[Openswan Users] Cannot see opposite subnet from VPN server

Arjun Datta arjun at greatgulfhomes.com
Thu May 22 16:14:02 EDT 2008


Hi Peter,

Here is the output of ipsec barf | grep gghdev-brockport where gghdev is 
the 10.243.102.0/24 subnet and brockport is the 10.249.100.0/24 subnet.

[root at vpn etc]# ipsec barf | grep gghdev-brockport
000 "gghdev-brockport": 
10.243.0.0/16===216.191.52.91---216.191.52.65...66.186.93.1---209.91.185.168===10.249.0.0/16; 
erouted; eroute owner: #14
000 "gghdev-brockport":     srcip=10.243.102.230; dstip=10.249.100.20; 
srcup=ipsec _updown; dstup=ipsec _updown;
000 "gghdev-brockport":   ike_life: 3600s; ipsec_life: 28800s; 
rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "gghdev-brockport":   policy: PSK+ENCRYPT+TUNNEL+PFS+UP; prio: 
16,16; interface: eth0;
000 "gghdev-brockport":   newest ISAKMP SA: #0; newest IPsec SA: #14;
000 #8: "gghdev-brockport":500 STATE_QUICK_I2 (sent QI2, IPsec SA 
established); EVENT_SA_REPLACE in 26668s
000 #8: "gghdev-brockport" esp.4201bca6 at 209.91.185.168 
esp.271aff04 at 216.191.52.91 tun.0 at 209.91.185.168 tun.0 at 216.191.52.91
000 #14: "gghdev-brockport":500 STATE_QUICK_R2 (IPsec SA established); 
EVENT_SA_REPLACE in 27468s; newest IPSEC; eroute owner
000 #14: "gghdev-brockport" esp.5aae9ff4 at 209.91.185.168 
esp.2e4f4a9 at 216.191.52.91 tun.0 at 209.91.185.168 tun.0 at 216.191.52.91
conn gghdev-brockport
May 22 14:46:33 vpn pluto[31735]: added connection description 
"gghdev-brockport"
May 22 14:46:38 vpn pluto[31735]: "gghdev-brockport" #8: initiating 
Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP {using isakmp#4}
May 22 14:46:39 vpn pluto[31735]: "gghdev-brockport" #8: transition from 
state STATE_QUICK_I1 to state STATE_QUICK_I2
May 22 14:46:39 vpn pluto[31735]: "gghdev-brockport" #8: STATE_QUICK_I2: 
sent QI2, IPsec SA established {ESP=>0x4201bca6 <0x271aff04 
xfrm=AES_0-HMAC_SHA1 NATD=none DPD=none}
May 22 14:46:42 vpn pluto[31735]: "gghdev-brockport" #14: responding to 
Quick Mode {msgid:87763e32}
May 22 14:46:42 vpn pluto[31735]: "gghdev-brockport" #14: transition 
from state STATE_QUICK_R0 to state STATE_QUICK_R1
May 22 14:46:42 vpn pluto[31735]: "gghdev-brockport" #14: 
STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
May 22 14:46:42 vpn pluto[31735]: "gghdev-brockport" #14: transition 
from state STATE_QUICK_R1 to state STATE_QUICK_R2
May 22 14:46:42 vpn pluto[31735]: "gghdev-brockport" #14: 
STATE_QUICK_R2: IPsec SA established {ESP=>0x5aae9ff4 <0x02e4f4a9 
xfrm=AES_0-HMAC_SHA1 NATD=none DPD=none}

I commmented out the klips and plutodebug lines in ipsec.conf and 
restarted ipsec but ipsec barf still spewed out a lot of information so 
I used grep above to glean the pertinent parts.

If this is not what you need please let me know.

Regards,
 
Arjun Datta



Peter McGill wrote:
> Arjun,
>
> No the traceroute should never show any internet hosts, it should go from 10.243.102.230 to 10.249.100.20 directly (utilizing the
> ipsec tunnel) and then to .22 (for that case), assuming of course that the tunnel is established.
> That the traceroute uses the internet indicates a problem on 10.243.102.230, your not MASQing the ipsec traffic are you?
> Give us an ipsec barf on 10.243.102.230, that should help us identify the cause of your trouble.
> First make sure your debug options in ipsec.conf are set to none or commented out.
>  
>
> Peter McGill
> IT Systems Analyst
> Gra Ham Energy Limited 
>
>  
>
>
> ________________________________
>
> 	From: Arjun Datta [mailto:arjun at greatgulfhomes.com] 
> 	Sent: May 22, 2008 2:23 PM
> 	To: petermcgill at goco.net
> 	Cc: users at openswan.org
> 	Subject: Re: [Openswan Users] Cannot see opposite subnet from VPN server
> 	
> 	
> 	Hi Peter,
> 	
> 	10.249.100.20 is the gateway for 10.249.100.0/24.  There is no other gw for that subnet
> 	
> 	It appears that my communincation breaks down at an external point on an external router outside my network:
> 	
> 	>From 10.243.102.230:
> 	[root at vpn ~]# traceroute 10.249.100.20
> 	traceroute to 10.249.100.20 (10.249.100.20), 30 hops max, 40 byte packets
> 	 1  216.191.158.97 (216.191.158.97)  3.292 ms  3.116 ms  3.065 ms
> 	 2  209.112.55.121 (209.112.55.121)  1.651 ms  1.654 ms *
> 	 3  * * *
> 	 4  * * *
> 	 5  * * *
> 	..
> 	30  * * *
> 	
> 	[root at vpn ~]# traceroute 10.249.100.22 - another static ip on the 10.249.100.0/24 subnet
> 	traceroute to 10.249.100.22 (10.249.100.22), 30 hops max, 40 byte packets
> 	 1  216.191.158.97 (216.191.158.97)  3.654 ms  3.345 ms  4.666 ms
> 	 2  209.112.55.121 (209.112.55.121)  5.752 ms  6.763 ms *
> 	 3  * * *
> 	 4  * * *
> 	 5  * * *
> 	 6  * * *
> 	...
> 	30  * * *
> 	
> 	Does this mean that a router owned by an ISP somewhere is blocking the returns ?
> 	
> 	Regards,
> 	 
> 	Arjun Datta
>
> 	Peter McGill wrote: 
>
> 		Arjun,
> 		
> 		The route you added on 10.243.102.254 (net 10.249.100.0/24 gw 10.243.102.230) allows communication between
> 10.243.102.0/24 and
> 		10.249.100.0/24. You need it for this to work.
> 		However, no routes on 10.243.102.254 will affect communication between 10.243.102.230 and 10.249.100.0/24, as the
> traffic will never
> 		reach 10.243.102.254.
> 		Do you have a different gateway for the 10.249.100.0/24 subnet other than 10.249.100.20, like you do on the
> 10.243.102.0/24 subnet?
> 		In that case you will need a route on it (10.249.100.?) also, (net 10.243.102.0/24 gw 10.249.100.20).
> 		If that is not the case I suggest the following on 10.243.102.230:
> 		traceroute 10.249.100.20
> 		traceroute 10.249.100.(test host)
> 		Which will indicate where the communication breaks down.
> 		
> 		
> 		Peter McGill
> 		IT Systems Analyst
> 		Gra Ham Energy Limited 
> 		
> 		 
> 		
> 		
> 		________________________________
> 		
> 			From: Arjun Datta [mailto:arjun at greatgulfhomes.com] 
> 			Sent: May 21, 2008 7:58 PM
> 			To: Matthew Hall
> 			Cc: Paul Wouters; users at openswan.org; petermcgill at goco.net
> 			Subject: Re: [Openswan Users] Cannot see opposite subnet from VPN server
> 			
> 			
> 			Thank you guys - Paul, Peter and Matthew.
> 			
> 			I applied the leftsourcip= and rightsourceip= changes advocated and suggested, and I can ping the
> 10.243.102.x subnet from
> 		the 10.249.100.20 VPN server now.
> 			
> 			However I still cannot ping the 10.249.100.x subnet from the 10.243.102.230 VPN server.
> 			
> 			Now, the gateway for the 10.243.102.x domain is NOT the 10.243.102.230 machine, the gateway is
> 10.243.102.254.
> 			
> 			I have manually added routes to the latter .254 machine to route all traffic for the 10.249.100.x subnet
> through the
> 		10.243.102.230 machine (VPN Peer/Server).  Sop I have to tweak something on the .254 machine to allow 10.243.102.230
> to ping the
> 		10.249.100 subnet ?
> 			
> 			>I have a VPN tunnel established between two subnets: 
> 			>10.243.102.x - the vpn server is 10.243.102.230 - 2.6.22.9-61.fc6, Linux Openswan U2.4.5/K2.6.22.9-61.fc6
> (netkey) 
> 			>10.249.100.x - the vpn server is 10.249.100.20 -  2.6.23.15-80.fc7, Linux Openswan U2.4.7/K2.6.23.15-80.fc7
> (netkey) 
> 			
> 			
> 			Regards,
> 			 
> 			Arjun Datta
> 			
> 			Matthew Hall wrote: 
> 		
> 				Paul Wouters wrote: 
> 				
> 		
> 					On Thu, 15 May 2008, Matthew Hall wrote: 
> 					
> 					
> 		
> 							I know that one cannot ping the actual vpn server(s) themselves, so the 
> 							above would be normal. 
> 							But, it also appears the VPN servers themselves cannot see anything in 
> 							the opposite subnet.  Is there a way around this ? 
> 							
> 							I need to pull something from one machine in the 10.243.102.x subnet 
> 							onto the 10.249.100.20 machine. 
> 							
> 		
> 						This will be because when it's pinging the other side, the source 
> 						address is not in the local range provided by the vpn - ie. it's source 
> 						address will be whatever the IP is of the interface with your default 
> 						gateway, so it doesn't get routed over the vpn. 
> 						
> 						If you bind the ping to it's 'inside' interface it should work - ie. 
> 						ping 10.243.102.x -I 10.249.100.20. 
> 						
> 						You can workaround this by setting the 'defaultsource' for pluto; on 
> 						
> 		
> 		
> 					A better was is to specify leftsourceip= and rightsourceip= in the conn, 
> 					Setting it globally would limit you you to do this only on one conn. 
> 					
> 		
> 		
> 				I didn't know that existed - makes my life easier :) 
> 				
> 				Thanks Paul. 
> 				
> 				Matt 
> 				
> 				
> 		
> 		
> 		  
>
>
>   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20080522/1c3338cd/attachment-0001.html 


More information about the Users mailing list