[Openswan Users] FW: VPN works, but you can't eBay ;-)
Miguel Dilaj
mdilaj at nccglobal.com
Tue May 17 13:11:16 CEST 2005
Hi all,
This is the current output of ipsec auto --status (anonymized), note the
line at the very end:
000 interface lo/lo 127.0.0.1
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 {external IP}
000 interface eth0/eth0 {external IP}
000 interface eth1/eth1 {internal IP}
000 interface eth1/eth1 {internal IP}
000 %myid = (none)
000 debug none
000
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64,
keysizemax=64
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192,
keysizemax=192
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40,
keysizemax=448
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0,
keysizemax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128,
keysizemax=256
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8,
keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5,
keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1,
keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256,
keysizemin=256, keysizemax=256
000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0
000
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16,
keydeflen=128
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8,
keydeflen=192
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000
000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0}
trans={0,0,0} attrs={0,0,0}
000
000 "roadwarrior": 0.0.0.0/0==={external IP}[C=xx, ST=xx, L=xx, O=xx, OU=xx,
CN={VPN GW id}]...%any[C=xx, ST=xx, L=xx, O=xx, OU=xx, CN=*]; unrouted;
eroute owner: #0
000 "roadwarrior": srcip=unset; dstip=unset
000 "roadwarrior": CAs: 'C=xx, ST=xx, L=xx, O=xx, OU=xx, CN={CA
id}'...'%any'
000 "roadwarrior": ike_life: 3600s; ipsec_life: 28800s; rekey_margin:
540s; rekey_fuzz: 100%; keyingtries: 3
000 "roadwarrior": policy: RSASIG+ENCRYPT+COMPRESS+TUNNEL+PFS; prio: 0,32;
interface: eth0;
000 "roadwarrior": newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "roadwarrior"[8]: 0.0.0.0/0==={external IP}[C=xx, ST=xx, L=xx, O=xx,
OU=xx, CN={VPN GW id}]...{RW1 IP}[C=xx, ST=xx, L=xx, O=xx, OU=xx, CN={RW1
id}]; erouted; eroute owner: #53
000 "roadwarrior"[8]: srcip=unset; dstip=unset
000 "roadwarrior"[8]: CAs: 'C=xx, ST=xx, L=xx, O=xx, OU=xx, CN={CA
id}'...'%any'
000 "roadwarrior"[8]: ike_life: 3600s; ipsec_life: 28800s; rekey_margin:
540s; rekey_fuzz: 100%; keyingtries: 3
000 "roadwarrior"[8]: policy: RSASIG+ENCRYPT+COMPRESS+TUNNEL+PFS; prio:
0,32; interface: eth0;
000 "roadwarrior"[8]: newest ISAKMP SA: #55; newest IPsec SA: #53;
000 "roadwarrior"[8]: IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024
000 "roadwarrior"[10]: 0.0.0.0/0==={external IP}[C=xx, ST=xx, L=xx, O=xx,
OU=xx, CN={VPN GW id}]...{RW2 IP}[C=xx, ST=xx, L=xx, O=xx, OU=xx, CN={RW2
id}]; erouted; eroute owner: #49
000 "roadwarrior"[10]: srcip=unset; dstip=unset
000 "roadwarrior"[10]: CAs: 'C=xx, ST=xx, L=xx, O=xx, OU=xx, CN={CA
id}'...'%any'
000 "roadwarrior"[10]: ike_life: 3600s; ipsec_life: 28800s; rekey_margin:
540s; rekey_fuzz: 100%; keyingtries: 3
000 "roadwarrior"[10]: policy: RSASIG+ENCRYPT+COMPRESS+TUNNEL+PFS; prio:
0,32; interface: eth0;
000 "roadwarrior"[10]: newest ISAKMP SA: #56; newest IPsec SA: #49;
000 "roadwarrior"[10]: IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024
000
000 #53: "roadwarrior"[8] {RW1 IP} STATE_QUICK_R2 (IPsec SA established);
EVENT_SA_REPLACE in 11837s; newest IPSEC; eroute owner
000 #53: "roadwarrior"[8] {RW1 IP} esp.48c4c795@{RW1 IP}
esp.a76c1b56@{external IP} comp.65de@{RW1 IP} comp.b580@{external IP}
tun.0@{RW1 IP} tun.0@{external IP}
000 #45: "roadwarrior"[8] {RW1 IP} STATE_QUICK_R2 (IPsec SA established);
EVENT_SA_REPLACE in 9129s
000 #45: "roadwarrior"[8] {RW1 IP} esp.4e73c6be@{RW1 IP}
esp.17620e40@{external IP} comp.8f2f@{RW1 IP} comp.1b71@{external IP}
tun.0@{RW1 IP} tun.0@{external IP}
000 #55: "roadwarrior"[8] {RW1 IP} STATE_MAIN_I4 (ISAKMP SA established);
EVENT_SA_REPLACE in 296s; newest ISAKMP; nodpd
000 #49: "roadwarrior"[10] {RW2 IP} STATE_QUICK_R2 (IPsec SA established);
EVENT_SA_REPLACE in 10217s; newest IPSEC; eroute owner
000 #49: "roadwarrior"[10] {RW2 IP} esp.d963d947@{RW2 IP}
esp.5ebc916@{external IP} comp.64c@{RW2 IP} comp.8570@{external IP}
tun.0@{RW2 IP} tun.0@{external IP}
000 #56: "roadwarrior"[10] {RW2 IP} STATE_MAIN_I4 (ISAKMP SA established);
EVENT_SA_REPLACE in 1473s; newest ISAKMP; nodpd
000
000 {eBay IP}/32:0 -6-> {RW2 IP}/32:0 => %hold 0 %acquire-netlink
RW1 was me, I can go to eBay and the other offending sites, login to MSN,
etc. RW2 can't browse to eBay or login to MSN. Both of use have a MTU of
1300. His machine was freshly installed yesterday, so it's WinXP SP2 with
SafeNet 8.0.2. Mine is similar, but with a lot of garbage ;-)
I would like this opportunity to post my ipsec.conf, for sure there are
things that can be corrected by the experts here.
# /etc/ipsec.conf - Openswan IPsec configuration file
# RCSID $Id: ipsec.conf.in,v 1.13 2004/03/24 04:14:39 ken Exp $
# This file: /usr/share/doc/openswan/ipsec.conf-sample
#
# Manual: ipsec.conf.5
version 2.0 # conforms to second version of ipsec.conf specification
config setup
interfaces="ipsec0=eth0"
nat_traversal=yes
forwardcontrol=yes
uniqueids=yes
virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!{re
ad note below}/24
conn %default
keyingtries=3
compress=yes
disablearrivalcheck=no
authby=rsasig
leftrsasigkey=%cert
rightrsasigkey=%cert
conn roadwarrior
left={external IP}
leftcert={VPN GW certificate}
leftid="C=xx, ST=xx, L=xx, O=xx, OU=xx, CN={VPN GW id}"
leftsubnet=0.0.0.0/0
leftupdown=/etc/ipsec.d/ipsec.masquerade
right=%any
rightid="C=xx, ST=xx, L=xx, O=xx, OU=xx, CN=*"
auto=add
pfs=yes
include /etc/ipsec.d/examples/no_oe.conf
I'm avoiding to identify a partial private range as private (in the
virtual_private directive) because it's used for a special purpose. The
internal interface of the Openswan box is in that special range. I don't
really know if this is needed, and I don't see (in principle) any relation
with the problem I have.
The leftid and rightid directives were added yesterday and didn't broke
anything. Before I just allowed Openswan to figure the id by itself, but I
read somewhere that this can potentially cause some problems with
roadwarriors, because if IP is used as the id, beforehand it is always
0.0.0.0 (don't know if this is true, and in fact everything worked before as
well, with the same problem).
The leftupdown script is simply flushing the nat table and creating a rule
to masquerade traffic going out.
The configuration of SafeNet on the Windows boxes is as follows:
1) a rule non encrypted to direct traffic to some local resources, using one
network card
range (some private range that's local)
no encryption
all protocols
interface: the 1st interface
2) the VPN configuration, using a second network card:
range 0.0.0.0-255.255.255.255 (note that a partial range is used
locally by the first rule, this works)
all protocols
secure gateway tunnel
use certificate
gw IP address: {external IP} in the Openswan box
My identity: certificate
no use of virtual adapter
interface: the 2nd interface
phase 1 negotiation: main mode
enable PFS
DH group 2
enable replay detection (I still wonder what's that ;-)
Phase 1:
auth by RSA signatures
encryption 3DES
hashing MD5
SA life 18000 seconds
DH group 2
Phase 2:
SA life 18000 seconds
deflate compression
ESP:
encryption 3DES
hashing MD5
encapsulation tunnel
no AH
Any suggestions?
Thank you in advance.
Kind regards,
Miguel
***********************************************************************************************************
DISCLAIMER:
This e-mail contains proprietary information, some or all of which may be legally privileged.
It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail,
please notify the author by replying to this e-mail. If you are not the intended recipient you may not use,
disclose, distribute, copy, print or rely on this e-mail.
***********************************************************************************************************
More information about the Users
mailing list