<div>Hello all,</div><div> </div><div>I could able to get them working changes were in the ipsec.conf , ipsec.psk and ipsec.secrets.</div><div> </div><div>I have a generic questions related to Strongswan and IPtables.</div>
<div> </div><div>Iam using the "<strong><em>Linux strongSwan U4.6.1/K2.6.39" </em></strong>version.</div><div> </div><div> </div><div>following are my queries.</div><div> </div><div>First : </div><div>=====</div>
<div>My Strongswan is running behind a router.</div><div> </div><div>My box where strongswan server currently running does not have any iptables as such now.<br></div><div>Currently iam Using a DNAT for 4500 , 500 ports in PREROUTING and SNAT for 4500 , 500 ports in POSTROUTING chains of nat table on my router. </div>
<div> </div><div>Do i need to have any other rules to be applied here on my router apart from these?</div><div> </div><div>Any rules like below.. do i need to apply on to my router ..?</div><div> </div><div>Here <a href="http://192.168.1.0/24">192.168.1.0/24</a> is my LAN Subnet and 10.10.15.8 is my WAN IP.</div>
<div> </div><div><font size="3" face="Times New Roman">
</font><p style="margin:0cm 0cm 10pt" class="MsoNormal"><font size="3"><font face="Calibri">-A INPUT -s <a href="http://192.168.1.0/24">192.168.1.0/24</a> -i eth4 -m mark --mark 0x8/0x8 -j
ACCEPT</font></font></p><font size="3" face="Times New Roman">
</font><p style="margin:0cm 0cm 10pt" class="MsoNormal"><font size="3"><font face="Calibri">-A INPUT -s <a href="http://10.10.15.8/32">10.10.15.8/32</a> -i eth4 -p ipv6-crypt -j ACCEPT</font></font></p><font size="3" face="Times New Roman">
</font></div><div> </div><div>2) Do we have any provision of applying the iptables rules on to my router through strongswan configuraiton ?</div><div> </div><div> </div><div>3) Any specific precations i need to take in my case..?</div>
<div> </div><div> </div><div>Your comments would be highly appreciated and would help me immensely.</div><div> </div><div>Thanks and Regards</div><div>Rama Kanth</div><div> </div><div> </div><div> </div><div> </div><div> </div>
<div> </div><div><br><br> </div><div class="gmail_quote">On Wed, Dec 5, 2012 at 12:23 AM, ramakanth varala <span dir="ltr"><<a href="mailto:ramakanth.varala@gmail.com" target="_blank">ramakanth.varala@gmail.com</a>></span> wrote:<br>
<blockquote style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid" class="gmail_quote"><div class="gmail_quote"><div>Hello all,</div><div><div class="h5">
<div> </div><div>Iam bit new to IPSec VPN and trying to figure it out how can run this VPNServer on my dual core board.</div><div> </div><div>First board is ARM with 10.10.16.8 (WAN) as its interface second interface on same board 192.168.1.1</div>
<div>Second board is ATOM runnig on 192.168.1.254 .</div><div> </div><div>Running VPN Server in ATOM and kept a DNAT at ARM using Iptable rules to follow all packets <a href="http://10.10.16.8:500" target="_blank">10.10.16.8:500</a> and <a href="http://10.10.16.8:4500" target="_blank">10.10.16.8:4500</a> to <a href="http://192.168.1.254:500" target="_blank">192.168.1.254:500</a> and <a href="http://192.168.1.254:4500" target="_blank">192.168.1.254:4500</a></div>
<div> </div><div>here is a typical block diagram with ip's.</div><div> </div><div>Here all ips can ping each other.</div><div> </div><div>router (10.90.200.1) ======= dual core board ( Wan board 10.10.15.8 | Lan board 192.168.1.254)</div>
<div>||</div><div>||=============== LAN PC (10.90.200.2)</div><div> </div><div> </div><div>my ipsec.conf is like below</div><div> </div><div># cat /var/etc/ipsec/ipsec.conf<br>config setup<br> charonstart=no<br> plutodebug=all<br>
plutostderrlog=/var/pluto.txt<br> nat_traversal=yes</div><div>conn %default<br> ikelifetime=10m<br> keylife=10m<br> rekeymargin=500s<br> rekeyfuzz=0%<br> keyingtries=1<br>
keyexchange=ikev1</div><div>conn host-host<br> right=10.90.200.2<br> xauth=server<br> left=%defaultroute<br> leftid=10.10.15.8<br> leftsubnet=<a href="http://192.168.1.1/24" target="_blank">192.168.1.1/24</a><br>
forceencaps=yes<br> leftfirewall=yes<br> rightsourceip=<a href="http://10.90.200.1/24" target="_blank">10.90.200.1/24</a><br> auto=add<br> modeconfig=push<br> authby=xauthpsk</div>
<div> </div><div>
</div><div>The error i see at /var/pluto.txt is like below when i initiate a connection from Remote IPSec Client at LAN PC</div><div> </div><div><em>| peer: 0a 5a c8 02<br>| state hash entry 27<br>| state object not found<br>
packet from <a href="http://10.90.200.2:4500" target="_blank">10.90.200.2:4500</a>: Quick Mode message is for a non-existent (expired?<br>| next event EVENT_REINIT_SECRET in 3397 seconds</em></div><div><em></em> </div><div>
<em></em> </div>
<div>Can you please guide me where am i going wrong.</div><div> </div><div>Your help would be highly appreciated.</div><span><font color="#888888"><div> </div><div>--RamaKanth</div><div><br><br><font size="3"><font face="Times New Roman">
</font></font><font size="3"><font face="Times New Roman">
</font></font></div>
</font></span></div></div></div><br>
</blockquote></div><br>