[Openswan Users] Right - Not working

[Dominic Wiersma]

Hi All,

 

I have openswan running and all is working well.

Due to a design change, I want only specific hosts to be able to connect.

So in my ipsec.conf I have changed right=%any to right=1.2.3.4, which is the
public ip of the remote client that must connect.

But then nothing happens, no errors in the logs, no nothing. On the client
the connection simply times out. I am  troubleshooting this problem for
hours now.

What can cause this behavior?

 

config setup

        dumpdir=/var/run/pluto/

        #in what directory should things started by setup (notably the Pluto
daemon) be allowed to dump core?

        nat_traversal=yes

        #whether to accept/offer to support NAT (NAPT, also known as "IP
Masqurade")workaround for IPsec

        virtual_private=%v4:10.254.168.0/24

        #contains the networks that are allowed as subnet= for the remote
client. In other words, the address ranges that may live behind a NAT router
through which a client connects.

        protostack=netkey

        #decide which protocol stack is going to be used.

        force_keepalive=yes

        keep_alive=60

        # Send a keep-alive packet every 60 seconds.

 

conn L2TP-PSK-noNAT

        authby=secret

        #shared secret. Use rsasig for certificates.

        pfs=no

        #Disable pfs

        auto=add

        #the ipsec tunnel should be started and routes created when the
ipsec daemon itself starts.

        keyingtries=3

        #Only negotiate a conn. 3 times.

        ikelifetime=8h

        keylife=1h

        ike=aes256-sha1,aes128-sha1,3des-sha1

        phase2alg=aes256-sha1,aes128-sha1,3des-sha1

        # https://lists.openswan.org/pipermail/users/2014-April/022947.html

        # specifies the phase 1 encryption scheme, the hashing algorithm,
and the diffie-hellman group. The modp1024 is for Diffie-Hellman 2. Why
'modp' instead of dh? DH2is a 1028 bit encryption $

        type=tunnel

        #because we use l2tp as tunnel protocol

        left=x.x.x.x

        leftsubnet=10.10.10.0/24

        #fill in server IP above

        leftprotoport=17/%any

        right=1.2.3.4

        rightprotoport=17/%any

        #dpddelay=10

        # Dead Peer Dectection (RFC 3706) keepalives delay

        #dpdtimeout=20

        # length of time (in seconds) we will idle without hearing either an
R_U_THERE poll from our peer, or an R_U_THERE_ACK reply.

        #dpdaction=clear

        # When a DPD enabled peer is declared dead, what action should be
taken. clear means the eroute and SA with both be cleared.

        #aggrmode=yes

        ikev2=propose

 

Best regards,

 

Dominic Wiersma

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openswan.org/pipermail/users/attachments/20141128/4e0cad2b/attachment.html>