.222.250 #1: STATE_MAIN_R2: sent MR2, expecting MI3<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[1]<br>
>>> 69.196.222.250 #1: ignoring informational payload, type<br>
>>> IPSEC_INITIAL_CONTACT msgid=00000000<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[1]<br>
>>> 69.196.222.250 #1: Main mode peer ID is ID_IPV4_ADDR: '192.168.59.26'<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[1]<br>
>>> 69.196.222.250 #1: switched from "roadwarrior" to "roadwarrior"<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: deleting connection "roadwarrior" instance with<br>
>>> peer 69.196.222.250 {isakmp=#0/ipsec=#0}<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: transition from state STATE_MAIN_R2 to state<br>
>>> STATE_MAIN_R3<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: new NAT mapping for #1, was <a href="http://69.196.222.250:19" rel="noreferrer" target="_blank">69.196.222.250:19</a>, now<br>
>>> <a href="http://69.196.222.250:1340" rel="noreferrer" target="_blank">69.196.222.250:1340</a><br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established<br>
>>> {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha<br>
>>> group=modp1024}<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: Sending XAUTH Login/Password Request<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: Sending Username/Password request (XAUTH_R0)<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: User elison: Attempting to login<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: md5 authentication being called to<br>
>>> authenticate user elison<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: password file (/etc/ipsec.d/passwd) open.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: checking user(elison:roadwarrior)<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: nope<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: checking user(elison:roadwarrior)<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: nope<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: checking user(elison:roadwarrior)<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: User elison: Authentication Successful<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: XAUTH: xauth_inR1(STF_OK)<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: transition from state STATE_XAUTH_R1 to state<br>
>>> STATE_MAIN_R3<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: unsupported mode cfg attribute<br>
>>> INTERNAL_ADDRESS_EXPIRY received.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: unsupported mode cfg attribute APPLICATION_VERSION<br>
>>> received.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: unsupported mode cfg attribute CISCO_BANNER<br>
>>> received.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: unsupported mode cfg attribute CISCO_DEF_DOMAIN<br>
>>> received.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: unsupported mode cfg attribute CISCO_SPLIT_DNS<br>
>>> received.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: unsupported mode cfg attribute CISCO_SPLIT_INC<br>
>>> received.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: unsupported mode cfg attribute CISCO_UNKNOWN<br>
>>> received.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: unsupported mode cfg attribute CISCO_DO_PFS<br>
>>> received.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: unsupported mode cfg attribute CISCO_SAVE_PW<br>
>>> received.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: unsupported mode cfg attribute CISCO_FW_TYPE<br>
>>> received.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: unsupported mode cfg attribute CISCO_BACKUP_SERVER<br>
>>> received.<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: modecfg_inR0(STF_OK)<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: transition from state STATE_MODE_CFG_R0 to state<br>
>>> STATE_MODE_CFG_R1<br>
>>> Nov 23 17:15:30 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: STATE_MODE_CFG_R1: ModeCfg Set sent, expecting Ack<br>
>>> Nov 23 17:15:31 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: Applying workaround for Mac OS X NAT-OA bug,<br>
>>> ignoring proposed subnet<br>
>>> Nov 23 17:15:31 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: the peer proposed: <a href="http://0.0.0.0/0:0/0" rel="noreferrer" target="_blank">0.0.0.0/0:0/0</a> -><br>
>>> <a href="http://69.196.222.250/32:0/0" rel="noreferrer" target="_blank">69.196.222.250/32:0/0</a><br>
>>> Nov 23 17:15:31 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #2: responding to Quick Mode proposal {msgid:ba3b61a4}<br>
>>> Nov 23 17:15:31 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #2: us:<br>
>>> <a href="http://10.223.0.0/16===10.223.6.20" rel="noreferrer" target="_blank">10.223.0.0/16===10.223.6.20</a><10.223.6.20>[MS+XS+S=C]<br>
>>> Nov 23 17:15:31 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #2: them: 69.196.222.250[192.168.59.26,+MC+XC+S=C]<br>
>>> Nov 23 17:15:31 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #2: transition from state STATE_QUICK_R0 to state<br>
>>> STATE_QUICK_R1<br>
>>> Nov 23 17:15:31 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #2: STATE_QUICK_R1: sent QR1, inbound IPsec SA<br>
>>> installed, expecting QI2<br>
>>> Nov 23 17:15:31 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #2: transition from state STATE_QUICK_R1 to state<br>
>>> STATE_QUICK_R2<br>
>>> Nov 23 17:15:31 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #2: STATE_QUICK_R2: IPsec SA established tunnel mode<br>
>>> {ESP=>0x0e95dea0 <0x397c4b2d xfrm=AES_256-HMAC_SHA1 NATOA=none<br>
>>> NATD=<a href="http://69.196.222.250:1340" rel="noreferrer" target="_blank">69.196.222.250:1340</a> DPD=none}<br>
>>> Nov 23 17:16:03 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: received Delete SA(0x0e95dea0) payload: deleting<br>
>>> IPSEC State #2<br>
>>> Nov 23 17:16:03 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: received and ignored informational message<br>
>>> Nov 23 17:16:03 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> 69.196.222.250 #1: received Delete SA payload: deleting ISAKMP State<br>
>>> #1<br>
>>> Nov 23 17:16:03 ip-10-223-6-20 pluto[15882]: "roadwarrior"[2]<br>
>>> <a href="http://69.196.222.250" rel="noreferrer" target="_blank">69.196.222.250</a>: deleting connection "roadwarrior" instance with peer<br>
>>> 69.196.222.250 {isakmp=#0/ipsec=#0}<br>
>>> Nov 23 17:16:03 ip-10-223-6-20 pluto[15882]: packet from<br>
>>> <a href="http://69.196.222.250:1340" rel="noreferrer" target="_blank">69.196.222.250:1340</a>: received and ignored informational message<br>
>>><br>
>>> ===============================================<br>
>>> _______________________________________________<br>
>>> <a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a><br>
>>> <a href="https://lists.openswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a><br>
>>> Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" rel="noreferrer" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
>>> Building and Integrating Virtual Private Networks with Openswan:<br>
>>> <a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" rel="noreferrer" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div><br></div>