[Openswan Users] VPN works internally, not from internet through NAT

Arno Lehmann al at its-lehmann.de
Wed Jul 25 06:21:39 EDT 2007


Hi,

24.07.2007 00:18,, Paul Wouters wrote::
> On Mon, 23 Jul 2007, Arno Lehmann wrote:
> 
> 
> That could be: http://bugs.xelerance.com/view.php?id=802
> 
> Try the patch in openswan 2.4.9's contrib directory?

Now I'm slightly confused... I found a kernel patch regarding nat 
traversal, but no contrib directory on ftp.openswan.org.

Applying a kernel patch is definitely not what I want - I need to keep 
the vendor kernels on the systems I'm working with.

In the bug report, two patches were mentioned. Do you refer to those?

Arno


> Paul
> 
>> after I got the PSK authentication working inside my test network, I
>> progessed to the next problems.
>>
>> The basic setup:
>> Client is Windows Vista, using IPsec/L2TP as VPN client.
>> Server is Linux Openswan U2.4.6/K2.6.18.8-0.3-default (netkey) as
>> distributed in OpenSUSE 10.2
>>
>> I use x509 certificates for authentication, which does work inside the
>>   LAN.
>>
>> The LAN is connected to the internet through a NAT'ing router.
>>
>> This is the network layout:
>>
>> ~~~~~~~~~
>> Internet } === Router === VPN-Gateway === Internal LAN, 192.168.0.0/24
>> ~~~~~~~~~     /      |    \               (irrelevant for now...)
>>               /       |     \
>>    dynamic IP,  static IP    static IP
>> ddns hostname  192.168.1.1  192.168.1.2
>>
>>
>> The router is doing NAT and is set up to forward incoming traffic on
>> udp ports 500 and 4500 to the 192.168.1.1 host. tcpdump shows that an
>> ipsec conversation is taking place between client and VPN gateway.
>>
>> (The router can be setup to also forward ip protocols 50 and 51; would
>> that help? - after my reading, I suppose it would not.)
>>
>> The relevant configuration of the VPN gateway is:
>>
>> version 2.0     # conforms to second version of ipsec.conf specification
>>
>> # basic configuration
>>
>> config setup
>>          interfaces="ipsec0=eth2 ipsec1=eth1 ipsec2=eth0"
>>          # klipsdebug=
>>          # plutodebug=all
>>          # manualstart=
>>          # syslog=
>>          plutowait=yes
>>          nhelpers=0
>> virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.0.0/24,%v4:!192.168.37.0/24,%v4:!192.168.1.1/24
>>          nat_traversal=yes
>>
>> conn extern-cert
>>          pfs=no
>>          authby=rsasig
>>          rightrsasigkey=%cert
>>          leftcert=ITS-VPN.pem
>>          left=192.168.1.2
>>          leftnexthop=192.168.1.1
>>          leftrsasigkey=%cert
>>          leftprotoport=17/1701
>>          right=%any
>>          rightprotoport=17/1701
>>          rightsubnet=vhost:%no,%priv
>>          rightca=%same
>>          auto=add
>>
>> An almost complete session log is at the end of this mail, but the
>> problem, in short, is this:
>>
>> A VPN connection is not created, which I suspect is due to the
>> following events:
>>
>>  > Jul 23 23:12:22 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1
>> #3: STATE_QUICK_R2: IPsec SA established {ESP=>0x4f2beffd <0x5299bed6
>> xfrm=AES_128-HMAC_SHA1 NATD=82.113.106.1:34585 DPD=none}
>>  > Jul 23 23:12:23 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1
>> #1: received Delete SA(0x3423cae0) payload: deleting IPSEC State #2
>>
>> Which seems to indicate that my client for some reason unknown to me
>> refuses the VPN setup.
>>
>> Now I've got two questions:
>> - Is this really the clients decision to refuse the VPN setup?
>> - How do I fix that?
>>
>> That same client, with the identical certificates, can create a VPN
>> connection through the LAN. The only difference in the connection
>> setup is that the internal VPN connection is defined without a
>> leftnexthop statement, and left= refers to another network interface.
>>
>>
>> Thanks, again, in advance for your support!
>>
>> Arno
>>
>> Here is the ipsec session log:
>>> Jul 23 23:11:37 balrog ipsec__plutorun: Starting Pluto subsystem...
>>> Jul 23 23:11:37 balrog pluto[13798]: Starting Pluto (Openswan Version 2.4.6 X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OEN|EMqk_Mlg)
>>> Jul 23 23:11:37 balrog pluto[13798]: Setting NAT-Traversal port-4500 floating to on
>>> Jul 23 23:11:37 balrog pluto[13798]:    port floating activation criteria nat_t=1/port_fload=1
>>> Jul 23 23:11:37 balrog pluto[13798]:   including NAT-Traversal patch (Version 0.6c)
>>> Jul 23 23:11:37 balrog pluto[13798]: WARNING: Open of /dev/hw_random failed in init_rnd_pool(), trying alternate sources of random
>>> Jul 23 23:11:37 balrog pluto[13798]: WARNING: Using /dev/urandom as the source of random
>>> Jul 23 23:11:37 balrog pluto[13798]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
>>> Jul 23 23:11:37 balrog pluto[13798]: no helpers will be started, all cryptographic operations will be done inline
>>> Jul 23 23:11:37 balrog pluto[13798]: Using Linux 2.6 IPsec interface code on 2.6.18.8-0.3-default
>>> Jul 23 23:11:37 balrog pluto[13798]: Changing to directory '/etc/ipsec.d/cacerts'
>>> Jul 23 23:11:37 balrog pluto[13798]:   loaded CA cert file 'ITS-VPN-cacert.pem' (1939 bytes)
>>> Jul 23 23:11:37 balrog pluto[13798]:   loaded CA cert file 'ITS-CA.pem' (2451 bytes)
>>> Jul 23 23:11:37 balrog pluto[13798]: Could not change to directory '/etc/ipsec.d/aacerts'
>>> Jul 23 23:11:37 balrog pluto[13798]: Could not change to directory '/etc/ipsec.d/ocspcerts'
>>> Jul 23 23:11:37 balrog pluto[13798]: Changing to directory '/etc/ipsec.d/crls'
>>> Jul 23 23:11:37 balrog pluto[13798]:   Warning: empty directory
>>> Jul 23 23:11:37 balrog ipsec__plutorun: ipsec_auto: fatal error in "private": %defaultroute requested but not known
>>> Jul 23 23:11:37 balrog ipsec__plutorun: ipsec_auto: fatal error in "clear": %defaultroute requested but not known
>>> Jul 23 23:11:37 balrog pluto[13798]:   loaded host cert file '/etc/ipsec.d/certs/ITS-VPN.pem' (1428 bytes)
>>> Jul 23 23:11:37 balrog pluto[13798]: added connection description "extern-cert"
>>> Jul 23 23:11:37 balrog pluto[13798]:   loaded host cert file '/etc/ipsec.d/certs/ITS-VPN.pem' (1428 bytes)
>>> Jul 23 23:11:37 balrog pluto[13798]: added connection description "wlan-cert"
>>> Jul 23 23:11:37 balrog ipsec__plutorun: ipsec_auto: fatal error in "block": %defaultroute requested but not known
>>> Jul 23 23:11:37 balrog ipsec__plutorun: ipsec_auto: fatal error in "private-or-clear": %defaultroute requested but not known
>>> Jul 23 23:11:37 balrog pluto[13798]:   loaded host cert file '/etc/ipsec.d/certs/ITS-VPN.pem' (1428 bytes)
>>> Jul 23 23:11:37 balrog pluto[13798]: added connection description "intern-cert"
>>> Jul 23 23:11:37 balrog ipsec__plutorun: ipsec_auto: fatal error in "clear-or-private": %defaultroute requested but not known
>>> Jul 23 23:11:38 balrog ipsec__plutorun: ipsec_auto: fatal error in "packetdefault": %defaultroute requested but not known
>>> Jul 23 23:11:38 balrog pluto[13798]: listening for IKE messages
>>> Jul 23 23:11:38 balrog pluto[13798]: adding interface eth2/eth2 192.168.0.22:500
>>> Jul 23 23:11:38 balrog pluto[13798]: adding interface eth2/eth2 192.168.0.22:4500
>>> Jul 23 23:11:38 balrog pluto[13798]: adding interface eth0/eth0 192.168.1.2:500
>>> Jul 23 23:11:38 balrog pluto[13798]: adding interface eth0/eth0 192.168.1.2:4500
>>> Jul 23 23:11:38 balrog pluto[13798]: adding interface eth1/eth1 192.168.37.1:500
>>> Jul 23 23:11:38 balrog pluto[13798]: adding interface eth1/eth1 192.168.37.1:4500
>>> Jul 23 23:11:38 balrog pluto[13798]: adding interface lo/lo 127.0.0.1:500
>>> Jul 23 23:11:38 balrog pluto[13798]: adding interface lo/lo 127.0.0.1:4500
>>> Jul 23 23:11:38 balrog pluto[13798]: adding interface lo/lo ::1:500
>>> Jul 23 23:11:38 balrog pluto[13798]: loading secrets from "/etc/ipsec.secrets"
>>> Jul 23 23:11:38 balrog pluto[13798]:   loaded private key file '/etc/ipsec.d/private/ITS-VPN-key.pem' (963 bytes)
>>> Jul 23 23:11:38 balrog ipsec__plutorun: 021 no connection named "private"
>>> Jul 23 23:11:38 balrog ipsec__plutorun: ...could not route conn "private"
>>> Jul 23 23:11:38 balrog ipsec__plutorun: 021 no connection named "clear"
>>> Jul 23 23:11:38 balrog ipsec__plutorun: ...could not route conn "clear"
>>> Jul 23 23:11:38 balrog ipsec__plutorun: 021 no connection named "block"
>>> Jul 23 23:11:38 balrog ipsec__plutorun: ...could not route conn "block"
>>> Jul 23 23:11:38 balrog ipsec__plutorun: 021 no connection named "private-or-clear"
>>> Jul 23 23:11:38 balrog ipsec__plutorun: ...could not route conn "private-or-clear"
>>> Jul 23 23:11:38 balrog ipsec__plutorun: 021 no connection named "clear-or-private"
>>> Jul 23 23:11:38 balrog ipsec__plutorun: ...could not route conn "clear-or-private"
>>> Jul 23 23:11:38 balrog ipsec__plutorun: 021 no connection named "packetdefault"
>>> Jul 23 23:11:38 balrog ipsec__plutorun: ...could not route conn "packetdefault"
>>> Jul 23 23:12:11 balrog pluto[13798]: packet from 82.113.106.1:305: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000005]
>>> Jul 23 23:12:11 balrog pluto[13798]: packet from 82.113.106.1:305: received Vendor ID payload [RFC 3947] method set to=110
>>> Jul 23 23:12:11 balrog pluto[13798]: packet from 82.113.106.1:305: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 110
>>> Jul 23 23:12:11 balrog pluto[13798]: packet from 82.113.106.1:305: ignoring Vendor ID payload [FRAGMENTATION]
>>> Jul 23 23:12:11 balrog pluto[13798]: packet from 82.113.106.1:305: ignoring unknown Vendor ID payload [fb1de3cdf341b7ea16b7e5be0855f120]
>>> Jul 23 23:12:11 balrog pluto[13798]: packet from 82.113.106.1:305: ignoring Vendor ID payload [Vid-Initial-Contact]
>>> Jul 23 23:12:11 balrog pluto[13798]: packet from 82.113.106.1:305: ignoring unknown Vendor ID payload [e3a5966a76379fe707228231e5ce8652]
>>> Jul 23 23:12:11 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: responding to Main Mode from unknown peer 82.113.106.1
>>> Jul 23 23:12:11 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: only OAKLEY_GROUP_MODP1024 and OAKLEY_GROUP_MODP1536 supported.  Attribute OAKLEY_GROUP_DESCRIPTION
>>> Jul 23 23:12:11 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: only OAKLEY_GROUP_MODP1024 and OAKLEY_GROUP_MODP1536 supported.  Attribute OAKLEY_GROUP_DESCRIPTION
>>> Jul 23 23:12:11 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
>>> Jul 23 23:12:11 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: STATE_MAIN_R1: sent MR1, expecting MI2
>>> Jul 23 23:12:13 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: NAT-Traversal: Result using 3: both are NATed
>>> Jul 23 23:12:13 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
>>> Jul 23 23:12:13 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: STATE_MAIN_R2: sent MR2, expecting MI3
>>> Jul 23 23:12:14 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: discarding duplicate packet; already STATE_MAIN_R2
>>> Jul 23 23:12:16 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: Main mode peer ID is ID_DER_ASN1_DN: 'C=DE, L=Osnabrueck, O=IT-Service Lehmann, OU=Network, CN=Phoenix, E=al at its-lehmann.de'
>>> Jul 23 23:12:16 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: no crl from issuer "C=DE, L=Osnabrueck, O=IT-Service Lehmann, OU=Network, CN=IT-Service Lehmann VPN CA, E=al at its-lehmann.de" found (strict=no)
>>> Jul 23 23:12:16 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: no crl from issuer "C=DE, L=Osnabrueck, O=IT-Service Lehmann, OU=CA, CN=IT-Service Lehmann CA, E=al at its-lehmann.de" found (strict=no)
>>> Jul 23 23:12:16 balrog pluto[13798]: "extern-cert"[1] 82.113.106.1 #1: switched from "extern-cert" to "extern-cert"
>>> Jul 23 23:12:16 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: deleting connection "extern-cert" instance with peer 82.113.106.1 {isakmp=#0/ipsec=#0}
>>> Jul 23 23:12:16 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: I am sending my cert
>>> Jul 23 23:12:16 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
>>> Jul 23 23:12:16 balrog pluto[13798]: | NAT-T: new mapping 82.113.106.1:305/34585)
>>> Jul 23 23:12:16 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}
>>> Jul 23 23:12:19 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: retransmitting in response to duplicate packet; already STATE_MAIN_R3
>>> Jul 23 23:12:19 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #2: responding to Quick Mode {msgid:01000000}
>>> Jul 23 23:12:19 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #2: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
>>> Jul 23 23:12:19 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #2: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
>>> Jul 23 23:12:20 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #2: discarding duplicate packet; already STATE_QUICK_R1
>>> Jul 23 23:12:21 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
>>> Jul 23 23:12:21 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #2: STATE_QUICK_R2: IPsec SA established {ESP=>0x3423cae0 <0x0bb43eb1 xfrm=AES_128-HMAC_SHA1 NATD=82.113.106.1:34585 DPD=none}
>>> Jul 23 23:12:21 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #3: responding to Quick Mode {msgid:02000000}
>>> Jul 23 23:12:21 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #3: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
>>> Jul 23 23:12:21 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #3: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
>>> Jul 23 23:12:22 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #3: discarding duplicate packet; already STATE_QUICK_R1
>>> Jul 23 23:12:22 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #3: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
>>> Jul 23 23:12:22 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #3: STATE_QUICK_R2: IPsec SA established {ESP=>0x4f2beffd <0x5299bed6 xfrm=AES_128-HMAC_SHA1 NATD=82.113.106.1:34585 DPD=none}
>>> Jul 23 23:12:23 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: received Delete SA(0x3423cae0) payload: deleting IPSEC State #2
>>> Jul 23 23:12:23 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: received and ignored informational message
>>> Jul 23 23:12:27 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #4: responding to Quick Mode {msgid:03000000}
>>> Jul 23 23:12:27 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #4: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
>>> Jul 23 23:12:27 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #4: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
>>> Jul 23 23:12:28 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #4: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
>>> Jul 23 23:12:28 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #4: STATE_QUICK_R2: IPsec SA established {ESP=>0xac14385e <0xfe617865 xfrm=AES_128-HMAC_SHA1 NATD=82.113.106.1:34585 DPD=none}
>>> Jul 23 23:12:28 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: received Delete SA(0x4f2beffd) payload: deleting IPSEC State #3
>>> Jul 23 23:12:28 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: received and ignored informational message
>>> Jul 23 23:12:35 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #5: responding to Quick Mode {msgid:04000000}
>>> Jul 23 23:12:35 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #5: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
>>> Jul 23 23:12:35 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #5: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
>>> Jul 23 23:12:36 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: received Delete SA(0xac14385e) payload: deleting IPSEC State #4
>>> Jul 23 23:12:36 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: received and ignored informational message
>>> Jul 23 23:12:38 balrog pluto[13798]: "extern-cert"[2] 82.113.106.1 #1: received Delete SA payload: deleting ISAKMP State #1
>>> Jul 23 23:12:38 balrog pluto[13798]: packet from 82.113.106.1:34585: received and ignored informational message
>>
>>
> 

-- 
Arno Lehmann
IT-Service Lehmann
www.its-lehmann.de


More information about the Users mailing list