[Openswan Users] openswan on dedibox

Thu Nov 13 03:16:57 EST 2008

88.191.50.209 is the public address of the openswan server and 82.229.55.165 is the public address
of the remote Windows client.

I've just added : 
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:192.168.2.0/24,%v4:88.191.50.0/24

and I've tried with this configuration. It doesn't work :

Nov 13 09:15:43 transchaines pluto[28036]: packet from 82.229.55.165:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Nov 13 09:15:43 transchaines pluto[28036]: packet from 82.229.55.165:500: ignoring Vendor ID payload [FRAGMENTATION]
Nov 13 09:15:43 transchaines pluto[28036]: packet from 82.229.55.165:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
Nov 13 09:15:43 transchaines pluto[28036]: packet from 82.229.55.165:500: ignoring Vendor ID payload [Vid-Initial-Contact]
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[3] 82.229.55.165 #3: responding to Main Mode from unknown peer 82.229.55.165
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[3] 82.229.55.165 #3: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[3] 82.229.55.165 #3: STATE_MAIN_R1: sent MR1, expecting MI2
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[3] 82.229.55.165 #3: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[3] 82.229.55.165 #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[3] 82.229.55.165 #3: STATE_MAIN_R2: sent MR2, expecting MI3
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[3] 82.229.55.165 #3: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, ST=France, L=Var, O=Olympe CTI, OU=Ingenierie, CN=vpn.olympecti.fr, E=test at aol.com'
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[3] 82.229.55.165 #3: switched from "roadwarrior-xp" to "roadwarrior-xp"
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: deleting connection "roadwarrior-xp" instance with peer 82.229.55.165 {isakmp=#0/ipsec=#0}
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: I am sending my cert
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: new NAT mapping for #3, was 82.229.55.165:500, now 82.229.55.165:4500
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: peer client type is FQDN
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: Applying workaround for MS-818043 NAT-T bug
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: IDci was FQDN: X\2772\321, using NAT_OA=192.168.7.200/32 as IDci
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: the peer proposed: 88.191.50.209/32:17/1701 -> 192.168.7.200/32:17/1701
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #4: responding to Quick Mode proposal {msgid:870767ef}
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #4:     us: 88.191.50.209<88.191.50.209>[+S=C]:17/1701
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #4:   them: 82.229.55.165[C=FR, ST=France, L=Var, O=Olympe CTI, OU=Ingenierie, CN=vpn.olympecti.fr, E=test at aol.com,+S=C]:17/1701===192.168.7.200/32
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #4: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #4: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #4: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
Nov 13 09:15:43 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #4: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x8c8601a3 <0xb1649fe9 xfrm=3DES_0-HMAC_MD5 NATOA=192.168.7.200 NATD=82.229.55.165:4500 DPD=none}
Nov 13 09:16:15 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: received Delete SA(0x8c8601a3) payload: deleting IPSEC State #4
Nov 13 09:16:15 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: request to replace with shunt a prospective erouted policy with netkey kernel --- experimental
Nov 13 09:16:15 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: received and ignored informational message
Nov 13 09:16:15 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165 #3: received Delete SA payload: deleting ISAKMP State #3
Nov 13 09:16:15 transchaines pluto[28036]: "roadwarrior-xp"[4] 82.229.55.165: deleting connection "roadwarrior-xp" instance with peer 82.229.55.165 {isakmp=#0/ipsec=#0}
Nov 13 09:16:15 transchaines pluto[28036]: "roadwarrior-xp": request to delete a unrouted policy with netkey kernel --- experimental
Nov 13 09:16:15 transchaines pluto[28036]: packet from 82.229.55.165:4500: received and ignored informational message

I don't know where is the problem.

Paul Wouters a écrit :
> On Wed, 12 Nov 2008, Reza Issany wrote:
>
>   
>> I've done these modificcations (v in %v4 and rightsubnet). Here are the logs :
>>     
>
>   
>> Nov 12 22:07:43 transchaines pluto[6298]: "roadwarrior-xp"[4] 82.229.55.165
>> #2: peer proposal was reject in a virtual connection policy because:
>> Nov 12 22:07:43 transchaines pluto[6298]: "roadwarrior-xp"[4] 82.229.55.165
>> #2:   a private network virtual IP was required, but the proposed IP did not
>> match our list (virtual_private=)
>> Nov 12 22:07:43 transchaines pluto[6298]: "roadwarrior-xp"[4] 82.229.55.165
>> #2: peer proposal was reject in a virtual connection policy because:
>> Nov 12 22:07:43 transchaines pluto[6298]: "roadwarrior-xp"[4] 82.229.55.165
>> #2:   a private network virtual IP was required, but the proposed IP did not
>> match our list (virtual_private=)
>> Nov 12 22:07:43 transchaines pluto[6298]: "roadwarrior-xp"[4] 82.229.55.165
>> #2: cannot respond to IPsec SA request because no connection is known for
>> 88.191.50.209<88.191.50.209>[+S=C]:17/1701...82.229.55.165[C=FR, ST=France,
>> L=Var, O=Olympe CTI, OU=Ingenierie, CN=vpn.olympecti.fr,
>> E=test at aol.com,+S=C]:17/1701===192.168.7.200/32
>>     
>
> 88.191.50.209 is NAT'ed to 82.229.55.165? But 88.191.50.0/24 is not listed
> in virtual_private= as a valid address to allow for NAT-T.
>
> Paul
>
>   