<div dir="ltr"><div><span style="font-size:12.8px">from server alpha:</span></div><div><span style="font-size:12.8px">----------------------------------------------------------------------------------------------------------------------</span><span style="font-size:12.8px"><br></span></div><span style="font-size:12.8px">ipsec statusall</span><div><span style="font-size:12.8px"><br></span><div><div><span style="font-size:12.8px">Status of IKE charon daemon (strongSwan 5.6.1, Linux 2.6.32-042stab123.3, x86_64):</span></div><div><span style="font-size:12.8px"> uptime: 106 seconds, since Dec 22 10:43:25 2017</span></div><div><span style="font-size:12.8px"> malloc: sbrk 1486848, mmap 0, used 400416, free 1086432</span></div><div><span style="font-size:12.8px"> worker threads: 7 of 16 idle, 5/0/4/0 working, job queue: 0/0/0/0, scheduled: 0</span></div><div><span style="font-size:12.8px"> loaded plugins: charon aes des rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf curve25519 xcbc cmac hmac attr kernel-libipsec kernel-netlink resolve socket-default stroke vici updown eap-identity eap-md5 eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-pam tnc-tnccs dhcp certexpire radattr addrblock unity counters</span></div><div><span style="font-size:12.8px">Listening IP addresses:</span></div><div><span style="font-size:12.8px"> 138.128.199.83</span></div><div><span style="font-size:12.8px">Connections:</span></div><div><span style="font-size:12.8px"> rw: 138.128.199.xx...198.181.41.xx IKEv2</span></div><div><span style="font-size:12.8px"> rw: local: [138.128.199.xx] uses pre-shared key authentication</span></div><div><span style="font-size:12.8px"> rw: remote: [198.181.41.xx] uses pre-shared key authentication</span></div><div><span style="font-size:12.8px"> rw: child: dynamic === dynamic TUNNEL</span></div><div><span style="font-size:12.8px">Security Associations (0 up, 0 connecting):</span></div><div><span style="font-size:12.8px"> none</span></div></div></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">----------------------------------------------------------------------------------------------------------------------</span></div><div><span style="font-size:12.8px">sysctl -A | grep rp_filter</span><span style="font-size:12.8px"><br></span></div><div><br></div><div><div><span style="font-size:12.8px">sysctl: separators should not be repeated: /.fake</span></div><div><span style="font-size:12.8px">sysctl: separators should not be repeated: /.fake</span></div><div><span style="font-size:12.8px">net.ipv4.conf.all.rp_filter = 0</span></div><div><span style="font-size:12.8px">net.ipv4.conf.all.arp_filter = 0</span></div><div><span style="font-size:12.8px">net.ipv4.conf.default.rp_filter = 0</span></div><div><span style="font-size:12.8px">net.ipv4.conf.default.arp_filter = 0</span></div><div><span style="font-size:12.8px">net.ipv4.conf.lo.rp_filter = 1</span></div><div><span style="font-size:12.8px">net.ipv4.conf.lo.arp_filter = 0</span></div><div><span style="font-size:12.8px">net.ipv4.conf.venet0.rp_filter = 1</span></div><div><span style="font-size:12.8px">net.ipv4.conf.venet0.arp_filter = 0</span></div><div><span style="font-size:12.8px">net.ipv4.conf.ipsec0.rp_filter = 0</span></div><div><span style="font-size:12.8px">net.ipv4.conf.ipsec0.arp_filter = 0</span></div></div><div><span style="font-size:12.8px">----------------------------------------------------------------------------------------------------------------------</span><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">ip route show table all</span><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><div>198.181.41.xx dev ipsec0 table 220 proto static src 138.128.199.xx </div><div>default dev venet0 scope link </div><div>broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 </div><div>local 138.128.199.xx dev venet0 table local proto kernel scope host src 138.128.199.xx </div><div>broadcast 138.128.199.xx dev venet0 table local proto kernel scope link src 138.128.199.xx </div><div>local 127.0.0.2 dev venet0 table local proto kernel scope host src 127.0.0.2 </div><div>broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 </div><div>local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 </div><div>local <a href="http://127.0.0.0/8">127.0.0.0/8</a> dev lo table local proto kernel scope host src 127.0.0.1 </div><div>unreachable default dev lo table unspec proto kernel metric 4294967295 error -101 hoplimit 255</div><div>default dev venet0 metric 1 mtu 1500 hoplimit 0</div><div>unreachable default dev lo table unspec proto kernel metric 4294967295 error -101 hoplimit 255</div><div>local ::1 via :: dev lo table local proto none metric 0 mtu 65536 hoplimit 0</div><div>unreachable default dev lo table unspec proto kernel metric 4294967295 error -101 hoplimit 255</div></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">----------------------------------------------------------------------------------------------------------------------</span><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">ip rule</span><br></div><div><span style="font-size:12.8px"><br></span></div><div><div><span style="font-size:12.8px">0: from all lookup local </span></div><div><span style="font-size:12.8px">220: not from all fwmark 0x4 lookup 220 </span></div><div><span style="font-size:12.8px">32766: from all lookup main </span></div><div><span style="font-size:12.8px">32767: from all lookup default</span></div></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">-----------------------------------------------------------------------------------------------------------------------</span></div><div><span style="font-size:12.8px">if I ping from beta to alpha</span></div><div><span style="font-size:12.8px"><br></span></div><div><div>root@bwg:~# tcpdump -n -i ipsec0</div><div>tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</div><div>listening on ipsec0, link-type RAW (Raw IP), capture size 262144 bytes</div><div>11:01:46.158074 IP 138.128.199.xx > 198.181.41.xx: ICMP echo request, id 574, seq 1, length 64</div><div>11:01:47.157528 IP 138.128.199.xx > 198.181.41.xx: ICMP echo request, id 574, seq 2, length 64</div><div>11:01:48.157531 IP 138.128.199.xx > 198.181.41.xx: ICMP echo request, id 574, seq 3, length 64</div></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><div><div><span style="font-size:12.8px">root@bwg:~# tcpdump -n host 198.181.41.xx</span></div><div><span style="font-size:12.8px">tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</span></div><div><span style="font-size:12.8px">listening on venet0, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes</span></div><div><span style="font-size:12.8px">11:02:58.797762 IP 198.181.41.xx.4500 > 138.128.199.xx.4500: UDP-encap: ESP(spi=0xa02b7290,seq=0x4e), length 136</span></div><div><span style="font-size:12.8px">11:02:59.796353 IP 138.128.199.xx.4500 > 198.181.41.xx.4500: UDP-encap: ESP(spi=0xc33ec88a,seq=0x4f), length 136</span></div><div><span style="font-size:12.8px">11:02:59.797232 IP 198.181.41.xx.4500 > 138.128.199.xx.4500: UDP-encap: ESP(spi=0xa02b7290,seq=0x4f), length 136</span></div><div><span style="font-size:12.8px">11:03:00.796608 IP 138.128.199.xx.4500 > 198.181.41.xx.4500: UDP-encap: ESP(spi=0xc33ec88a,seq=0x50), length 136</span></div><div><span style="font-size:12.8px">11:03:00.797379 IP 198.181.41.xx.4500 > 138.128.199.xx.4500: UDP-encap: ESP(spi=0xa02b7290,seq=0x50), length 136</span></div><div><span style="font-size:12.8px">11:03:01.796649 IP 138.128.199.xx.4500 > 198.181.41.xx.4500: UDP-encap: ESP(spi=0xc33ec88a,seq=0x51), length 136</span></div><div><span style="font-size:12.8px">11:03:01.797435 IP 198.181.41.xx.4500 > 138.128.199.xx.4500: UDP-encap: ESP(spi=0xa02b7290,seq=0x51), length 136</span></div></div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature">Regards<br>Quaker</div></div>
<br><div class="gmail_quote">On Fri, Dec 22, 2017 at 7:00 AM, Noel Kuntze <span dir="ltr"><<a href="mailto:noel.kuntze+strongswan-users-ml@thermi.consulting" target="_blank">noel.kuntze+strongswan-users-ml@thermi.consulting</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">There have previously been problems with running XFRM in OpenVZ containers (meaning it didn't work at all, despite claims of the OpenVZ developers it did).<br>
<br>
Please provide the following outputs:<br>
ipsec statusall (or swanctl -l, if you use swanctl)<br>
sysctl -A | grep rp_filter<br>
ip route show table all<br>
ip rule<br>
'tcpdump -n -i ipsec0' when you're trying to connect over the tunnels<br>
<span class=""><br>
<br>
On 19.12.2017 08:57, Quaker wrote:<br>
> I am using Strongswan 5.6.1 on my OpenVZ servers<br>
> And strongswan 5.6.1 is compiled by myself. kernel-libipsec enabled by <br>
</span>> ./configure --enable-eap-identity --enable-eap-md5 \ --enable-eap-mschapv2 --enable-eap-tls --enable-eap-ttls --enable-eap-peap \ --enable-eap-tnc --enable-eap-dynamic--enable-<wbr>eap-radius --enable-xauth-eap \ --enable-xauth-pam --enable-dhcp --enable-openssl --enable-addrblock --enable-unity \ --enable-certexpire --enable-radattr --enable-tools --enable-openssl --disable-gmp --enable-kernel-libipsec<br>
<div class="HOEnZb"><div class="h5">> the strongswan.conf configuration modified as :<br>
><br>
> charon {<br>
> load_modular = yes<br>
> plugins {<br>
> include strongswan.d/charon/*.conf<br>
> kernel-netlink {<br>
> fwmark = !0x4<br>
> }<br>
> socket-default {<br>
> fwmark = 0x4<br>
> }<br>
> kernel-libipsec {<br>
> allow_peer_ts = yes<br>
> }<br>
> }<br>
> }<br>
> I have created ipsec tunnel successfully between my OpenVZ server alpha and beta:<br>
> But the socket connection fails.<br>
> By investigate the problem, I tried tcpdump, found that<br>
> If I ping from alpha to beta<br>
> tcpdump could found <br>
> esp from alpha->beta<br>
> esp from beta->alpha<br>
> but ping timeout<br>
><br>
> If I ping from beta to alpha<br>
> tcpdump could found <br>
> esp from beta->alpha<br>
> and ping timeout<br>
><br>
> if using tcp, and answer is similar<br>
> alpha->beta<br>
> alpha SYN_SENT<br>
> beta SYN_RECV<br>
><br>
> beta->alpha<br>
> beta SYN_SENT<br>
> alpha NULL<br>
><br>
> I guess there should be some problem during esp to socket<br>
> anyone could tell me how to detect the problem, or some further information should I give.<br>
><br>
> alpha and beta belongs to different OpenVZ supplier, don't know the problem.<br>
> I have reinstalled alpha sometimes, but doesn't work.<br>
><br>
> beta:Linux beta 2.6.32-042stab125.5 #1 SMP Tue Oct 17 12:48:22 MSK 2017 x86_64 GNU/Linux<br>
><br>
> alpha: Linux alpha 2.6.32-042stab123.3 #1 SMP Fri May 5 12:29:05 MSK 2017 x86_64 GNU/Linux<br>
><br>
> Regards<br>
> Quaker<br>
<br>
</div></div></blockquote></div><br></div>