[Openswan Users] Huge_IPSec_problem
Steven Schlegel
steven.schlegel1988 at googlemail.com
Fri Oct 9 14:41:55 EDT 2009
Hey guys,
first of all my english is not the best ;)
Well i've got a huge IPSec-Problem....
I've tried to set up the following scenario:
client1: 192.168.240.50 ----> vpn-router1: 82.144.x.130
-->|-------TUNNEL-------|<-- vpn-router2: 82.113.x.27 ----> client2:
82.113.x.65
My vpn-router1 has 3 network-cards:
eth0 with 10.254.0.1
eth1 with 10.254.0.2
eth2 with 82.144.x.130
Note: I don't have any access on vpn-router2, because it is a router from a
different network.
The Tunnel between vpn-router1 and vpn-router2 is setup correctly, because
i'll get an "ISAKMP SA established" - Message.
So i tried to ping from my vpn-router1 to vpn-router2 and it works, BUT as i
did a traceroute to vpn-router2, i noticed
that all the traffic goes through the internet and not through the
ipsec-tunnel. I believe this is an routing issue, but i can't figure what
is going wrong.
So any help will preciated ;)
Here are my configs:
/etc/ipsec.d/vpn-conf:
conn o2
authby=secret
left=82.144.x.130
leftsubnet=192.168.240.50/32
#
right=82.113.x.27
rightsubnet=82.113.x.65/32
rightnexthop=
#
ike=3des-sha1
esp=3des-sha1
pfsgroup=modp1024
#
auto=add
Output from "route -n":
Kernel-IP-Routentabelle
Ziel Router Genmask Flags Metric Ref Use
Iface
82.113.x.65 0.0.0.0 255.255.255.255 UH 0 0 0 eth2
192.168.240.1 10.254.0.6 255.255.255.255 UGH 0 0 0 eth0
192.168.240.2 0.0.0.0 255.255.255.255 UH 0 0 0 eth2
192.168.200.44 10.254.0.4 255.255.255.255 UGH 0 0 0 eth0
192.168.240.45 10.254.0.6 255.255.255.255 UGH 0 0 0 eth0
192.168.225.1 10.254.0.4 255.255.255.255 UGH 0 0 0 eth0
192.168.200.1 10.254.0.4 255.255.255.255 UGH 0 0 0 eth0
10.254.0.11 10.254.0.2 255.255.255.255 UGH 0 0 0 eth0
212.6.x.0 0.0.0.0 255.255.255.240 U 0 0 0 eth2
82.144.x.128 0.0.0.0 255.255.255.240 U 0 0 0 eth2
192.168.240.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
192.168.7.0 10.254.0.11 255.255.255.0 UG 0 0 0 eth0
192.168.100.0 10.254.0.11 255.255.255.0 UG 0 0 0 eth0
192.168.6.0 10.254.0.11 255.255.255.0 UG 0 0 0 eth0
192.168.225.0 10.254.0.4 255.255.255.0 UG 0 0 0 eth0
192.168.5.0 10.254.0.11 255.255.255.0 UG 0 0 0 eth0
192.168.4.0 10.254.0.11 255.255.255.0 UG 0 0 0 eth0
192.168.210.0 10.254.0.6 255.255.255.0 UG 0 0 0 eth0
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
192.168.245.0 10.254.0.6 255.255.255.0 UG 0 0 0 eth0
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0
dummy0
192.168.230.0 10.254.0.8 255.255.255.0 UG 30 0 0 eth0
192.168.0.0 10.254.0.5 255.255.255.0 UG 0 0 0 eth0
192.168.200.0 10.254.0.4 255.255.255.0 UG 0 0 0 eth0
10.254.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.254.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.120.0 10.254.0.8 255.255.255.0 UG 20 0 0 eth0
10.254.4.0 10.254.0.7 255.255.255.0 UG 20 0 0 eth0
10.10.0.0 10.254.0.8 255.255.248.0 UG 0 0 0 eth0
0.0.0.0 82.144.x.129 0.0.0.0 UG 100 0 0 eth2
The Output from ipsec auto --up vpn-conf:
root at vpn-router1:~# ipsec auto --up vpn-conf
104 "o2" #1: STATE_MAIN_I1: initiate
003 "o2" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
method set to=108
106 "o2" #1: STATE_MAIN_I2: sent MI2, expecting MR2
003 "o2" #1: received Vendor ID payload [Cisco-Unity]
003 "o2" #1: received Vendor ID payload [Dead Peer Detection]
003 "o2" #1: ignoring unknown Vendor ID payload
[aa9f2d2a2ca9c8697632c1290dfa7179]
003 "o2" #1: received Vendor ID payload [XAUTH]
003 "o2" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03:
no NAT detected
108 "o2" #1: STATE_MAIN_I3: sent MI3, expecting MR3
004 "o2" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY
cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}
117 "o2" #2: STATE_QUICK_I1: initiate
003 "o2" #2: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
004 "o2" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x490d945d
<0x35ccf61f xfrm=3DES_0-HMAC_SHA1 NATD=none DPD=none}
Output from "iptables-save":
root at vpn-router1:~# iptables-save
# Generated by iptables-save v1.4.1.1 on Fri Oct 9 20:34:10 2009
*nat
:PREROUTING ACCEPT [12356738:1126281944]
:POSTROUTING ACCEPT [199775:13301675]
:OUTPUT ACCEPT [39239:3256355]
:or10er - [0:0]
-A PREROUTING -p tcp -m tcp --dport 22022 -j DNAT --to-destination
192.168.240.130:22
-A PREROUTING -p tcp -m tcp --dport 22023 -j DNAT --to-destination
192.168.240.131:22
-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 8081 -j DNAT
--to-destination 192.168.210.210:8081
-A PREROUTING -d 192.168.2.4/32 -j DNAT --to-destination 192.168.0.4
-A PREROUTING -d 192.168.2.3/32 -j DNAT --to-destination 192.168.0.3
-A PREROUTING -d 192.168.2.5/32 -j DNAT --to-destination 192.168.0.5
-A PREROUTING -d 192.168.2.10/32 -j DNAT --to-destination 192.168.0.10
-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 17971 -j DNAT
--to-destination 192.168.240.94:80
-A PREROUTING -d 192.168.2.150/32 -j DNAT --to-destination 192.168.245.150
-A PREROUTING -d 192.168.2.151/32 -j DNAT --to-destination 192.168.245.151
-A PREROUTING -d 192.168.2.235/32 -j DNAT --to-destination 192.168.240.235
-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 21 -j DNAT
--to-destination 192.168.240.50:21
-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 20 -j DNAT
--to-destination 192.168.240.50:20
-A PREROUTING -i eth2 -p tcp -m tcp --dport 2000:30000 -j DNAT
--to-destination 192.168.0.10
-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 80 -j DNAT
--to-destination 192.168.0.10:80
-A PREROUTING -d 82.144.x.130/32 -p tcp -m tcp --dport 4434 -j DNAT
--to-destination 192.168.0.10:4434
-A POSTROUTING -s 212.6.x.0/28 -d 192.168.245.0/24 -j MASQUERADE
-A POSTROUTING -s 192.168.3.0/24 -d 192.168.0.0/24 -j MASQUERADE
-A POSTROUTING -o eth2 -j MASQUERADE
-A POSTROUTING -d 192.168.240.94/32 -j MASQUERADE
-A POSTROUTING -d 192.168.0.10/32 -o eth0 -j MASQUERADE
-A POSTROUTING -d 192.168.0.10/32 -o eth1 -j MASQUERADE
COMMIT
# Completed on Fri Oct 9 20:34:10 2009
# Generated by iptables-save v1.4.1.1 on Fri Oct 9 20:34:10 2009
*mangle
:PREROUTING ACCEPT [1579535223:989589268388]
:INPUT ACCEPT [13365691:2167215608]
:FORWARD ACCEPT [1565049027:987281194415]
:OUTPUT ACCEPT [2091035:339136033]
:POSTROUTING ACCEPT [1566938084:987591423846]
COMMIT
# Completed on Fri Oct 9 20:34:10 2009
# Generated by iptables-save v1.4.1.1 on Fri Oct 9 20:34:10 2009
*filter
:INPUT ACCEPT [13329201:2164008631]
:FORWARD ACCEPT [1564853173:987158653555]
:OUTPUT ACCEPT [1888870:310192555]
COMMIT
# Completed on Fri Oct 9 20:34:10 2009
I hope you can help me with this problem...
Greetz to you
Steven
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20091009/2a9b3408/attachment.html
More information about the Users
mailing list