[Openswan Users] tunnel ok, ping cannot work

zheng.man zheng.man at feitian-tech.com
Mon Oct 10 04:26:18 EDT 2016


Hi,
 
I'm using openswan2.6.46 on a device with embedded linux kernel 3.10.20. 
The device has a 4G interface usb1 connecting to internet.
 
The network config:
10.67.8.0/24===10.29.19.62<%usb1>[@feitian]...THEIR_PUBLIC_IP<vpn.railfi.com>[@server]===192.168.17.0/24
 
 ~ # cat ipsec.conf 
version 2.0     # conforms to second version of ipsec.conf specification
# basic configuration
config setup
        dumpdir=/var/run/pluto/
        oe=off
        nat_traversal=yes
        protostack=klips
        interfaces="ipsec1=usb1"
conn ipsec
        auto=add        
        ikelifetime=24h
        salifetime=24h   
 
        authby=secret
        pfs=no
        rekey=yes
        keyingtries=3
        type=tunnel
 
        left=%usb1
        leftid=@feitian
        leftsubnets={10.67.8.0/24}
        leftsourceip=10.67.8.1
 
        right=vpn.railfi.com
        rightid=@server
        rightsubnet=192.168.17.0/24
 
        dpddelay=10
        dpdtimeout=60
        dpdaction=hold
 
 
 
The tunnel is created successfully.
 
~ # tail /var/log/secure -n50
Sep 29 15:39:32 (none) ipsec__plutorun: Starting Pluto subsystem...
Sep 29 15:39:32 (none) pluto[15819]: Starting Pluto (Openswan Version 2.6.46; Vendor ID OSWqwPd@^IAE) pid:15819
Sep 29 15:39:32 (none) pluto[15819]: LEAK_DETECTIVE support [enabled]
Sep 29 15:39:32 (none) pluto[15819]: OCF support for IKE [disabled]
Sep 29 15:39:32 (none) pluto[15819]: SAref support [disabled]: Protocol not available
Sep 29 15:39:32 (none) pluto[15819]: SAbind support [disabled]: Protocol not available
Sep 29 15:39:32 (none) pluto[15819]: NSS support [disabled]
Sep 29 15:39:32 (none) pluto[15819]: HAVE_STATSD notification support not compiled in
Sep 29 15:39:32 (none) pluto[15819]: Setting NAT-Traversal port-4500 floating to on
Sep 29 15:39:32 (none) pluto[15819]:    port floating activation criteria nat_t=1/port_float=1
Sep 29 15:39:32 (none) pluto[15819]:    NAT-Traversal support  [enabled]
Sep 29 15:39:32 (none) pluto[15819]: using /dev/urandom as source of random entropy
Sep 29 15:39:32 (none) pluto[15819]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Sep 29 15:39:32 (none) pluto[15819]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)
Sep 29 15:39:32 (none) pluto[15819]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)
Sep 29 15:39:32 (none) pluto[15819]: starting up 1 cryptographic helpers
Sep 29 15:39:32 (none) pluto[15819]: started helper pid=15825 (fd:6)
Sep 29 15:39:32 (none) pluto[15819]: Using KLIPS IPsec interface code on 3.10.20-rt14-Cavium-Octeon+
Sep 29 15:39:32 (none) pluto[15825]: using /dev/urandom as source of random entropy
Sep 29 15:39:32 (none) pluto[15819]: adding connection: "ipsec/1x0"
Sep 29 15:39:32 (none) pluto[15819]: listening for IKE messages
Sep 29 15:39:32 (none) pluto[15819]: adding interface ipsec1/usb1 10.29.19.62:500
Sep 29 15:39:32 (none) pluto[15819]: adding interface ipsec1/usb1 10.29.19.62:4500
Sep 29 15:39:32 (none) pluto[15819]: loading secrets from "/etc/ipsec.secrets"
Sep 29 15:39:33 (none) pluto[15819]: initiating all conns with alias='ipsec' 
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: initiating Main Mode
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: received Vendor ID payload [Dead Peer Detection]
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: received Vendor ID payload [RFC 3947] method set to=115 
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): both are NATed
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: Main mode peer ID is ID_FQDN: '@server'
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp1024}
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #1: Dead Peer Detection (RFC 3706): enabled
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:19bbd8b7 proposal=defaults pfsgroup=no-pfs}
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #2: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME msgid=19bbd8b7
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #2: up-client output: /usr/local/lib/ipsec/_updown.klips: changesource `ip route change 192.168.17.0/24 dev ipsec1 src 10.67.8.1' failed (RTNETLINK answers: No such file or directory)
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #2: Dead Peer Detection (RFC 3706): enabled
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
Sep 29 15:39:33 (none) pluto[15819]: "ipsec/1x0" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x32269a98 <0x26f68275 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=THEIR_PUBLIC_IP:4500 DPD=enabled}
 
 
~ # ipsec auto status
ipsec auto: warning: obsolete command syntax used
000 using kernel interface: klips
000 interface ipsec1/usb1 10.29.19.62
000 interface ipsec1/usb1 10.29.19.62
000 %myid = (none)
000 debug none
000  
000 virtual_private (%priv):
000 - allowed 0 subnets: 
000 - disallowed 0 subnets: 
000 WARNING: Either virtual_private= is not specified, or there is a syntax 
000          error in that line. 'left/rightsubnet=vhost:%priv' will not work!
000 WARNING: Disallowed subnets in virtual_private= is empty. If you have 
000          private address space in internal use, it should be excluded!
000  
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=64, keysizemin=96, keysizemax=448
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128, keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128
000  
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32
000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
000  
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} 
000  
000 "ipsec/1x0": 10.67.8.0/24===10.29.19.62<%usb1>[@feitian]...THEIR_PUBLIC_IP <vpn.railfi.com>[@server]===192.168.17.0/24; unrouted; eroute owner: #2
000 "ipsec/1x0":     myip=10.67.8.1; hisip=unset;
000 "ipsec/1x0":   ike_life: 86400s; ipsec_life: 86400s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3 
000 "ipsec/1x0":   policy: PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,24; interface: usb1; kind=CK_PERMANENT
000 "ipsec/1x0":   dpd: action:hold; delay:10; timeout:60;  
000 "ipsec/1x0":   newest ISAKMP SA: #1; newest IPsec SA: #2; eroute owner: #2;
000 "ipsec/1x0":   aliases: ipsec 
000 "ipsec/1x0":   IKE algorithm newest: AES_CBC_128-SHA1-MODP1024
000  
000 #2: "ipsec/1x0":4500 IKEv1.0 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 81957s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate
000 #2: "ipsec/1x0" esp.32269a98 at THEIR_PUBLIC_IP esp.26f68275 at 10.29.19.62 tun.1001 at THEIR_PUBLIC_IP tun.1002 at 10.29.19.62 ref=3 refhim=1
000 #1: "ipsec/1x0":4500 IKEv1.0 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 81793s; newest ISAKMP; lastdpd=4s(seq in:2632 out:0); idle; import:admin initiate
000  
 
 
 
But ping private address of vpn server failed. 
 
/etc # ping 192.168.17.4
PING 192.168.17.4 (192.168.17.4) 56(84) bytes of data.
^C
--- 192.168.17.4 ping statistics ---
8 packets transmitted, 0 received, 100% packet loss, time 7011ms
 
~ # tcpdump -i ipsec1 -n icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ipsec1, link-type EN10MB (Ethernet), capture size 65535 bytes
16:36:12.780793 IP 10.67.8.1 > 192.168.17.4: ICMP echo request, id 14248, seq 1, length 64
16:36:13.781654 IP 10.67.8.1 > 192.168.17.4: ICMP echo request, id 14248, seq 2, length 64
16:36:14.787813 IP 10.67.8.1 > 192.168.17.4: ICMP echo request, id 14248, seq 3, length 64
 
 
As output below, ICMP echo reply seem to come back, but couldn’t be decrypted successfully.
 
~ # tcpdump -i usb1 -n port 4500
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on usb1, link-type EN10MB (Ethernet), capture size 65535 bytes
16:36:35.430282 IP 10.29.19.62.4500 > THEIR_PUBLIC_IP.4500: UDP-encap: ESP(spi=0x32269a98,seq=0x118), length 132
16:36:35.509216 IP THEIR_PUBLIC_IP.4500 > 10.29.19.62.4500: UDP-encap: ESP(spi=0x26f68275,seq=0x21c), length 132
16:36:36.437868 IP 10.29.19.62.4500 > THEIR_PUBLIC_IP.4500: UDP-encap: ESP(spi=0x32269a98,seq=0x119), length 132
16:36:36.518809 IP THEIR_PUBLIC_IP.4500 > 10.29.19.62.4500: UDP-encap: ESP(spi=0x26f68275,seq=0x21d), length 132
16:36:38.437798 IP 10.29.19.62.4500 > THEIR_PUBLIC_IP.4500: UDP-encap: ESP(spi=0x32269a98,seq=0x11b), length 132
16:36:38.479313 IP THEIR_PUBLIC_IP.4500 > 10.29.19.62.4500: UDP-encap: ESP(spi=0x26f68275,seq=0x21f), length 132
 
 

Could anyone give some ideas?
 
Best regards
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openswan.org/pipermail/users/attachments/20161010/b0b9aa75/attachment-0001.html>


More information about the Users mailing list