[Openswan Users] Small Amounts of Traffic Only STILL
Phillip T. George
phillip at eacsi.com
Tue May 10 11:23:03 CEST 2005
Okay people,
I'm still having a problem with only being able to get small amounts of
traffic thru the VPN. I'm going to provide a bit more information and
hope that someone can see the problem, because this is really getting
frustrating.
Internet connection: LEFT is using Cox residential services, RIGHT is
using Cox business services ( http://www.cox.com/Tulsa )
Linux distro: Fedora Core 3
Kernel version: Linux version 2.6.10-1.770_FC3
(bhcompile at bugs.build.redhat.com) (gcc version 3.4.2 20041017 (Red Hat
3.4.2-6.fc3)) #1 Thu Feb 24 14:00:27 EST 2005
Openswan version: 2.3.1
Recently installed RPMs:
openswan-2.3.1-1.i386.rpm
openswan-doc-2.3.1-1.i386.rpm
openswan-klips-2.3.1-2.6.10_1.770_FC3_1.i386.rpm
ipsec-tools-0.5-2.fc3.i386.rpm
kernel-2.6.10-1.770_FC3.i586.rpm
kernel-doc-2.6.10-1.770_FC3.noarch.rpm
(I was up to kernel version 2.6.11-1.14_FC3, but I realized there was an
openswan-klips packages specific to 2.6.10-1.770_FC3 that make do the
trick, which is why I downgraded to that version)
ipsec.conf :
version 2.0
config setup
interfaces=%defaultroute
klipsdebug=none
plutowait=no
uniqueids=yes
conn %default
keyingtries=0
conn PHILLIPtoEACS
authby=secret
left=lanica.dyndns.org
leftsubnet=192.168.192.0/24
leftnexthop=%defaultroute
right=70.182.220.68
rightsubnet=192.168.0.0/24
rightnexthop=%defaultroute
compress=yes
auto=start
include /etc/ipsec.d/examples/no_oe.conf
LEFT is a semi-dynamic address. I write "semi-dynamic" because the IP
doesn't really change that often. I'm actually wanting to experiment
with the IP changing a bit more for fun. I have tried listing LEFT with
the actual IP, but that didn't improve anything.
LEFT /var/log/messages
May 10 10:16:04 fire2pt5 kernel: NET: Registered protocol family 15
May 10 10:16:04 fire2pt5 ipsec_setup: KLIPS ipsec0 on eth1
68.12.232.86/255.255.248.0 broadcast 68.12.239.255
May 10 10:16:04 fire2pt5 ipsec_setup: ...Openswan IPsec started
May 10 10:16:04 fire2pt5 ipsec_setup: Starting Openswan IPsec 2.3.1...
May 10 10:16:04 fire2pt5 ipsec_setup: insmod
/lib/modules/2.6.10-1.770_FC3/kernel/net/key/af_key.ko
May 10 10:16:04 fire2pt5 ipsec_setup: insmod
/lib/modules/2.6.10-1.770_FC3/kernel/net/ipv4/xfrm4_tunnel.ko
May 10 10:16:05 fire2pt5 ipsec__plutorun: 104 "PHILLIPtoEACS" #1:
STATE_MAIN_I1: initiate
May 10 10:16:05 fire2pt5 ipsec__plutorun: ...could not start conn
"PHILLIPtoEACS"
LEFT /var/log/secure
May 10 10:16:51 fire2pt5 ipsec__plutorun: Starting Pluto subsystem...
May 10 10:16:51 fire2pt5 pluto[8101]: Starting Pluto (Openswan Version
2.3.1 X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID
OEExalF{_o`m)
May 10 10:16:51 fire2pt5 pluto[8101]: Setting port floating to off
May 10 10:16:51 fire2pt5 pluto[8101]: port floating activate 0/1
May 10 10:16:51 fire2pt5 pluto[8101]: including NAT-Traversal patch
(Version 0.6c) [disabled]
May 10 10:16:51 fire2pt5 pluto[8101]: ike_alg_register_enc(): Activating
OAKLEY_AES_CBC: Ok (ret=0)
May 10 10:16:51 fire2pt5 pluto[8101]: starting up 1 cryptographic helpers
May 10 10:16:51 fire2pt5 pluto[8101]: started helper pid=8102 (fd:6)
May 10 10:16:51 fire2pt5 pluto[8101]: Using Linux 2.6 IPsec interface code
May 10 10:16:51 fire2pt5 pluto[8101]: Could not change to directory
'/etc/ipsec.d/cacerts'
May 10 10:16:51 fire2pt5 pluto[8101]: Changing to directory
'/etc/ipsec.d/aacerts'
May 10 10:16:51 fire2pt5 pluto[8101]: Changing to directory
'/etc/ipsec.d/ocspcerts'
May 10 10:16:51 fire2pt5 pluto[8101]: Could not change to directory
'/etc/ipsec.d/crls'
May 10 10:16:52 fire2pt5 pluto[8101]: added connection description
"PHILLIPtoEACS"
May 10 10:16:52 fire2pt5 pluto[8101]: listening for IKE messages
May 10 10:16:52 fire2pt5 pluto[8101]: adding interface eth1/eth1
68.12.232.86:500
May 10 10:16:52 fire2pt5 pluto[8101]: adding interface eth0/eth0
192.168.192.1:500
May 10 10:16:52 fire2pt5 pluto[8101]: adding interface lo/lo 127.0.0.1:500
May 10 10:16:52 fire2pt5 pluto[8101]: adding interface lo/lo ::1:500
May 10 10:16:52 fire2pt5 pluto[8101]: loading secrets from
"/etc/ipsec.secrets"
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #1: initiating
Main Mode
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #1: received
Vendor ID payload [Openswan (this version) 2.3.1 X.509-1.5.4
PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR]
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #1: received
Vendor ID payload [Dead Peer Detection]
May 10 10:16:52 fire2pt5 pluto[8101]: packet from 70.182.220.68:500:
received Vendor ID payload [Openswan (this version) 2.3.1 X.509-1.5.4
PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR]
May 10 10:16:52 fire2pt5 pluto[8101]: packet from 70.182.220.68:500:
received Vendor ID payload [Dead Peer Detection]
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: responding to
Main Mode
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: transition
from state STATE_MAIN_R0 to state STATE_MAIN_R1
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #1: transition
from state STATE_MAIN_I1 to state STATE_MAIN_I2
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: transition
from state STATE_MAIN_R1 to state STATE_MAIN_R2
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: packet
rejected: should have been encrypted
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: sending
notification INVALID_FLAGS to 70.182.220.68:500
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: failed to
build notification for spisize=0
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: Main mode peer
ID is ID_IPV4_ADDR: '70.182.220.68'
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: I did not send
a certificate because I do not have one.
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: transition
from state STATE_MAIN_R2 to state STATE_MAIN_R3
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: sent MR3,
ISAKMP SA established
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #3: responding to
Quick Mode {msgid:d0abf27e}
May 10 10:16:52 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #3: transition
from state STATE_QUICK_R0 to state STATE_QUICK_R1
May 10 10:16:53 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #3: transition
from state STATE_QUICK_R1 to state STATE_QUICK_R2
May 10 10:16:53 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #3: IPsec SA
established {ESP=>0xc5e50ae5 <0xf409d6d4 xfrm=AES_0-HMAC_SHA1
IPCOMP=>0x0000959c <0x000029fd}
May 10 10:17:02 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: packet
rejected: should have been encrypted
May 10 10:17:02 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: sending
notification INVALID_FLAGS to 70.182.220.68:500
May 10 10:17:02 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: failed to
build notification for spisize=0
May 10 10:17:02 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: ignoring
Delete SA payload: PROTO_IPSEC_ESP SA(0xf9677171) not found (maybe expired)
May 10 10:17:02 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: received and
ignored informational message
May 10 10:17:22 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: packet
rejected: should have been encrypted
May 10 10:17:22 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: sending
notification INVALID_FLAGS to 70.182.220.68:500
May 10 10:17:22 fire2pt5 pluto[8101]: "PHILLIPtoEACS" #2: failed to
build notification for spisize=0
RIGHT /var/log/messages
May 10 09:19:39 testimax kernel: NET: Registered protocol family 15
May 10 09:19:39 testimax ipsec_setup: KLIPS ipsec0 on eth1
70.182.220.68/255.255.255.224 broadcast 70.182.220.95
May 10 09:19:39 testimax ipsec_setup: ...Openswan IPsec started
May 10 09:19:39 testimax ipsec_setup: Starting Openswan IPsec 2.3.1...
May 10 09:19:39 testimax ipsec_setup: insmod
/lib/modules/2.6.10-1.770_FC3/kernel/net/key/af_key.ko
May 10 09:19:39 testimax ipsec_setup: insmod
/lib/modules/2.6.10-1.770_FC3/kernel/net/ipv4/xfrm4_tunnel.ko
May 10 09:19:41 testimax ipsec__plutorun: 104 "PHILLIPtoEACS" #1:
STATE_MAIN_I1: initiate
May 10 09:19:41 testimax ipsec__plutorun: ...could not start conn
"PHILLIPtoEACS"
RIGHT /var/log/secure
May 10 09:20:04 testimax ipsec__plutorun: Starting Pluto subsystem...
May 10 09:20:04 testimax pluto[7669]: Starting Pluto (Openswan Version
2.3.1 X.5
09-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OEExalF{_o`m)
May 10 09:20:04 testimax pluto[7669]: Setting port floating to off
May 10 09:20:04 testimax pluto[7669]: port floating activate 0/1
May 10 09:20:04 testimax pluto[7669]: including NAT-Traversal patch
(Version 0
.6c) [disabled]
May 10 09:20:04 testimax pluto[7669]: ike_alg_register_enc(): Activating
OAKLEY_
AES_CBC: Ok (ret=0)
May 10 09:20:04 testimax pluto[7669]: starting up 1 cryptographic helpers
May 10 09:20:04 testimax pluto[7669]: started helper pid=7670 (fd:6)
May 10 09:20:04 testimax pluto[7669]: Using Linux 2.6 IPsec interface code
May 10 09:20:05 testimax pluto[7669]: Could not change to directory
'/etc/ipsec.
d/cacerts'
May 10 09:20:05 testimax pluto[7669]: Changing to directory
'/etc/ipsec.d/aacert
s'
May 10 09:20:05 testimax pluto[7669]: Changing to directory
'/etc/ipsec.d/ocspce
rts'
May 10 09:20:05 testimax pluto[7669]: Could not change to directory
'/etc/ipsec.
d/crls'
May 10 09:20:06 testimax pluto[7669]: added connection description
"PHILLIPtoEAC
S"
May 10 09:20:06 testimax pluto[7669]: listening for IKE messages
May 10 09:20:06 testimax pluto[7669]: adding interface eth1/eth1
70.182.220.68:5
00
May 10 09:20:06 testimax pluto[7669]: adding interface eth0/eth0
192.168.0.110:5
00
May 10 09:20:06 testimax pluto[7669]: adding interface lo/lo 127.0.0.1:500
May 10 09:20:06 testimax pluto[7669]: adding interface lo/lo ::1:500
May 10 09:20:06 testimax pluto[7669]: loading secrets from
"/etc/ipsec.secrets"
May 10 09:20:06 testimax pluto[7669]: "PHILLIPtoEACS" #1: initiating
Main Mode
May 10 09:20:06 testimax pluto[7669]: "PHILLIPtoEACS" #1: received
Vendor ID pay
load [Openswan (this version) 2.3.1 X.509-1.5.4 PLUTO_SENDS_VENDORID
PLUTO_USES
_KEYRR]
May 10 09:20:06 testimax pluto[7669]: "PHILLIPtoEACS" #1: received
Vendor ID pay
load [Dead Peer Detection]
May 10 09:20:06 testimax pluto[7669]: "PHILLIPtoEACS" #1: transition
from state
STATE_MAIN_I1 to state STATE_MAIN_I2
May 10 09:20:06 testimax pluto[7669]: "PHILLIPtoEACS" #1: I did not send
a certi
ficate because I do not have one.
May 10 09:20:06 testimax pluto[7669]: "PHILLIPtoEACS" #1: transition
from state
STATE_MAIN_I2 to state STATE_MAIN_I3
May 10 09:20:06 testimax pluto[7669]: "PHILLIPtoEACS" #1: Main mode peer
ID is I
D_IPV4_ADDR: '68.12.232.86'
May 10 09:20:06 testimax pluto[7669]: "PHILLIPtoEACS" #1: transition
from state
STATE_MAIN_I3 to state STATE_MAIN_I4
May 10 09:20:06 testimax pluto[7669]: "PHILLIPtoEACS" #1: ISAKMP SA
established
May 10 09:20:06 testimax pluto[7669]: "PHILLIPtoEACS" #2: initiating
Quick Mode
PSK+ENCRYPT+COMPRESS+TUNNEL+PFS+UP {using isakmp#1}
May 10 09:20:08 testimax pluto[7669]: "PHILLIPtoEACS" #2: transition
from state
STATE_QUICK_I1 to state STATE_QUICK_I2
May 10 09:20:08 testimax pluto[7669]: "PHILLIPtoEACS" #2: sent QI2,
IPsec SA est
ablished {ESP=>0xcfc6435f <0x46df2a6c xfrm=AES_0-HMAC_SHA1
IPCOMP=>0x00007bd2 <0
x000065ad}
May 10 09:20:18 testimax pluto[7669]: "PHILLIPtoEACS" #1: ignoring
Delete SA pay
load: PROTO_IPSEC_ESP SA(0xaefaf390) not found (maybe expired)
May 10 09:20:18 testimax pluto[7669]: "PHILLIPtoEACS" #1: received and
ignored i
nformational message
Ping test results (RIGHT client to LEFT client):
>ping 192.168.192.10
Pinging 192.168.192.10 with 32 bytes of data:
Reply from 192.168.192.10: bytes=32 time=22ms TTL=126
Reply from 192.168.192.10: bytes=32 time=22ms TTL=126
Reply from 192.168.192.10: bytes=32 time=22ms TTL=126
Reply from 192.168.192.10: bytes=32 time=20ms TTL=126
Ping statistics for 192.168.192.10:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 20ms, Maximum = 22ms, Average = 21ms
[C:\Documents and Settings\EACSI]
>ping 192.168.192.10 -l 60
Pinging 192.168.192.10 with 60 bytes of data:
Reply from 192.168.192.10: bytes=60 time=17ms TTL=126
Reply from 192.168.192.10: bytes=60 time=20ms TTL=126
Reply from 192.168.192.10: bytes=60 time=30ms TTL=126
Reply from 192.168.192.10: bytes=60 time=18ms TTL=126
Ping statistics for 192.168.192.10:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 17ms, Maximum = 30ms, Average = 21ms
[C:\Documents and Settings\EACSI]
>ping 192.168.192.10 -l 64
Pinging 192.168.192.10 with 64 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.192.10:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
Ping test results (RIGHT firewall to LEFT client):
[root at testimax ~]# ping -I 192.168.0.110 192.168.192.10 -w 4
PING 192.168.192.10 (192.168.192.10) from 192.168.0.110 : 56(84) bytes
of data.
64 bytes from 192.168.192.10: icmp_seq=0 ttl=127 time=20.2 ms
64 bytes from 192.168.192.10: icmp_seq=1 ttl=127 time=19.1 ms
64 bytes from 192.168.192.10: icmp_seq=2 ttl=127 time=17.7 ms
64 bytes from 192.168.192.10: icmp_seq=3 ttl=127 time=18.8 ms
--- 192.168.192.10 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3002ms
rtt min/avg/max/mdev = 17.768/19.014/20.258/0.891 ms, pipe 2
[root at testimax ~]# ping -I 192.168.0.110 192.168.192.10 -w 4 -s 64
PING 192.168.192.10 (192.168.192.10) from 192.168.0.110 : 64(92) bytes
of data.
72 bytes from 192.168.192.10: icmp_seq=0 ttl=127 time=18.5 ms
72 bytes from 192.168.192.10: icmp_seq=1 ttl=127 time=33.7 ms
72 bytes from 192.168.192.10: icmp_seq=2 ttl=127 time=26.9 ms
72 bytes from 192.168.192.10: icmp_seq=3 ttl=127 time=22.5 ms
--- 192.168.192.10 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3002ms
rtt min/avg/max/mdev = 18.530/25.429/33.776/5.658 ms, pipe 2
[root at testimax ~]# ping -I 192.168.0.110 192.168.192.10 -w 4 -s 128
PING 192.168.192.10 (192.168.192.10) from 192.168.0.110 : 128(156) bytes
of data
.
136 bytes from 192.168.192.10: icmp_seq=0 ttl=127 time=32.3 ms
136 bytes from 192.168.192.10: icmp_seq=1 ttl=127 time=18.2 ms
136 bytes from 192.168.192.10: icmp_seq=2 ttl=127 time=20.8 ms
136 bytes from 192.168.192.10: icmp_seq=3 ttl=127 time=19.9 ms
--- 192.168.192.10 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3002ms
rtt min/avg/max/mdev = 18.257/22.873/32.378/5.569 ms, pipe 2
[root at testimax ~]# ping -I 192.168.0.110 192.168.192.10 -w 4 -s 256
PING 192.168.192.10 (192.168.192.10) from 192.168.0.110 : 256(284) bytes
of data
.
264 bytes from 192.168.192.10: icmp_seq=0 ttl=127 time=20.2 ms
264 bytes from 192.168.192.10: icmp_seq=1 ttl=127 time=24.4 ms
264 bytes from 192.168.192.10: icmp_seq=2 ttl=127 time=29.5 ms
264 bytes from 192.168.192.10: icmp_seq=3 ttl=127 time=32.6 ms
--- 192.168.192.10 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3002ms
rtt min/avg/max/mdev = 20.219/26.709/32.662/4.767 ms, pipe 2
[root at testimax ~]# ping -I 192.168.0.110 192.168.192.10 -w 4 -s 1024
PING 192.168.192.10 (192.168.192.10) from 192.168.0.110 : 1024(1052)
bytes of da
ta.
--- 192.168.192.10 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3000ms
ANY suggestions would be helpful!
Thanks,
Phillip
More information about the Users
mailing list