[Openswan Users] iOS devices not always be dedected and NATted
Neville
nev at itsnev.co.uk
Tue Nov 13 18:46:05 EST 2012
Anyone as this is driving me nuts.
Thx
Neville
-----Original Message-----
From: Neville [mailto:nev at itsnev.co.uk]
Sent: 10 November 2012 1:17 PM
To: 'users at lists.openswan.org'
Subject: RE: iOS devices not always be dedected and NATted. (Neville)
Any ideas anyone or is this a result of the recent iOS upgrade 6.0, 6.1
(Also corrected some of my bad English below)
Thx
Nev
Hi,
All of a sudden, from today without any changes being made to the server,
all iPhones and iPads have started to fail to connect via IPSEC.
The issue seems to be happening with devices which are NATed only, as we've
started to see the following messages in the logs...
"L2TP-PSK-NAT"[40] 46.A.B.C #58: responding to Main Mode from unknown peer
46.A.B.C Nov 8 21:39:26 vpn3 pluto[15290]: "L2TP-PSK-NAT"[40] 46.A.B.C #58:
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1 Nov 8 21:39:26
vpn3 pluto[15290]: "L2TP-PSK-NAT"[40] 46.A.B.C #58:
STATE_MAIN_R1: sent MR1, expecting MI2
Nov 8 21:39:27 vpn3 pluto[15290]: "L2TP-PSK-NAT"[40] 46.A.B.C #58:
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): no NAT
detected Nov 8 21:39:27 vpn3 pluto[15290]: "L2TP-PSK-NAT"[40] 46.A.B.C #58:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 Nov 8 21:39:27
vpn3 pluto[15290]: "L2TP-PSK-NAT"[40] 46.A.B.C #58: new NAT mapping for #58,
was 46.A.B.C:500, now 192.168.1.101:500 Nov 8 21:39:27 vpn3 pluto[15290]:
"L2TP-PSK-NAT"[40] 192.168.1.101 #58:
STATE_MAIN_R2: sent MR2, expecting MI3
Nov 8 21:39:30 vpn3 pluto[15290]: "L2TP-PSK-NAT"[40] 192.168.1.101 #58:
discarding duplicate packet; already STATE_MAIN_R2 Nov 8 21:39:48 vpn3 last
message repeated 3 times Nov 8 21:40:37 vpn3 pluto[15290]:
"L2TP-PSK-NAT"[40] 192.168.1.101 #58: max number of retransmissions (2)
reached STATE_MAIN_R2
46.A.B.C is the customers Gateway Address and 192.168.1.101 is there NATed
IP address and 91.A.B.C is the servers IP Address
/etc/ipsec.conf
config setup
protostack=netkey
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
oe=off
nhelpers=0
include /etc/ipsec.d/*.conf
/etc/ipsec.d/l2tp-psk-nat.conf
conn L2TP-PSK-NAT
rightsubnet=vhost:%no,%priv
also=L2TP-PSK-noNAT-vpn2
conn L2TP-PSK-noNAT-vpn2
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
dpdaction=clear
dpdtimeout=120
dpddelay=3
type=transport
left=%defaultroute
leftnexthop=91.A.B.C (servers IP Address)
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
conn passthrough-for-non-l2tp
type=passthrough
left=%defaultroute
leftnexthop=91.A.B.C (servers IP Address)
right=0.0.0.0
rightsubnet=0.0.0.0/0
auto=route
/etc/xl2tpd/xl2tpd.conf
[global]
; listen-addr = 192.168.1.98
;
; requires openswan-2.5.18 or higher - Also does not yet work in combination
; with kernel mode l2tp as present in linux 2.6.23+ ; ipsec saref = yes ;
forceuserspace = yes ; ; debug tunnel = yes
[lns default]
ip range = 10.200.11.2-10.200.11.254
local ip = 10.200.10.1
assign ip = yes
require chap = yes
refuse pap = yes
require authentication = no
name = OpenVPN-VPN3
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
/etc/ppp/options.xl2tpd
ipcp-accept-local
ipcp-accept-remote
ms-dns 8.8.8.8
ms-dns 8.8.4.4
10.200.10.1:
noccp
auth
crtscts
idle 600
mtu 1410
mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000
idle 600
plugin radius.so
plugin radattr.so
/etc/pptpd.conf
ppp /usr/sbin/pppd
option /etc/ppp/options.pptpd
delegate
localip 10.200.10.1
Here is the output for ipsec verify. Please note that although this is on
2.6.33 off openswan, I'm getting exactly the same on 2.6.38 will the same
configuration on a different server.
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.33/K2.6.18-164.15.1.el5 (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing XFRM related proc values [OK]
[OK]
[OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
/etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel # Manual
customization of this file is not recommended.
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
:OUTPUT ACCEPT [0:0]
# -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT -A
RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A
RH-Firewall-1-INPUT -i lo -j ACCEPT -A RH-Firewall-1-INPUT -p icmp
--icmp-type any -j ACCEPT -A RH-Firewall-1-INPUT -p 50 -j ACCEPT -A
RH-Firewall-1-INPUT -p 51 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -d
224.0.0.251 --dport 5353 -j ACCEPT -A RH-Firewall-1-INPUT -p tcp -m tcp
--dport 10000 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j
ACCEPT -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT -A
RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 3389 --state NEW -j
ACCEPT # PPP Port -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 1723 -j
ACCEPT -A RH-Firewall-1-INPUT -p gre -j ACCEPT # ipsec -A
RH-Firewall-1-INPUT -p tcp -m tcp --dport 4500 -j ACCEPT -A
RH-Firewall-1-INPUT -p udp -m udp --dport 4500 -j ACCEPT -A
RH-Firewall-1-INPUT -p udp -m udp --dport 500 -j ACCEPT # ntop -A
RH-Firewall-1-INPUT -p tcp -m tcp --dport 3000 -j ACCEPT # Accept response
to DNS queries -A RH-Firewall-1-INPUT -p udp -m udp --dport 1024:65535
--sport 53 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m udp --dport 1701 -j
ACCEPT -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 1701 -j ACCEPT # Radius
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 1812:1814 -j ACCEPT -A
RH-Firewall-1-INPUT -s 193.33.186.190 -j ACCEPT # mySQL -A
RH-Firewall-1-INPUT -p tcp -m tcp --dport 3306 -j ACCEPT -A
RH-Firewall-1-INPUT -p udp -m udp --dport 3799 -j ACCEPT -A
RH-Firewall-1-INPUT -p udp -m udp --dport 1700 -j ACCEPT -A
RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited # Munin
Host -A INPUT -j RH-Firewall-1-INPUT COMMIT # Generated by webmin *mangle
:FORWARD ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :PREROUTING
ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] COMMIT # Completed # Generated by
webmin *nat :OUTPUT ACCEPT [0:0] :PREROUTING ACCEPT [0:0] :POSTROUTING
ACCEPT [0:0] # PPP NAT Translation -A POSTROUTING -s 10.200.10.0/24 -o eth0
-j SNAT --to-source 91.A.B.C COMMIT # Completed
Any ideas would me greatly received.
Thx
Nev
------------------------------
_______________________________________________
Users mailing list
Users at lists.openswan.org
https://lists.openswan.org/mailman/listinfo/users
End of Users Digest, Vol 103, Issue 6
*************************************
More information about the Users
mailing list