<html><body>
<div style="font-family: Tahoma; color: rgb(0, 0, 0); font-size: 13.3333px; font-weight: 400; font-style: normal;">
<div><font face="Segoe UI" size="2">Hi,</font></div>
<div><font face="Segoe UI" size="2"> </font></div>
<div><font face="Segoe UI" size="2">I am running an Ubuntu VPS and I'm trying to get it to connect to a Draytek router acting as a VPN endpoint at my office. The Draytek has several other
remote Drayteks tunnelling into it so I'm unable to change the settings at that end.</font></div>
<div><font face="Segoe UI" size="2"> </font></div>
<div><font face="Segoe UI" size="2">I am trying to establish a tunnel from my VPS with no joy. I have created a specific profile for the VPS on the Draytek. When I configure a remote Draytek to
dial-in, these are the settings that work:</font></div>
<div> </div>
<div><font face="Segoe UI" size="2">PSK: XXXXXXX</font></div>
<div>IPSec Security Method: High(ESP) 3DES with Authentication</div>
<div>IKE Phase 1 mode: Main</div>
<div>IKE Phase 1 proposal: 3DES_SHA1_G2</div>
<div>IKE Phase 2 proposal: 3DES_SHA1</div>
<div>IKE Phase 1 key lifetime: 86400s</div>
<div>IKE Phase 2 key lifetime: 3600s</div>
<div>PFS: Disable</div>
<div> </div>
<div>Remote Network IP: 10.0.0.0</div>
<div>Remote Network Mask: 255.255.0.0</div>
<div>Local Network IP: 10.0.10.0</div>
<div>Local Network Mask: 255.255.255.0</div>
<div> </div>
<div>So I need to translate these into an ipsec.conf file. This is what I've got so far:</div>
<div> </div>
<div>
<div><span style="font-family:courier new,courier,monospace;"># basic configuration<br />
config setup<br />
klipsdebug=all<br />
plutodebug="control parsing"<br />
interfaces=%defaultroute<br />
oe=no<br />
protostack=auto<br />
nat_traversal=yes<br />
syslog=syslog.debug<br />
virtual_private=%v4:10.0.30.0/16</span></div>
<div><span style="font-family:courier new,courier,monospace;">conn net-to-net<br />
type=tunnel<br />
authby=secret<br />
auto=start<br />
ikelifetime=86400s<br />
keylife=3600s<br />
left=%defaultroute<br />
leftsourceip=<VPS IP address><br />
leftsubnet=10.0.30.0/24<br />
aggrmode=no<br />
pfs=no<br />
right=<Draytek external address><br />
rightsubnet=10.0.0.0/16<br />
# ike=3des-sha1;modp1024!<br />
# phase2alg=3des-sha1;modp1024</span></div>
<div> </div>
</div>
<div>With this ipsec.conf I can see packets leaving the VPS but the tunnel isn't established:</div>
<div> </div>
<div><span style="font-family:courier new,courier,monospace;">11:19:44.577299 IP (tos 0x0, ttl 64, id 31146, offset 0, flags [DF], proto UDP (17), length 892)<br />
<VPS Address>.isakmp > <Draytek Address>.isakmp: [bad udp cksum 0x45dc -> 0xb75f!] isakmp 1.0 msgid 00000000 cookie ca837204e7654e72->0000000000000000: phase 1
I ident:<br />
(sa: doi=ipsec situation=identity<br />
(p: #0 protoid=isakmp transform=18<br />
(t: #0 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp2048)(type=keylen value=0100))<br />
(t: #1 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp2048)(type=keylen value=0080))<br />
(t: #2 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp2048)(type=keylen value=0100))<br />
(t: #3 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp2048)(type=keylen value=0080))<br />
(t: #4 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=3des)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp2048))<br />
(t: #5 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=3des)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp2048))<br />
(t: #6 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp1536)(type=keylen value=0100))<br />
(t: #7 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp1536)(type=keylen value=0080))<br />
(t: #8 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp1536)(type=keylen value=0100))<br />
(t: #9 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp1536)(type=keylen value=0080))<br />
(t: #10 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=3des)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp1536))<br />
(t: #11 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=3des)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp1536))<br />
(t: #12 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp1024)(type=keylen value=0100))<br />
(t: #13 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp1024)(type=keylen value=0080))<br />
(t: #14 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp1024)(type=keylen value=0100))<br />
(t: #15 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp1024)(type=keylen value=0080))<br />
(t: #16 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=3des)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp1024))<br />
(t: #17 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=3des)(type=hash value=md5)(type=auth
value=preshared)(type=group desc value=modp1024))))<br />
(vid: len=16 afcad71368a1f1c96b8696fc77570100)<br />
(vid: len=16 4048b7d56ebce88525e7de7f00d6c2d3)<br />
(vid: len=16 4a131c81070358455c5728f20e95452f)<br />
(vid: len=16 7d9419a65310ca6f2c179d9215529d56)<br />
(vid: len=16 90cb80913ebb696e086381b5ec427b1f)<br />
(vid: len=16 cd60464335df21f87cfdb2fc68b6a448)<br />
11:19:44.587902 IP (tos 0x0, ttl 242, id 12234, offset 0, flags [none], proto UDP (17), length 156)<br />
<Draytek Address>.isakmp > <VPS Address>.isakmp: [udp sum ok] isakmp 1.0 msgid 00000000 cookie ca837204e7654e72->7fbe6375f5b33fb0: phase 1 R ident:<br />
(sa: doi=ipsec situation=identity<br />
(p: #0 protoid=isakmp transform=1<br />
(t: #0 id=ike (type=lifetype value=sec)(type=lifeduration len=4 value=00015180)(type=enc value=aes)(type=hash value=sha1)(type=auth
value=preshared)(type=group desc value=modp2048)(type=keylen value=0100))))<br />
(vid: len=16 afcad71368a1f1c96b8696fc77570100)<br />
(vid: len=16 4a131c81070358455c5728f20e95452f)<br />
11:19:44.593741 IP (tos 0x0, ttl 64, id 31147, offset 0, flags [DF], proto UDP (17), length 384)<br />
<VPS Address>.isakmp > <Draytek Address>.isakmp: [bad udp cksum 0x43e0 -> 0x11b3!] isakmp 1.0 msgid 00000000 cookie ca837204e7654e72->7fbe6375f5b33fb0: phase 1
I ident:<br />
(ke: key len=256
595c8acd4d89d45b6227a5fc86a4b9d25eb25347691f8efb331aa028d9c1d4c079c70c9ecd15303e13920ab372f37c78566f5dc288500f3f19706d9cace6290c95dcc26680c8591a88098013cd29a9b1441294f028904e111d53bd7b43baf7ad9bc1afc65adf8042429c4fd7ceeecfcc9f1a7227c2c3745d49d5e61831cd370c01003fe8eada64647fafb614095cd62c8069c1752cf17c2cf930e1a8fe77b3016c060e43c908663130ec991dd6269782b7e641c39689a8f3cc03efc3e3a7f29014580cdd709c4beefbe57c650c65440b243e5de4ef73e62d24ea102ffb85529ef7e49d17e14429ef39036756a78ce0f5148906a369937fc77a0b0982ce3b8c0f)<br
/>
(nonce: n len=16 78bc2e4e5abcbd16eea158b44d49ad5f)<br />
(pay20)<br />
(pay20)<br />
11:19:45.000344 IP (tos 0x0, ttl 242, id 12242, offset 0, flags [none], proto UDP (17), length 384)<br />
<Draytek Address>.isakmp > <VPS Address>.isakmp: [udp sum ok] isakmp 1.0 msgid 00000000 cookie ca837204e7654e72->7fbe6375f5b33fb0: phase 1 R ident:<br />
(ke: key len=256
2c4abe9bddb4b4703a4e3f10ead0c0101acce7495bdfc53d2f6d25c196eb13d7f2b0927a948189d740bb9d438d929a68834efbc4a5f5e782712c8a8b37ed688d0fedda141f42f4ccbd9807e682d009178bdaf520867b96e86999c09b64483a04c12263841cf6ebda8cd134fb151e4e1457bc275f23255be747b9c6bf4e5023d6964036453129942cefa10e66066860d2fd7e8d8db321efb25bc77d9f36d75f9b0e2e3ed6b3d6ba1deabe1aad2b290112db1a30feb09b1807de3c65e904806e0b4a4c28d2cece5d9c903ec0bbe70755827ba2614639be5ab9572670ba1fbd63b5e0d5486d17c0f4f528b01c9b6459f48c3bffba5e9fca5abaa625234133bb4fe2)<br
/>
(nonce: n len=16 3b239752301f9754b3633ba8df7b4931)<br />
(pay20)<br />
(pay20)<br />
11:19:45.008153 IP (tos 0x0, ttl 64, id 31237, offset 0, flags [DF], proto UDP (17), length 108)<br />
<VPS Address>.ipsec-nat-t > <Draytek Address>.ipsec-nat-t: [bad udp cksum 0x42cc -> 0xd2bc!] NONESP-encap: isakmp 1.0 msgid 00000000 cookie
ca837204e7654e72->7fbe6375f5b33fb0: phase 1 I ident[E]: [encrypted id]<br />
11:19:45.019147 IP (tos 0x0, ttl 242, id 12269, offset 0, flags [none], proto UDP (17), length 108)<br />
<Draytek Address>.ipsec-nat-t > <VPS Address>.ipsec-nat-t: [udp sum ok] NONESP-encap: isakmp 1.0 msgid 00000000 cookie ca837204e7654e72->7fbe6375f5b33fb0: phase 1
R ident[E]: [encrypted id]<br />
11:19:45.019573 IP (tos 0x0, ttl 242, id 12272, offset 0, flags [none], proto UDP (17), length 124)<br />
<Draytek Address>.ipsec-nat-t > <VPS Address>.ipsec-nat-t: [udp sum ok] NONESP-encap: isakmp 1.0 msgid d077cb75 cookie 08a05b41a6d3da0a->b6698ecf0753d89d: phase
2/others R inf[E]: [encrypted hash]<br />
11:19:45.021199 IP (tos 0x0, ttl 64, id 31239, offset 0, flags [DF], proto UDP (17), length 108)<br />
<VPS Address>.ipsec-nat-t > <Draytek Address>.ipsec-nat-t: [bad udp cksum 0x42cc -> 0xd7ff!] NONESP-encap: isakmp 1.0 msgid 3a25b209 cookie
ca837204e7654e72->7fbe6375f5b33fb0: phase 2/others I inf[E]: [encrypted hash]</span></div>
<div> </div>
<div>I thought it might be because of the proposals so I added the ike and phase2alg lines to ipsec.conf (that are currently commented out) but if I uncomment them I don't see any traffic at all.
The PSK has been added to ipsec.secrets:</div>
<div> </div>
<div><VPS address> %any : PSK "XXXXXXXX"</div>
<div> </div>
<div>The logging on the Draytek is non-existent so I can't see what the problem is.</div>
<div> </div>
<div>Any clue what I might be doing wrong?</div>
<div> </div>
<div>Thanks.</div>
<div> </div>
<div>Darren.</div>
<div> </div>
</div>
<br clear="both">
______________________________________________________________________<BR>
This email has been scanned by the Symantec Email Security.cloud service.<BR>
For more information please visit http://www.symanteccloud.com<BR>
______________________________________________________________________<BR>
</body></html>