<div dir="ltr">When I've seen this happen before (interface sees the traffic, ping or some other process does not), it usually means it's getting dropped by the Kernel.<div><br></div><div>It's usually RP-filtering... you can try to turn it off:</div><div><br></div><div># echo 0 > /proc/sys/net/ipv4/conf/vti/rp_filter</div><div># echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter</div><div><br></div><div>I wouldn't leave if off permanently, but it might help you get further with testing where the packets are going.</div><div><br></div><div>/Ryan</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 17, 2014 at 7:15 AM, Olivier PELERIN <span dir="ltr"><<a href="mailto:olivier_pelerin@hotmail.com" target="_blank">olivier_pelerin@hotmail.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div dir="ltr">Kernel wise I'm on 3.18.1. I saw few links on the internet about this prerouting mangling rules but it's very unclear if it's needed or not. I would assume the ikey in the ip tunnel command is enough.<br><br>I've modified the config by specifying the local address [ instead of using %any] now I've added left=10.1.1.1<br><br>ipsec statusall<br>Status of IKE charon daemon (strongSwan 5.2.2rc1, Linux 3.18.1-gentoo, x86_64):<br> uptime: 2 minutes, since Dec 17 13:07:54 2014<br> malloc: sbrk 2416640, mmap 0, used 377184, free 2039456<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 2<br> loaded plugins: charon ldap aes des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic<br>Listening IP addresses:<br> 192.168.255.134<br> 10.1.1.1<br> 10.0.0.1<br>Connections:<br> VTI: 10.1.1.1...10.1.1.254 IKEv2<br> VTI: local: [10.1.1.1] uses pre-shared key authentication<br> VTI: remote: [10.1.1.254] uses pre-shared key authentication<br> VTI: child: <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> === <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> TUNNEL<br>Routed Connections:<br> VTI{1}: ROUTED, TUNNEL<br> VTI{1}: <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> === <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <br>Security Associations (1 up, 0 connecting):<br> VTI[1]: ESTABLISHED 2 minutes ago, 10.1.1.1[10.1.1.1]...10.1.1.254[10.1.1.254]<br> VTI[1]: IKEv2 SPIs: 2be274863074302d_i* 720fa6a0e8c28b09_r, pre-shared key reauthentication in 2 hours<br> VTI[1]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br> VTI{1}: INSTALLED, TUNNEL, ESP SPIs: c8da39c8_i 938ec319_o<br> VTI{1}: AES_CBC_256/HMAC_SHA1_96, 12848 bytes_i (152 pkts, 23s ago), 12348 bytes_o (147 pkts, 23s ago), rekeying in 39 minutes<br> VTI{1}: <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> === <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <br><br><br>Now I'm one step further. I see bytes_i and bytes_o increasing.<br><br>running tcpdump directly on the VTI interface I see the echo-reply arriving<br><br>manowar python # tcpdump -nNi vti0<br>error : ret -1<br>tcpdump: verbose output suppressed, use -v or -vv for full protocol decode<br>listening on vti0, link-type RAW (Raw IP), capture size 262144 bytes<br>13:09:37.669100 IP 10.0.0.1 > <a href="http://10.0.0.2" target="_blank">10.0.0.2</a>: ICMP echo request, id 18052, seq 4366, length 64<br>13:09:37.669564 IP 10.0.0.2 > <a href="http://10.0.0.1" target="_blank">10.0.0.1</a>: ICMP echo reply, id 18052, seq 4366, length 64<br>13:09:38.669208 IP 10.0.0.1 > <a href="http://10.0.0.2" target="_blank">10.0.0.2</a>: ICMP echo request, id 18052, seq 4367, length 64<br>13:09:38.669691 IP 10.0.0.2 > <a href="http://10.0.0.1" target="_blank">10.0.0.1</a>: ICMP echo reply, id 18052, seq 4367, length 64<br><br>Still traffic seems not to reach the ping process <br><br>ping 10.0.0.2 -I vti0<br>PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 vti0: 56(84) bytes of data.<br><br>vti0 sees the traffic but not the ping process??<br><br><br><br><br><br><div><hr>Subject: Re: [strongSwan] Strongswan using VTI<br>From: <a href="mailto:ryan0751@gmail.com" target="_blank">ryan0751@gmail.com</a><br>Date: Wed, 17 Dec 2014 06:50:47 -0500<br>CC: <a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a><br>To: <a href="mailto:olivier_pelerin@hotmail.com" target="_blank">olivier_pelerin@hotmail.com</a><br><br>I was just trying to get this to work the other day myself and also had problems with the routing.<div><br><div>It wasn’t clear to me if you still need to create the PREROUTING mangle rules. such as:</div><div><pre style="white-space:pre-wrap;background-color:rgb(255,255,255)"># mangle PREROUTING rules:
iptables -t mangle -A PREROUTING -s <a href="http://192.168.10.0/24" target="_blank">192.168.10.0/24</a> -d <a href="http://192.168.11.0/24" target="_blank">192.168.11.0/24</a>
-j MARK --set-mark 32
iptables -t mangle -A PREROUTING -p esp -s 10.1.3.2 -d 10.1.1.2 -j MARK
--set-mark 32</pre><div>From what I had read the Kernel might have been patched to no longer require this? </div></div><div><br></div><div>Have you checked the SA stats on the Linux box (setkey -D or using the ip xfrm command) to see if the packets are matching the SA and are being decrypted?</div><div><br></div><div>/Ryan</div><div><br><div><blockquote><div>On Dec 17, 2014, at 6:08 AM, Olivier PELERIN <<a href="mailto:olivier_pelerin@hotmail.com" target="_blank">olivier_pelerin@hotmail.com</a>> wrote:</div><br><div><div dir="ltr" style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">Dear Strongswan alias,<br><br>I'm trying a VTI config between a linux box and a cisco router.<span> </span><br><br>I've created a VTI interface on my linux<br><br>ip tunnel add vti0 mode vti local 10.1.1.1 remote 10.1.1.254 okey 32 ikey 32<br> ip link set vti0 up<br> ip addr add <a href="http://10.0.0.1/30" target="_blank">10.0.0.1/30</a> remote <a href="http://10.0.0.2/30" target="_blank">10.0.0.2/30</a> dev vti0<br><br>conn VTI<br> keyexchange=ikev2<br> ike=aes256-sha1-modp1024<br> esp=aes256-sha1!<br> leftid=10.1.1.1<br> leftauth=psk<br> leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> rightauth=psk<br> right=10.1.1.254<br> rightid=10.1.1.254<br> rightsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> mark=32<br> auto=route<br><br><br><br><br>manowar python # ipsec statusall<br>Status of IKE charon daemon (strongSwan 5.2.2rc1, Linux 3.18.1-gentoo, x86_64):<br> uptime: 114 seconds, since Dec 17 11:53:47 2014<br> malloc: sbrk 2416640, mmap 0, used 373840, free 2042800<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 2<br> loaded plugins: charon ldap aes des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic<br>Listening IP addresses:<br> 192.168.255.134<br> 10.1.1.1<br> 10.0.0.1<br>Connections:<br> VTI: %any...10.1.1.254 IKEv2<br> VTI: local: [10.1.1.1] uses pre-shared key authentication<br> VTI: remote: [10.1.1.254] uses pre-shared key authentication<br> VTI: child: <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> === <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> TUNNEL<br>Routed Connections:<br> VTI{1}: ROUTED, TUNNEL<br> VTI{1}: <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> === <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><span> </span><br>Security Associations (1 up, 0 connecting):<br> VTI[1]: ESTABLISHED 109 seconds ago, 10.1.1.1[10.1.1.1]...10.1.1.254[10.1.1.254]<br> VTI[1]: IKEv2 SPIs: e1e9a005055323ab_i* 78c7cc9d34a5886f_r, pre-shared key reauthentication in 2 hours<br> VTI[1]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br> VTI{1}: INSTALLED, TUNNEL, ESP SPIs: c8031e20_i 37b2a5a2_o<br> VTI{1}: AES_CBC_256/HMAC_SHA1_96, 0 bytes_i, 1848 bytes_o (22 pkts, 8s ago), rekeying in 44 minutes<br> VTI{1}: <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> === <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><span> </span><br><br><br>I do have ESP in<span> </span><br><br>manowar python # tcpdump -nNi netio0<br>error : ret -1<br>tcpdump: verbose output suppressed, use -v or -vv for full protocol decode<br>listening on netio0, link-type EN10MB (Ethernet), capture size 262144 bytes<br>12:07:57.840726 IP 10.1.1.1 > <a href="http://10.1.1.254" target="_blank">10.1.1.254</a>: ESP(spi=0x37b2a5a2,seq=0x2bf), length 132<br>12:07:57.841405 IP 10.1.1.254 > <a href="http://10.1.1.1" target="_blank">10.1.1.1</a>: ESP(spi=0xc8031e20,seq=0x2bf), length 132<br>12:07:58.840971 IP 10.1.1.1 > <a href="http://10.1.1.254" target="_blank">10.1.1.254</a>: ESP(spi=0x37b2a5a2,seq=0x2c0), length 132<br>12:07:58.841336 IP 10.1.1.254 > <a href="http://10.1.1.1" target="_blank">10.1.1.1</a>: ESP(spi=0xc8031e20,seq=0x2c0), length 132<br><br><br>But it seems not be decapsulated by the kernel.<br><br>Any ideas why?<br></div><span style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;display:inline!important">_______________________________________________</span><br style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><span style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;display:inline!important">Users mailing list</span><br style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><a href="mailto:Users@lists.strongswan.org" style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px" target="_blank">Users@lists.strongswan.org</a><br style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><a href="https://lists.strongswan.org/mailman/listinfo/users" style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a></div></blockquote></div></div></div></div> </div></div>
<br>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br></blockquote></div></div>