<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hello Everyone,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I'm trying to use openswan to create an IPSec tunnel. The tunnel status says up but I cannot ping over the tunnel. Would appreciate any pointers to get it working.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please find below a details about my setup.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Setup:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">(Linux pc)<o:p></o:p></p>
<p class="MsoNormal">10.1.1.3 <o:p></o:p></p>
<p class="MsoNormal">|<o:p></o:p></p>
<p class="MsoNormal">|<o:p></o:p></p>
<p class="MsoNormal">10.1.1.1 172.16.18.64 <-------> 172.16.18.72 192.168.18.1 --- 192.168.18.3<o:p></o:p></p>
<p class="MsoNormal">eth0 eth1 eth0 eth1 Linux PC<o:p></o:p></p>
<p class="MsoNormal">Raspberry pi Linux vm<o:p></o:p></p>
<p class="MsoNormal">OpenSwan running here. OpenSwan running here.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On Linux vm (172.16.18.72)<o:p></o:p></p>
<p class="MsoNormal">service ipsec status<o:p></o:p></p>
<p class="MsoNormal">IPsec running - pluto pid: 29954<o:p></o:p></p>
<p class="MsoNormal">pluto pid 29954<o:p></o:p></p>
<p class="MsoNormal">1 tunnels up<o:p></o:p></p>
<p class="MsoNormal">some eroutes exist<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">ipsec auto --status<o:p></o:p></p>
<p class="MsoNormal">000 using kernel interface: netkey<o:p></o:p></p>
<p class="MsoNormal">...<o:p></o:p></p>
<p class="MsoNormal">000 interface eth0/eth0 172.16.18.64<o:p></o:p></p>
<p class="MsoNormal">000 interface eth0/eth0 172.16.18.64<o:p></o:p></p>
<p class="MsoNormal">000 interface eth1/eth1 192.168.18.1<o:p></o:p></p>
<p class="MsoNormal">000 interface eth1/eth1 192.168.18.1<o:p></o:p></p>
<p class="MsoNormal">...<o:p></o:p></p>
<p class="MsoNormal">000 - allowed 6 subnets: 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 25.0.0.0/8, fd00::/8, fe80::/10<o:p></o:p></p>
<p class="MsoNormal">000 - disallowed 0 subnets: <o:p></o:p></p>
<p class="MsoNormal">...<o:p></o:p></p>
<p class="MsoNormal">000 "test_conn": 192.168.18.0/24===172.16.18.64<172.16.18.64>...172.16.18.72<172.16.18.72>===10.1.1.0/24; erouted; eroute owner: #2<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">root@makarandpradhan:/proc/sys/net/ipv4# ip xfrm state<o:p></o:p></p>
<p class="MsoNormal">src 172.16.18.72 dst 172.16.18.64<o:p></o:p></p>
<p class="MsoNormal"> proto esp spi 0xdf61e45a reqid 16385 mode tunnel<o:p></o:p></p>
<p class="MsoNormal"> replay-window 32 flag af-unspec<o:p></o:p></p>
<p class="MsoNormal"> auth-trunc hmac(md5) 0x9e7882623b06f8509aa2337957752bd9 96<o:p></o:p></p>
<p class="MsoNormal"> enc cbc(des3_ede) 0x953abbe75655e7b268feee4ab63f6bff876d7b6254ed7325<o:p></o:p></p>
<p class="MsoNormal">src 172.16.18.64 dst 172.16.18.72<o:p></o:p></p>
<p class="MsoNormal"> proto esp spi 0x8c8525e7 reqid 16385 mode tunnel<o:p></o:p></p>
<p class="MsoNormal"> replay-window 32 flag af-unspec<o:p></o:p></p>
<p class="MsoNormal"> auth-trunc hmac(md5) 0xff8d29bc5bbfe1d935eb260a29a944df 96<o:p></o:p></p>
<p class="MsoNormal"> enc cbc(des3_ede) 0xfa1cc693ef5dba393bdacc2553b7fbd86b46e68d7acca8a1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">root@makarandpradhan:/proc/sys/net/ipv4# route -n<o:p></o:p></p>
<p class="MsoNormal">Kernel IP routing table<o:p></o:p></p>
<p class="MsoNormal">Destination Gateway Genmask Flags Metric Ref Use Iface<o:p></o:p></p>
<p class="MsoNormal">0.0.0.0 172.16.18.2 0.0.0.0 UG 0 0 0 eth0<o:p></o:p></p>
<p class="MsoNormal">172.16.18.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0<o:p></o:p></p>
<p class="MsoNormal">192.168.18.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">root@makarandpradhan:/proc/sys/net/ipv4# ipsec eroute<o:p></o:p></p>
<p class="MsoNormal">/usr/lib/ipsec/eroute: NETKEY does not support eroute table.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When I ping 10.1.1.1 from 192.168.18.3, I can see the pkt come in on eth1 i.e. 192.168.18.1, but I do not see an ESP packet go out of eth0 (172.16.18.72). I think, the pkt is going out the default route instead of the tunnel.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I'm running a fairly recent linux and openswan:<o:p></o:p></p>
<p class="MsoNormal">root@makarandpradhan:/proc/sys/net/ipv4# uname -a<o:p></o:p></p>
<p class="MsoNormal">Linux makarandpradhan 4.4.0-31-generic #50~14.04.1-Ubuntu SMP Wed Jul 13 01:07:32 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">root@makarandpradhan:/proc/sys/net/ipv4# dpkg -l openswan<o:p></o:p></p>
<p class="MsoNormal">Desired=Unknown/Install/Remove/Purge/Hold<o:p></o:p></p>
<p class="MsoNormal">| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend<o:p></o:p></p>
<p class="MsoNormal">|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)<o:p></o:p></p>
<p class="MsoNormal">||/ Name Version Architecture Description<o:p></o:p></p>
<p class="MsoNormal">+++-==============-============-============-=================================<o:p></o:p></p>
<p class="MsoNormal">ii openswan 1:2.6.38-1 amd64 Internet Key Exchange daemon<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any pointers to get the tunnel working would be highly appreciated.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">With Rgds,<o:p></o:p></p>
<p class="MsoNormal">Makarand.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA">Makarand Pradhan<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA">Senior Software Engineer.<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="mso-fareast-language:EN-CA">iS5 Communications Inc.<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="mso-fareast-language:EN-CA">#1-1815 Meyerside Drive</span></b><span style="mso-fareast-language:EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="mso-fareast-language:EN-CA">Mississauga, Ontario</span></b><span style="mso-fareast-language:EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="mso-fareast-language:EN-CA">L5T 1G3<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA">Main Line: +1-844-520-0588 Ext. 129<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA">Direct Line: +1-289-724-2296<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA">Cell: +1-226-501-5666<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA">Fax:+1-289-401-5206<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA">Email: <u><span style="color:blue"><a href="mailto:makarandpradhan@is5com.com">makarandpradhan@is5com.com</a></span></u><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA">Website: <a href="http://www.is5com.com/">
<span style="color:blue">www.iS5Com.com</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA"> <img border="0" width="431" height="301" style="width:4.4916in;height:3.1333in" id="Picture_x0020_1" src="cid:image002.png@01D4EA19.5C955700" alt="cid:image002.png@01D40F8B.0A286FC0"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="mso-fareast-language:EN-CA">Confidentiality Notice: <br>
This message is intended only for the named recipients. This message may contain information that is confidential and/or exempt from disclosure under applicable law. Any dissemination or copying of this message by anyone other than a named recipient is strictly
prohibited. If you are not a named recipient or an employee or agent responsible for delivering this message to a named recipient, please notify us immediately, and permanently destroy this message and any copies you may have. Warning: Email may not be secure
unless properly encrypted.</span></b><span style="mso-fareast-language:EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>