<div dir="ltr">Hi,<div><br></div><div>I managed to get OpenSwan 2.6.38-1 on Ubuntu 14.04 on EC2 instance to talk to AWS Virtual GW and bring up BGP4 session using Quagga 0.99.22.4.</div><div><br></div><div>The problem is that as soon as the ipsec service is fired up, I lose direct connection to the instance and it's only accessible through the ipsec tunnel.</div><div><br></div><div>I'd like to be able to use the instance also as a NAT gateway for the rest of the network.</div><div><br></div><div>In general, I want it to route all traffic to/from RFC-1918 networks except the local VPC over the tunnel, but also leave non-RFC-1918 traffic out and let it go directly to the Internet.</div><div><br></div><div>The configuration which works for me for now (but doesn't let me talk directly to the instance outside the tunnel when ipsec is running) is the following:</div><div><br></div><div>/etc/ipsec.conf:</div><div><br></div><div><div><font face="monospace, monospace">config setup</font></div><div><font face="monospace, monospace"> protostack=netkey</font></div><div><font face="monospace, monospace"> nat_traversal=yes</font></div><div><font face="monospace, monospace"><span class="" style="white-space:pre"> </span>virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10</a></font></div><div><font face="monospace, monospace"> oe=off</font></div><div><font face="monospace, monospace">include /etc/ipsec.d/*.conf</font></div><div><br></div><div><br></div><div>/etc/ipsec.d/vpn.conf:</div><div><font face="monospace, monospace"><br></font></div><div><div><font face="monospace, monospace">conn vpn</font></div><div><font face="monospace, monospace"> type=tunnel</font></div><div><font face="monospace, monospace"> authby=secret</font></div><div><font face="monospace, monospace"> left=%defaultroute</font></div><div><font face="monospace, monospace"> leftid=52.203.150.120</font></div><div><font face="monospace, monospace"> leftsubnet=<a href="http://10.20.40.0/24">10.20.40.0/24</a></font></div><div><font face="monospace, monospace"> right=52.71.186.227</font></div><div><font face="monospace, monospace"> rightsubnet=<a href="http://10.20.30.0/24">10.20.30.0/24</a></font></div><div><font face="monospace, monospace"> auth=esp</font></div><div><font face="monospace, monospace"> phase2alg=aes128-sha1</font></div><div><font face="monospace, monospace"> ike=aes128-sha1</font></div><div><font face="monospace, monospace"> ikelifetime=28800s</font></div><div><font face="monospace, monospace"> salifetime=3600s</font></div><div><font face="monospace, monospace"> pfs=yes</font></div><div><font face="monospace, monospace"> auto=start</font></div><div><font face="monospace, monospace"> keyexchange=ike</font></div><div><font face="monospace, monospace"> rekey=yes</font></div><div><font face="monospace, monospace"> keyingtries=%forever</font></div><div><font face="monospace, monospace"> dpddelay=10</font></div><div><font face="monospace, monospace"> dpdtimeout=30</font></div><div><font face="monospace, monospace"> dpdaction=restart_by_peer</font></div></div><div><font face="monospace, monospace"><br></font></div><div><font face="arial, helvetica, sans-serif">/etc/quagga/bgpd.conf:</font></div><div><font face="monospace, monospace"><br></font></div><div><div style="font-family:monospace,monospace">hostname bgp</div><div style="font-family:monospace,monospace">password test</div><div style="font-family:monospace,monospace">enable password test</div><div style="font-family:monospace,monospace">!</div><div style="font-family:monospace,monospace">log file /var/log/quagga/bgpd</div><div style="font-family:monospace,monospace">debug bgp events</div><div style="font-family:monospace,monospace">debug bgp zebra</div><div style="font-family:monospace,monospace">debug bgp updates</div><div style="font-family:monospace,monospace">!</div><div style="font-family:monospace,monospace">router bgp 65500</div><div style="font-family:monospace,monospace">bgp router-id 52.203.150.120</div><div style="font-family:monospace,monospace">network <a href="http://169.254.44.74/30">169.254.44.74/30</a></div><div style="font-family:monospace,monospace">network <a href="http://10.20.40.0/24">10.20.40.0/24</a></div><div style="font-family:monospace,monospace">!</div><div style="font-family:monospace,monospace">! aws tunnel #1 neighbour</div><div style="font-family:monospace,monospace">neighbor 169.254.44.73 remote-as 7224</div><div style="font-family:monospace,monospace">!</div><div style="font-family:monospace,monospace">line vty</div><div style="font-family:monospace,monospace"><br></div><div><font face="arial, helvetica, sans-serif">/etc/quagga/zebra.conf:</font></div></div><div><font face="monospace, monospace"><br></font></div><div><div><font face="monospace, monospace">hostname Router</font></div><div><font face="monospace, monospace">password zebra</font></div><div><font face="monospace, monospace">enable password zebra</font></div><div><font face="monospace, monospace">interface eth0</font></div><div><font face="monospace, monospace">log file /var/log/quagga/zebra.log</font></div></div><div><br></div><div>I suspect that the issue is that the "right=<a href="http://0.0.0.0/0">0.0.0.0/0</a>" turns the tunnel into sort of "default route" so everything is sent through it, where in fact I just want only legitimate traffic to/from RFC-1918 and the Virtual GW "Internal IP Addresses" to go through the tunnel.</div><div><br></div><div>I tried to change the "rightnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a>" to "righsubnets={<a href="http://172.16.0.0/12">172.16.0.0/12</a> <a href="http://169.254.0.0/16">169.254.0.0/16</a>}" (and changed "leftsubnet" to "leftsubnets") but though the ipsec tunnel comes up the BGP session fails to initiate (and generally, the other side of the tunnel's internal IP 169.254.44.73, which is where the BGP is trying to connect, is not accessible).</div><div><br></div><div>The AWS support person who've been working on this with me suspects that "<a href="http://0.0.0.0/0">0.0.0.0/0</a>" holds a special meaning for ipsec where it means "use policy based routing" and if I change it to anything else then ipsec changes to something else to determine routing?</div><div><br></div><div>Is there a way to achieve what I want?</div><div><br></div><div>Thanks,</div><div><br></div><div>--Amos</div><div><br></div>
</div></div>