[Openswan Users] VPN tunnel up but traffic will not pass

[Ryan Slick]

Ok update. Seems I can ping in both directions only if I iniate a ping from the openswan LAN side first. So ipsec sa is showing as up on both ends. Contious ping running from juniper LAN side is running and failing as soon as a single ping from openswan side is run the contipus ping starts to work. Any ideas on how to fix it so either side can ping first??



------------------------------
On Sat, Oct 11, 2014 3:34 PM NZDT Ryan Slick wrote:

>Hi guys, I have phase 1 and 2 up on both sides. logs look good. But I cannot ping from either end.
>One side is openswan, the other is Juniper firewall.
>
>Traceroute from the juniper to the internal address shows the first hop failing, traceroute from openswan shows the traffic going out into the realms of the internet. It would appear openswan is not routing the traffic correctly. Juniper has permit any any rules on all interfaces.  
>
>
>Any help would be appreciated!
>
>
>
>conn netconn7
>        authby="secret"
>        left=%defaultroute
>        leftsubnet=192.168.10.0/24
>        leftid=@routerA
>        right=111.69.xx.xx
>        rightsubnet=192.168.1.0/24
>        rightid=@srx
>        pfs=off
>        salifetime=28800s
>        ikelifetime=3600s
>        auth=esp
>        ike=aes128-sha1;modp768
>        phase2alg=aes128-sha1;modp768
>        dpdaction=restart
>        dpddelay=10
>        dpdtimeout=60
>        aggrmode=yes
>        auto=add
>
>iptables:
>
>oot:/etc# iptables -L -v -n
>hain INPUT (policy ACCEPT 204 packets, 9136 bytes)
>pkts bytes target     prot opt in     out     source               destination
>
>   5   145 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
>
> 266 16806 macipport_filter_inbound  all  --  *      *       0.0.0.0/0
>  0.0.0.0/0
> 266 16806 macipport_filter  all  --  *      *       0.0.0.0/0            0.0.0
>0/0
> 266 16806 filter     all  --  *      *       0.0.0.0/0            0.0.0.0/0
>
>
>hain FORWARD (policy ACCEPT 0 packets, 0 bytes)
>pkts bytes target     prot opt in     out     source               destination
>
>   0     0 macipport_filter_forward  all  --  *      *       0.0.0.0/0
>  0.0.0.0/0
>   0     0 ipport_filter_forward  all  --  *      *       0.0.0.0/0
>.0.0.0/0
>   0     0 macipport_filter  all  --  *      *       0.0.0.0/0            0.0.0
>0/0
>   0     0 filter_forward  all  --  *      *       0.0.0.0/0            0.0.0.0
>0
>
>hain OUTPUT (policy ACCEPT 195 packets, 30949 bytes)
>pkts bytes target     prot opt in     out     source               destination
>
> 197 31007 macipport_filter_outbound  all  --  *      *       0.0.0.0/0
>   0.0.0.0/0
>
>hain filter (1 references)
>pkts bytes target     prot opt in     out     source               destination
>
>   0     0 ACCEPT     icmp --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>       icmp type 8
>   0     0 ACCEPT     tcp  --  wwan0  *       0.0.0.0/0            192.168.10.1
>       tcp dpt:80
>   0     0 DROP       tcp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>       tcp dpt:80
>   0     0 ACCEPT     tcp  --  wwan0  *       0.0.0.0/0            192.168.10.1
>       tcp dpt:443
>   0     0 DROP       tcp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>       tcp dpt:443
>   0     0 ACCEPT     tcp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>       tcp dpt:23
>   0     0 ACCEPT     tcp  --  wwan0  *       0.0.0.0/0            192.168.10.1
>       tcp dpt:22
>   0     0 DROP       tcp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>       tcp dpt:22
>   7  1171 ACCEPT     udp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>       udp dpt:500
>   0     0 ACCEPT     udp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>       udp dpt:4500
>   0     0 ACCEPT     esp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>
>   0     0 ACCEPT     ah   --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>
>   0     0 ACCEPT     all  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>       state RELATED,ESTABLISHED
>   0     0 DROP       all  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>
>
>hain filter_forward (1 references)
>pkts bytes target     prot opt in     out     source               destination
>
>   0     0 ACCEPT     all  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>       mark match 0x1
>   0     0 ACCEPT     all  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>       state RELATED,ESTABLISHED
>   0     0 DROP       all  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
>
>
>hain ipport_filter_forward (1 references)
>pkts bytes target     prot opt in     out     source               destination
>
>
>
>root:/etc# netstat -rn
>Kernel IP routing table
>Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
>0.0.0.0         49.226.157.41   0.0.0.0         UG        0 0          0 wwan0
>49.226.157.40   0.0.0.0         255.255.255.252 U         0 0          0 wwan0
>192.168.10.0    0.0.0.0         255.255.255.0   U         0 0          0 br0