[Openswan Users] Problems with NAT'd Windows clients
Paul Wouters
paul at xelerance.com
Thu Oct 15 12:47:53 EDT 2009
On Thu, 15 Oct 2009, Marc Fisher wrote:
> I've been trying to get NAT-T working for nat'd windows XP and Vista clients for several days now. It works fine without NAT, but when
> the client is nat'd it fails after the tunnel is established.
> I tried both PSK and X.509, several openswan versions (I've been told on irc that NAT-T is broken for 2.6.x version) , even strongswan,
> it's always the same result (after getting through all the other errors):
> After the tunnel is established the server initiates the l2tp conn instead of the client, while the client keeps sending UDP-encapsulated
> packets and ICMP port 1701 unreachable messages to the server. This goes on until both ends timeout.
Replace your openswan 2.4.x _updown script with the one from openswan 2.6.x.
I've attached a copy for you. This will be in /usr/local/lib/ipsec/_updown
Paul
-------------- next part --------------
#! /bin/sh
# iproute2 version, default updown script
#
# Copyright (C) 2003-2004 Nigel Metheringham
# Copyright (C) 2002-2007 Michael Richardson <mcr at xelerance.com>
# Copyright (C) 2007-2008 Paul Wouters <paul at xelerance.com>
# Copyright (C) 2003-2008 Tuomo Soini <tis at foobar.fi>
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
#
# CAUTION: Installing a new version of Openswan will install a new
# copy of this script, wiping out any custom changes you make. If
# you need changes, make a copy of this under another name, and customize
# that, and use the (left/right)updown parameters in ipsec.conf to make
# Openswan use yours instead of this default one.
LC_ALL=C
export LC_ALL
# Things that this script gets (from ipsec_pluto(8) man page)
#
#
# PLUTO_VERSION
# indicates what version of this interface is being
# used. This document describes version 1.1. This
# is upwardly compatible with version 1.0.
#
# PLUTO_VERB
# specifies the name of the operation to be performed
# (prepare-host, prepare-client, up-host, up-client,
# down-host, or down-client). If the address family
# for security gateway to security gateway
# communications is IPv6, then a suffix of -v6 is added
# to the verb.
#
# PLUTO_CONNECTION
# is the name of the connection for which we are
# routing.
#
# PLUTO_CONN_POLICY
# the policy of the connection, as in:
# RSASIG+ENCRYPT+TUNNEL+PFS+DONTREKEY+OPPORTUNISTIC
# +failureDROP+lKOD+rKOD
#
# PLUTO_NEXT_HOP
# is the next hop to which packets bound for the peer
# must be sent.
#
# PLUTO_INTERFACE
# is the name of the ipsec interface to be used.
#
# PLUTO_ME
# is the IP address of our host.
#
# PLUTO_MY_CLIENT
# is the IP address / count of our client subnet. If
# the client is just the host, this will be the
# host's own IP address / max (where max is 32 for
# IPv4 and 128 for IPv6).
#
# PLUTO_MY_CLIENT_NET
# is the IP address of our client net. If the client
# is just the host, this will be the host's own IP
# address.
#
# PLUTO_MY_CLIENT_MASK
# is the mask for our client net. If the client is
# just the host, this will be 255.255.255.255.
#
# PLUTO_MY_SOURCEIP
# if non-empty, then the source address for the route will be
# set to this IP address.
#
# PLUTO_MY_PROTOCOL
# is the protocol for this connection. Useful for
# firewalling.
#
# PLUTO_MY_PORT
# is the port. Useful for firewalling.
#
# PLUTO_PEER
# is the IP address of our peer.
#
# PLUTO_PEER_CLIENT
# is the IP address / count of the peer's client subnet.
# If the client is just the peer, this will be
# the peer's own IP address / max (where max is 32
# for IPv4 and 128 for IPv6).
#
# PLUTO_PEER_CLIENT_NET
# is the IP address of the peer's client net. If the
# client is just the peer, this will be the peer's
# own IP address.
#
# PLUTO_PEER_CLIENT_MASK
# is the mask for the peer's client net. If the
# client is just the peer, this will be
# 255.255.255.255.
#
# PLUTO_PEER_PROTOCOL
# is the protocol set for remote end with port
# selector.
#
# PLUTO_PEER_PORT
# is the peer's port. Useful for firewalling.
#
# PLUTO_CONNECTION_TYPE
#
# PLUTO_PROTO_STACK
# is the local IPsec kernel stack used, eg KLIPS, NETKEY,
# NOSTACK
if [ -f /etc/sysconfig/pluto_updown ]
then
. /etc/sysconfig/pluto_updown
fi
# Ignore parameter custom
if [ " $1" = " custom" ]; then
shift
fi
while [ $# -gt 0 ]; do
case $1 in
--route)
case $2 in
[Yy]*)
ROUTE=yes
;;
*)
ROUTE=
;;
esac
shift; shift
;;
--iproute)
IPRARGS="$2"
shift; shift
;;
*)
echo "$0: Unknown argument \"$1\"" >&2
exit 1
;;
esac
done
# utility functions for route manipulation
# Meddling with this stuff should not be necessary and requires great care.
uproute() {
doroute replace
ip route flush cache
}
downroute() {
doroute del
ip route flush cache
}
addsource() {
st=0
# check if given sourceip is local and add as alias if not
if ! ip -o route get ${PLUTO_MY_SOURCEIP%/*} | grep -q ^local; then
it="ip addr add ${PLUTO_MY_SOURCEIP%/*}/32 dev ${PLUTO_INTERFACE%:*}"
oops="`eval $it 2>&1`"
st=$?
if [ " $oops" = " " -a " $st" != " 0" ]; then
oops="silent error, exit status $st"
fi
case "$oops" in
'RTNETLINK answers: File exists'*)
# should not happen, but ... ignore if the
# address was already assigned on interface
oops=""
st=0
;;
esac
if [ " $oops" != " " -o " $st" != " 0" ]; then
echo "$0: addsource \`$it' failed ($oops)" >&2
fi
fi
return $st
}
doroute() {
if [ -z "$PLUTO_MY_SOURCEIP" ] && [ -n "$DEFAULTSOURCE" ]
then
PLUTO_MY_SOURCEIP="${DEFAULTSOURCE%/*}"
fi
st=0
# skip routing if it's not enabled or necessary
if [ " $PLUTO_MY_SOURCEIP" = " " -a " $ROUTE" != " yes" ]; then
return 0
fi
parms="$PLUTO_PEER_CLIENT"
parms2=$IPRARGS
# use nexthop if (right/left)nexthop is set and nexthop is not %direct
if [ -n "$PLUTO_NEXT_HOP" -a "$PLUTO_NEXT_HOP" != "$PLUTO_PEER" ]; then
parms2="via $PLUTO_NEXT_HOP"
fi
# old: route via pluto_interface
# parms2="$parms2 dev ${PLUTO_INTERFACE%:*} $IPROUTEARGS"
# new: route via proper interface according to routing table
PLUTO_PEER_INTERFACE=`ip -o route get $PLUTO_PEER | sed "s/^.*dev \([^ ]*\) .*/\1/"`
if [ -z "$PLUTO_PEER_INTERFACE" ]; then
PLUTO_PEER_INTERFACE=$PLUTO_INTERFACE
fi
parms2="$parms2 dev ${PLUTO_PEER_INTERFACE%:*} $IPROUTEARGS"
# make sure whe have sourceip locally in this machine
if [ "$1" = "replace" -a -n "$PLUTO_MY_SOURCEIP" ]; then
addsource
# use sourceip as route default source
parms2="$parms2 src ${PLUTO_MY_SOURCEIP%/*}"
fi
case "$PLUTO_PEER_CLIENT" in
"0.0.0.0/0")
# opportunistic encryption work around
# need to provide route that eclipses default, without
# replacing it.
it="ip route $1 0.0.0.0/1 $parms2 && ip route $1 128.0.0.0/1 $parms2"
;;
*)
it="ip route $1 $parms $parms2"
;;
esac
oops="`eval $it 2>&1`"
st=$?
if [ " $oops" = " " -a " $st" != " 0" ]; then
oops="silent error, exit status $st"
fi
if [ " $oops" != " " -o " $st" != " 0" ]; then
echo "$0: doroute \`$it' failed ($oops)" >&2
fi
return $st
}
# the big choice
case "$PLUTO_VERB" in
prepare-host|prepare-client)
# Delete possibly-existing route (preliminary to adding a route)
# Not used for NETKEY
;;
route-host|route-client)
# connection to me or my client subnet being routed
uproute
;;
unroute-host|unroute-client)
# connection to me or my client subnet being unrouted
downroute
;;
up-host)
# connection to me coming up
# If you are doing a custom version, firewall commands go here.
;;
down-host)
# connection to me going down
# If you are doing a custom version, firewall commands go here.
;;
up-client)
# connection to my client subnet coming up
# If you are doing a custom version, firewall commands go here.
;;
down-client)
# connection to my client subnet going down
# If you are doing a custom version, firewall commands go here.
;;
#
# IPv6
#
prepare-host-v6|prepare-client-v6)
# prepare client for connection
;;
route-host-v6|route-client-v6)
# connection to me or my client subnet being routed
;;
unroute-host-v6|unroute-client-v6)
# connection to me or my client subnet being unrouted
;;
up-host-v6)
# connection to me coming up
# If you are doing a custom version, firewall commands go here.
;;
down-host-v6)
# connection to me going down
# If you are doing a custom version, firewall commands go here.
;;
up-client-v6)
# connection to my client subnet coming up
# If you are doing a custom version, firewall commands go here.
;;
down-client-v6)
# connection to my client subnet going down
# If you are doing a custom version, firewall commands go here.
;;
*) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
exit 1
;;
esac
More information about the Users
mailing list