Hi Andreas, <br><br>Thanks for the quick reply!<br><br>I don't block anything at all outbound on either machine, plus the OUTPUT chain on both is set to ACCEPT<br><br>I'm not 100% sure I've answered your question - shout back if you need any more info<br>
<br>Cheers<br><br>Russ<br><br><br><br>iptables -nvL<br>...<br>...<br>Chain OUTPUT (policy ACCEPT 2137K packets, 16G bytes)<br>pkts bytes target prot opt in out source destination <br>...<br>
-------------------------<br>rodney:~# iptables -nvL |grep 192.168.6<br> 0 0 ACCEPT all -- eth2:8 * <a href="http://192.168.6.0/24">192.168.6.0/24</a> <a href="http://192.168.0.0/24">192.168.0.0/24</a> policy match dir in pol ipsec reqid 16601 proto 50 <br>
0 0 ACCEPT all -- * eth2:8 <a href="http://192.168.0.0/24">192.168.0.0/24</a> <a href="http://192.168.6.0/24">192.168.6.0/24</a> policy match dir out pol ipsec reqid 16601 proto 50 <br>--------------------------<br>
root@granville:~# iptables -nvL |grep 192.168.0<br> 0 0 ACCEPT all -- eth1 * <a href="http://192.168.0.0/24">192.168.0.0/24</a> <a href="http://192.168.6.0/24">192.168.6.0/24</a> policy match dir in pol ipsec reqid 16385 proto 50 <br>
7607 647K ACCEPT all -- * eth1 <a href="http://192.168.6.0/24">192.168.6.0/24</a> <a href="http://192.168.0.0/24">192.168.0.0/24</a> policy match dir out pol ipsec reqid 16385 proto 50 <br><br>
<br>
<br><div class="gmail_quote">On 23 March 2011 16:29, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Hello Russ,<br>
<br>
what about the IPsec policy based firewall rules inserted with<br>
firewall=yes. Do you get any hits on the outbound rules?<br>
<br>
Regards<br>
<br>
Andreas<br>
<div><div></div><div class="h5"><br>
On 03/23/2011 04:36 PM, Russ Cox wrote:<br>
> Hi All,<br>
><br>
> I'm having a bit of a strange issue with a net-net vpn setup where<br>
> packets bound for the remote subnet don't appear to be getting<br>
> encapsulated on either gateway, I see no ESP packets other than those<br>
> attributed with existing functional tunnels.<br>
><br>
> I've tried tcpdumping on both endpoints, and can see icmp packets coming<br>
> in to the local gateway from hosts on both networks, but no ESP packets<br>
> - and none of it seems to get across the tunnel.<br>
><br>
> Any help would be greatly appreciated - I've tried doing the same thing<br>
> with IKEV2 (with a couple of required changes) and had exactly the same<br>
> result.<br>
><br>
> Give me a shout if I can provide any additional information.<br>
><br>
> Thanks!<br>
><br>
> Russ<br>
><br>
> ---------------------<br>
><br>
> Here's my setup<br>
><br>
> Rodney:<br>
> Debian lenny x86_64<br>
> Strongswan 4.2.4-5 - from repo<br>
> A number of existing working ikev1 tunnels set up to other networks/hosts<br>
><br>
> Granville:<br>
> Debian Squeeze x86_64<br>
> Strongswan 4.4.1-5.1 - from repo<br>
><br>
> Iptables on both hosts:<br>
> udp 500 and 4500 + esp open<br>
><br>
><br>
> <a href="http://192.168.0.0/24-----RODNEY----BRIGHTON_PUB_IP.........ESSEX_PUB_IP---NAT_ROUTER----GRANVILLE----192.168.6.0/24" target="_blank">192.168.0.0/24-----RODNEY----BRIGHTON_PUB_IP.........ESSEX_PUB_IP---NAT_ROUTER----GRANVILLE----192.168.6.0/24</a><br>
</div></div>> <<a href="http://192.168.0.0/24-----RODNEY----BRIGHTON_PUB_IP.........ESSEX_PUB_IP---NAT_ROUTER----GRANVILLE----192.168.6.0/24" target="_blank">http://192.168.0.0/24-----RODNEY----BRIGHTON_PUB_IP.........ESSEX_PUB_IP---NAT_ROUTER----GRANVILLE----192.168.6.0/24</a>><br>
<div class="im">><br>
><br>
> Essex router nats absolutely everything to Granville (it's on the<br>
> netgear router's dmz)<br>
> --------------------------------------<br>
> ESSEX - IPSEC.CONF<br>
><br>
> config setup<br>
> plutodebug=control<br>
> nat_traversal=yes<br>
> charonstart=no<br>
> plutostart=yes<br>
><br>
> conn essex_brighton<br>
> left=%defaultroute<br>
> leftid=ESSEX_PUB_IP<br>
</div>> leftsubnet=<a href="http://192.168.6.0/24" target="_blank">192.168.6.0/24</a> <<a href="http://192.168.6.0/24" target="_blank">http://192.168.6.0/24</a>><br>
<div class="im">> leftfirewall=yes<br>
> right=BRIGHTON_PUB_IP<br>
</div>> rightsubnet=<a href="http://192.168.0.0/24" target="_blank">192.168.0.0/24</a> <<a href="http://192.168.0.0/24" target="_blank">http://192.168.0.0/24</a>><br>
<div class="im">> forceencaps=yes<br>
> keyexchange=ikev1<br>
> authby=secret<br>
> auto=add<br>
> --------------------------------------<br>
><br>
> BRIGHTON-IPSEC.CONF<br>
><br>
> config setup<br>
> plutodebug=control<br>
> nat_traversal=yes<br>
> charonstart=yes<br>
> plutostart=yes<br>
><br>
> conn essex_brighton<br>
> left=BRIGHTON_PUB_IP<br>
</div>> leftsubnet=<a href="http://192.168.0.0/24" target="_blank">192.168.0.0/24</a> <<a href="http://192.168.0.0/24" target="_blank">http://192.168.0.0/24</a>><br>
<div class="im">> leftfirewall=yes<br>
> right=ESSEX_PUB_IP<br>
</div>> rightsubnet=<a href="http://192.168.6.0/24" target="_blank">192.168.6.0/24</a> <<a href="http://192.168.6.0/24" target="_blank">http://192.168.6.0/24</a>><br>
<div class="im">> forceencaps=yes<br>
> keyexchange=ikev1<br>
> authby=secret<br>
> auto=add<br>
><br>
> -----------------------------------<br>
><br>
> root@granville:~# ipsec status<br>
> 000 "essex_brighton":<br>
> <a href="http://192.168.6.0/24===192.168.16.2:4500[ESSEX_PUB_IP]---192.168.16.1...BRIGHTON_PUB_IP:4500[BRIGHTON_PUB_IP]===192.168.0.0/24" target="_blank">192.168.6.0/24===192.168.16.2:4500[ESSEX_PUB_IP]---192.168.16.1...BRIGHTON_PUB_IP:4500[BRIGHTON_PUB_IP]===192.168.0.0/24</a><br>
</div>> <<a href="http://192.168.6.0/24===192.168.16.2:4500[ESSEX_PUB_IP]---192.168.16.1...BRIGHTON_PUB_IP:4500[BRIGHTON_PUB_IP]===192.168.0.0/24" target="_blank">http://192.168.6.0/24===192.168.16.2:4500[ESSEX_PUB_IP]---192.168.16.1...BRIGHTON_PUB_IP:4500[BRIGHTON_PUB_IP]===192.168.0.0/24</a>>;<br>
<div class="im">> erouted; eroute owner: #2<br>
> 000 "essex_brighton": newest ISAKMP SA: #1; newest IPsec SA: #2;<br>
> 000<br>
> 000 #2: "essex_brighton" STATE_QUICK_I2 (sent QI2, IPsec SA<br>
> established); EVENT_SA_REPLACE in 4s; newest IPSEC; eroute owner<br>
> 000 #2: "essex_brighton" esp.9c28ba55@BRIGHTON_PUB_IP (0 bytes)<br>
</div>> <a href="mailto:esp.c32b10a1@192.168.16.2">esp.c32b10a1@192.168.16.2</a> <mailto:<a href="mailto:esp.c32b10a1@192.168.16.2">esp.c32b10a1@192.168.16.2</a>> (0 bytes);<br>
<div class="im">> tunnel<br>
> 000 #1: "essex_brighton" STATE_MAIN_I4 (ISAKMP SA established);<br>
> EVENT_SA_REPLACE in 6962s; newest ISAKMP<br>
> 000<br>
><br>
><br>
> rodney:~# ipsec status<br>
> 000 "essex_brighton":<br>
> <a href="http://192.168.0.0/24===BRIGHTON_PUB_IP:4500...ESSEX_PUB_IP:4500===192.168.6.0/24" target="_blank">192.168.0.0/24===BRIGHTON_PUB_IP:4500...ESSEX_PUB_IP:4500===192.168.6.0/24</a><br>
</div>> <<a href="http://192.168.0.0/24===BRIGHTON_PUB_IP:4500...ESSEX_PUB_IP:4500===192.168.6.0/24" target="_blank">http://192.168.0.0/24===BRIGHTON_PUB_IP:4500...ESSEX_PUB_IP:4500===192.168.6.0/24</a>>;<br>
<div><div></div><div class="h5">> erouted; eroute owner: #3909<br>
> 000 "essex_brighton": newest ISAKMP SA: #3898; newest IPsec SA: #3909;<br>
> 000<br>
> 000 #3909: "essex_brighton" STATE_QUICK_R2 (IPsec SA established);<br>
> EVENT_SA_REPLACE in 3285s; newest IPSEC; eroute owner<br>
> 000 #3909: "essex_brighton" esp.360fcd9e@ESSEX_PUB_IP (0 bytes)<br>
> esp.295edd15@BRIGHTON_PUB_IP (0 bytes); tunnel<br>
> 000 #3899: "essex_brighton" STATE_QUICK_R2 (IPsec SA established);<br>
> EVENT_SA_REPLACE in 446s<br>
> 000 #3899: "essex_brighton" esp.c32b10a1@ESSEX_PUB_IP (0 bytes)<br>
> esp.9c28ba55@BRIGHTON_PUB_IP (0 bytes); tunnel<br>
> 000 #3898: "essex_brighton" STATE_MAIN_R3 (sent MR3, ISAKMP SA<br>
> established); EVENT_SA_REPLACE in 7635s; newest ISAKMP<br>
> 000<br>
> Security Associations:<br>
> none<br>
><br>
> ------------------------<br>
><br>
> root@granville:~# ip xfrm state<br>
> src 192.168.16.2 dst BRIGHTON_PUB_IP<br>
> proto esp spi 0x295edd15 reqid 16385 mode tunnel<br>
> replay-window 32 flag af-unspec<br>
> auth hmac(sha1) 0x0ba38e23a79f79f7f96690d2d166b315f60b60bb<br>
> enc cbc(aes) 0xdf238a47bb128a41d94f60452411cd26<br>
> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0<br>
> src BRIGHTON_PUB_IP dst 192.168.16.2<br>
> proto esp spi 0x360fcd9e reqid 16385 mode tunnel<br>
> replay-window 32 flag af-unspec<br>
> auth hmac(sha1) 0x015ec50f83fc414a681902bd935cf8560da4cbb2<br>
> enc cbc(aes) 0x7e40d181e5c8ca5bfc35ed44b59c968d<br>
> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0<br>
> src 192.168.16.2 dst BRIGHTON_PUB_IP<br>
> proto esp spi 0x9c28ba55 reqid 16385 mode tunnel<br>
> replay-window 32 flag af-unspec<br>
> auth hmac(sha1) 0x2345729df63869ea9a6df60f50508cf746860b02<br>
> enc cbc(aes) 0xf90f83024f337ff85a8fc72392eaea8f<br>
> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0<br>
> src BRIGHTON_PUB_IP dst 192.168.16.2<br>
> proto esp spi 0xc32b10a1 reqid 16385 mode tunnel<br>
> replay-window 32 flag af-unspec<br>
> auth hmac(sha1) 0x7f16f51d63369bec30ac74e4eef27d9a8ff81958<br>
> enc cbc(aes) 0x047271d81f3a0483c34c0790fcc098c8<br>
> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0<br>
> root@granville:~# ip xfrm policy<br>
</div></div>> src <a href="http://192.168.6.0/24" target="_blank">192.168.6.0/24</a> <<a href="http://192.168.6.0/24" target="_blank">http://192.168.6.0/24</a>> dst <a href="http://192.168.0.0/24" target="_blank">192.168.0.0/24</a><br>
> <<a href="http://192.168.0.0/24" target="_blank">http://192.168.0.0/24</a>><br>
<div class="im">> dir out priority 2344 ptype main<br>
> tmpl src 192.168.16.2 dst BRIGHTON_PUB_IP<br>
> proto esp reqid 16385 mode tunnel<br>
</div>> src <a href="http://192.168.0.0/24" target="_blank">192.168.0.0/24</a> <<a href="http://192.168.0.0/24" target="_blank">http://192.168.0.0/24</a>> dst <a href="http://192.168.6.0/24" target="_blank">192.168.6.0/24</a><br>
> <<a href="http://192.168.6.0/24" target="_blank">http://192.168.6.0/24</a>><br>
<div class="im">> dir fwd priority 2344 ptype main<br>
> tmpl src BRIGHTON_PUB_IP dst 192.168.16.2<br>
> proto esp reqid 16385 mode tunnel<br>
</div>> src <a href="http://192.168.0.0/24" target="_blank">192.168.0.0/24</a> <<a href="http://192.168.0.0/24" target="_blank">http://192.168.0.0/24</a>> dst <a href="http://192.168.6.0/24" target="_blank">192.168.6.0/24</a><br>
> <<a href="http://192.168.6.0/24" target="_blank">http://192.168.6.0/24</a>><br>
<div class="im">> dir in priority 2344 ptype main<br>
> tmpl src BRIGHTON_PUB_IP dst 192.168.16.2<br>
> proto esp reqid 16385 mode tunnel<br>
> src ::/0 dst ::/0<br>
> dir 4 priority 0 ptype main<br>
> src ::/0 dst ::/0<br>
> dir 3 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 4 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 3 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 4 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 3 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 4 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 3 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 4 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 3 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 4 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 3 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 4 priority 0 ptype main<br>
</div>> src <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="im">> dir 3 priority 0 ptype main<br>
><br>
><br>
><br>
><br>
><br>
</div>> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
<font color="#888888"><br>
<br>
--<br>
======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
</font></blockquote></div><br>