[Openswan Users] IPSec + RoadWarrior + NAT-T + WinXP. rightsubnet=vhost:%no, %priv kills things
Erik Carlseen
erik-netfilter-users at planeterik.com
Fri Feb 23 03:20:19 EST 2007
Hi, I'm setting up a VPN with OpenSwan 2.4.6 on Vanilla kernel 2.6.18,
Windows XP, x.509 certificates, and NAT-T. .I've got everything working
perfectly without NAT-T involved and the "rightsubnet=" config line.
When I add -the "rightsubnet=" line to the config and try to connect,
things get screwed up.
If I attempt to connect via NAT, OpenSWAN indicates (and tcpdump shows)
that STATE_MAIN_R3 packets are being sent to the roadwarrior client, but
Ethereal shows them not arriving. I've tried running the NAT through a
Cisco 831 router so I could do some packet dumps there as well, and I
don't see those packets arriving at the public Interface (I've also
tried a consumer-grade router, just to verify that it wasn't an issue
with the Cisco device). I can ping with the outside of the client's NAT
router with 1500-byte packets just fine, so it doesn't appear to be an
MTU issue.
If I attempt to connect without NAT, the IPSec negotiates successfully,
and the XP client starts sending ESP-encapsulated L2TP packets. My
firewall responds with L2TP packets, but OpenSWAN doesn't encapsulate
them in IPSec - it just sends them in the clear (tcpdump on the
firewall's public interface shows this correctly). Crazy.
Any help or suggestions would be appreciated.
Obligatory ASCII Art:
OpenSWAN Box
[A.A.A.A]
|
( Internet )
|
[B.B.B.B]
Cisco 831
|
[172.16.70.2]
WinXP SP2 Client
******************************************************************************
******************************************************************************
OpenSwan Config (relevant sections) (the virtual_private entry is all
one line in the actual config; I wrapped it here for readability)
config setup
interfaces="ipsec0=eth0"
klipsdebug=none
plutodebug=none
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!172.16.68.0/24,
%v4:!172.20.0.0/14,%v4:!172.24.0.0/13,%v4:!192.168.3.0/24,%v4:!192.168.192.0/18
conn test-rw-x509
left=[A.A.A.A]
leftcert=(certificate file name)
leftrsasigkey=%cert
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
rightsubnet=vhost:%no,%priv
rightrsasigkey=%cert
rightca=%same
rightid="(x509 selection)"
authby=rsasig
pfs=no
type=transport
keyingtries=1
compress=yes
disablearrivalcheck=no
auto=add
******************************************************************************
******************************************************************************
Typical OpenSWAN output (with NAT):
Feb 22 22:19:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
responding to Main Mode from unknown peer [B.B.B.B]
Feb 22 22:19:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Feb 22 22:19:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
STATE_MAIN_R1: sent MR1, expecting MI2
Feb 22 22:19:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
Feb 22 22:19:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Feb 22 22:19:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
STATE_MAIN_R2: sent MR2, expecting MI3
Feb 22 22:19:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
Main mode peer ID is ID_DER_ASN1_DN: '(RW certificate stuff)'
Feb 22 22:19:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
no crl from issuer "(ca stuff)" found (strict=no)
Feb 22 22:19:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56: I
am sending my cert
Feb 22 22:19:04 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
deleting connection "test-rw-x509" instance with peer [Other Address]
{isakmp=#55/ipsec=#0}
Feb 22 22:19:04 Firewall pluto[8149]: "test-rw-x509" #51: deleting state
(STATE_MAIN_R3)
Feb 22 22:19:04 Firewall pluto[8149]: "test-rw-x509" #52: deleting state
(STATE_MAIN_R3)
Feb 22 22:19:04 Firewall pluto[8149]: "test-rw-x509" #48: deleting state
(STATE_MAIN_R3)
Feb 22 22:19:04 Firewall pluto[8149]: "test-rw-x509" #55: deleting state
(STATE_MAIN_R3)
Feb 22 22:19:04 Firewall pluto[8149]: "test-rw-x509" #54: deleting state
(STATE_MAIN_R3)
Feb 22 22:19:04 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Feb 22 22:19:04 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG
cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}
Feb 22 22:19:04 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
retransmitting in response to duplicate packet; already STATE_MAIN_R3
Feb 22 22:19:06 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
retransmitting in response to duplicate packet; already STATE_MAIN_R3
Feb 22 22:19:10 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
discarding duplicate packet -- exhausted retransmission; already
STATE_MAIN_R3
Feb 22 22:19:18 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
discarding duplicate packet -- exhausted retransmission; already
STATE_MAIN_R3
Feb 22 22:19:22 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
next payload type of ISAKMP Hash Payload has an unknown value: 24
Feb 22 22:19:22 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
malformed payload in packet
Feb 22 22:19:22 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #56:
sending notification PAYLOAD_MALFORMED to [B.B.B.B]:4500
Feb 22 22:19:25 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
responding to Main Mode from unknown peer [B.B.B.B]
Feb 22 22:19:25 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Feb 22 22:19:25 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
STATE_MAIN_R1: sent MR1, expecting MI2
Feb 22 22:19:25 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
Feb 22 22:19:25 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Feb 22 22:19:25 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
STATE_MAIN_R2: sent MR2, expecting MI3
Feb 22 22:19:25 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
Main mode peer ID is ID_DER_ASN1_DN: '(RW Certificate Stuff)'
Feb 22 22:19:25 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
no crl from issuer "(ca stuff)" found (strict=no)
Feb 22 22:19:25 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57: I
am sending my cert
Feb 22 22:19:26 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Feb 22 22:19:26 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG
cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}
Feb 22 22:19:26 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
retransmitting in response to duplicate packet; already STATE_MAIN_R3
Feb 22 22:19:28 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
retransmitting in response to duplicate packet; already STATE_MAIN_R3
Feb 22 22:19:32 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
discarding duplicate packet -- exhausted retransmission; already
STATE_MAIN_R3
Feb 22 22:19:40 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
discarding duplicate packet -- exhausted retransmission; already
STATE_MAIN_R3
Feb 22 22:19:43 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
next payload type of ISAKMP Hash Payload has an unknown value: 202
Feb 22 22:19:43 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
malformed payload in packet
Feb 22 22:19:43 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #57:
sending notification PAYLOAD_MALFORMED to [B.B.B.B]:4500
Feb 22 22:20:02 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
responding to Main Mode from unknown peer [B.B.B.B]
Feb 22 22:20:02 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Feb 22 22:20:02 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
STATE_MAIN_R1: sent MR1, expecting MI2
Feb 22 22:20:02 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
Feb 22 22:20:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Feb 22 22:20:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
STATE_MAIN_R2: sent MR2, expecting MI3
Feb 22 22:20:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
Main mode peer ID is ID_DER_ASN1_DN: '(RW Certificate Stuff)'
Feb 22 22:20:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
no crl from issuer "(CA Stuff)" found (strict=no)
Feb 22 22:20:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58: I
am sending my cert
Feb 22 22:20:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Feb 22 22:20:03 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG
cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}
Feb 22 22:20:04 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
retransmitting in response to duplicate packet; already STATE_MAIN_R3
Feb 22 22:20:06 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
retransmitting in response to duplicate packet; already STATE_MAIN_R3
Feb 22 22:20:10 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
discarding duplicate packet -- exhausted retransmission; already
STATE_MAIN_R3
Feb 22 22:20:18 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
discarding duplicate packet -- exhausted retransmission; already
STATE_MAIN_R3
Feb 22 22:20:20 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
next payload type of ISAKMP Hash Payload has an unknown value: 54
Feb 22 22:20:20 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
malformed payload in packet
Feb 22 22:20:20 Firewall pluto[8149]: "test-rw-x509"[3] [B.B.B.B] #58:
sending notification PAYLOAD_MALFORMED to [B.B.B.B]:4500
******************************************************************************
******************************************************************************
Output from "tcpdump -nvvvi eth0 ip host [B.B.B.B]"
Entries preceded by an asterisk are not received on the other end
(apparently they never actually make it on to the wire).
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96
bytes
22:36:55.422432 IP (tos 0x0, ttl 117, id 58279, offset 0, flags
[none], proto: UDP (17), length: 340) [B.B.B.B].isakmp >
[A.A.A.A].isakmp: isakmp 1.0 msgid cookie ->: phase 1 I ident: [|sa]
22:36:55.423647 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF],
proto: UDP (17), length: 168) [A.A.A.A].isakmp > [B.B.B.B].isakmp:
isakmp 1.0 msgid cookie ->: phase 1 R ident: [|sa]
22:36:55.772240 IP (tos 0x0, ttl 117, id 58280, offset 0, flags
[none], proto: UDP (17), length: 388) [B.B.B.B].isakmp >
[A.A.A.A].isakmp: isakmp 1.0 msgid cookie ->: phase 1 I ident: [|ke]
22:36:55.824812 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF],
proto: UDP (17), length: 584) [A.A.A.A].isakmp > [B.B.B.B].isakmp:
isakmp 1.0 msgid cookie ->: phase 1 R ident: [|ke]
22:36:55.996795 IP (tos 0x0, ttl 117, id 58281, offset 0, flags [+],
proto: UDP (17), length: 1500) [B.B.B.B].4500 > [A.A.A.A].4500:
NONESP-encap: isakmp 1.0 msgid cookie ->: phase 1 I ident[E]:
[encrypted id] (len mismatch: isakmp 3292/ip 1468)
22:36:56.004809 IP (tos 0x0, ttl 117, id 58281, offset 1480, flags
[+], proto: UDP (17), length: 1500) [B.B.B.B] > [A.A.A.A]: udp
22:36:56.010166 IP (tos 0x0, ttl 117, id 58281, offset 2960, flags
[none], proto: UDP (17), length: 364) [B.B.B.B] > [A.A.A.A]: udp
* 22:36:56.263035 IP (tos 0x0, ttl 64, id 44371, offset 0, flags [+],
proto: UDP (17), length: 1500) [A.A.A.A].4500 > [B.B.B.B].4500:
NONESP-encap: isakmp 1.0 msgid cookie ->: phase 1 R ident[E]:
[encrypted id] (len mismatch: isakmp 2604/ip 1468)
* 22:36:56.263046 IP (tos 0x0, ttl 64, id 44371, offset 1480, flags
[none], proto: UDP (17), length: 1156) [A.A.A.A] > [B.B.B.B]: udp
22:36:57.304518 IP (tos 0x0, ttl 117, id 58282, offset 0, flags [+],
proto: UDP (17), length: 1500) [B.B.B.B].4500 > [A.A.A.A].4500:
NONESP-encap: isakmp 1.0 msgid cookie ->: phase 1 I ident[E]:
[encrypted id] (len mismatch: isakmp 3292/ip 1468)
22:36:57.312520 IP (tos 0x0, ttl 117, id 58282, offset 1480, flags
[+], proto: UDP (17), length: 1500) [B.B.B.B] > [A.A.A.A]: udp
22:36:57.315907 IP (tos 0x0, ttl 117, id 58282, offset 2960, flags
[none], proto: UDP (17), length: 364) [B.B.B.B] > [A.A.A.A]: udp
* 22:36:57.316433 IP (tos 0x0, ttl 64, id 44372, offset 0, flags [+],
proto: UDP (17), length: 1500) [A.A.A.A].4500 > [B.B.B.B].4500:
NONESP-encap: isakmp 1.0 msgid cookie ->: phase 1 R ident[E]:
[encrypted id] (len mismatch: isakmp 2604/ip 1468)
* 22:36:57.316446 IP (tos 0x0, ttl 64, id 44372, offset 1480, flags
[none], proto: UDP (17), length: 1156) [A.A.A.A] > [B.B.B.B]: udp
22:36:59.304068 IP (tos 0x0, ttl 117, id 58285, offset 0, flags [+],
proto: UDP (17), length: 1500) [B.B.B.B].4500 > [A.A.A.A].4500:
NONESP-encap: isakmp 1.0 msgid cookie ->: phase 1 I ident[E]:
[encrypted id] (len mismatch: isakmp 3292/ip 1468)
22:36:59.312232 IP (tos 0x0, ttl 117, id 58285, offset 1480, flags
[+], proto: UDP (17), length: 1500) [B.B.B.B] > [A.A.A.A]: udp
22:36:59.317313 IP (tos 0x0, ttl 117, id 58285, offset 2960, flags
[none], proto: UDP (17), length: 364) [B.B.B.B] > [A.A.A.A]: udp
* 22:36:59.317823 IP (tos 0x0, ttl 64, id 44373, offset 0, flags [+],
proto: UDP (17), length: 1500) [A.A.A.A].4500 > [B.B.B.B].4500:
NONESP-encap: isakmp 1.0 msgid cookie ->: phase 1 R ident[E]:
[encrypted id] (len mismatch: isakmp 2604/ip 1468)
* 22:36:59.317834 IP (tos 0x0, ttl 64, id 44373, offset 1480, flags
[none], proto: UDP (17), length: 1156) [A.A.A.A] > [B.B.B.B]: udp
22:37:03.303190 IP (tos 0x0, ttl 117, id 58286, offset 0, flags [+],
proto: UDP (17), length: 1500) [B.B.B.B].4500 > [A.A.A.A].4500:
NONESP-encap: isakmp 1.0 msgid cookie ->: phase 1 I ident[E]:
[encrypted id] (len mismatch: isakmp 3292/ip 1468)
22:37:03.310106 IP (tos 0x0, ttl 117, id 58286, offset 1480, flags
[+], proto: UDP (17), length: 1500) [B.B.B.B] > [A.A.A.A]: udp
22:37:03.314442 IP (tos 0x0, ttl 117, id 58286, offset 2960, flags
[none], proto: UDP (17), length: 364) [B.B.B.B] > [A.A.A.A]: udp
22:37:11.301495 IP (tos 0x0, ttl 117, id 58287, offset 0, flags [+],
proto: UDP (17), length: 1500) [B.B.B.B].4500 > [A.A.A.A].4500:
NONESP-encap: isakmp 1.0 msgid cookie ->: phase 1 I ident[E]:
[encrypted id] (len mismatch: isakmp 3292/ip 1468)
22:37:11.308549 IP (tos 0x0, ttl 117, id 58287, offset 1480, flags
[+], proto: UDP (17), length: 1500) [B.B.B.B] > [A.A.A.A]: udp
22:37:11.313901 IP (tos 0x0, ttl 117, id 58287, offset 2960, flags
[none], proto: UDP (17), length: 364) [B.B.B.B] > [A.A.A.A]: udp
22:37:27.298053 IP (tos 0x0, ttl 117, id 58290, offset 0, flags [+],
proto: UDP (17), length: 1500) [B.B.B.B].4500 > [A.A.A.A].4500:
NONESP-encap: isakmp 1.0 msgid cookie ->: phase 1 I ident[E]:
[encrypted id] (len mismatch: isakmp 3292/ip 1468)
22:37:27.306852 IP (tos 0x0, ttl 117, id 58290, offset 1480, flags
[+], proto: UDP (17), length: 1500) [B.B.B.B] > [A.A.A.A]: udp
22:37:27.311287 IP (tos 0x0, ttl 117, id 58290, offset 2960, flags
[none], proto: UDP (17), length: 364) [B.B.B.B] > [A.A.A.A]: udp
22:37:59.287414 IP (tos 0x0, ttl 117, id 58301, offset 0, flags
[none], proto: UDP (17), length: 116) [B.B.B.B].4500 > [A.A.A.A].4500:
NONESP-encap: isakmp 1.0 msgid cookie ->: phase 2/others I inf[E]:
[encrypted hash]
22:37:59.288638 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF],
proto: UDP (17), length: 72) [A.A.A.A].4500 > [B.B.B.B].4500: [udp sum
ok] NONESP-encap: isakmp 1.0 msgid cookie ->: phase 2/others R inf:
(n: doi=ipsec proto=isakmp type=PAYLOAD-MALFORMED)
More information about the Users
mailing list