<div dir="ltr">Hi Noel,<div>Thanks for your help.</div><div><br></div><div>Log as defined in the HelpRequests page can be download from "<a href="http://www.printemps.cc/Temp/charon_debug.log">http://www.printemps.cc/Temp/charon_debug.log</a>"</div><div>it shows the result of the following commands:</div><div> - sudo ipsec start</div><div> - sudo ipsec up VPN</div><div> - sudo -u vpn -i -- curl <a href="http://ipinfo.io">ipinfo.io</a></div><div> {</div><div> "ip": "5.79.71.229",</div><div> "city": "",</div><div> "region": "",</div><div> "country": "NL",</div><div> "loc": "52.3824,4.8995",</div><div> "org": "AS60781 LeaseWeb Netherlands B.V."</div><div> }</div><div> - sudo -u vpn -i -- curl <a href="http://ipinfo.io">ipinfo.io</a></div><div> {</div><div> "ip": "5.79.71.229",</div><div> "city": "",</div><div> "region": "",</div><div> "country": "NL",</div><div> "loc": "52.3824,4.8995",</div><div> "org": "AS60781 LeaseWeb Netherlands B.V."</div><div> }</div><div><br></div><div><div> - sudo -u vpn -i -- curl <a href="http://ipinfo.io">ipinfo.io</a></div><div> curl: (6) Could not resolve host: <a href="http://ipinfo.io">ipinfo.io</a></div></div><div><br></div><div> - sudo -u vpn -i -- curl <a href="http://ipinfo.io">ipinfo.io</a></div><div> {</div><div> "ip": "46.166.179.59",</div><div> "hostname": "",</div><div> "city": "Amsterdam",</div><div> "region": "Noord-Holland",</div><div> "country": "NL",</div><div> "loc": "52.3666,4.9027",</div><div> "postal": "1066",</div><div> "org": "AS43350 NForce Entertainment B.V."</div><div> }</div><div><br></div><div>Connection is established, works few minutes, destroyed and restarted</div><div>Best Regards,</div><div>Gilles</div><div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jun 4, 2018 at 8:44 PM, Noel Kuntze <span dir="ltr"><<a href="mailto:noel.kuntze+strongswan-users-ml@thermi.consulting" target="_blank">noel.kuntze+strongswan-users-ml@thermi.consulting</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Hello,<br>
<br>
The log you provide is not useful. Please provide a log file as the HelpRequests page says and use the exact configuration from the page to create it.<br>
<br>
Kind regards<br>
<br>
Noel<br>
<span class="gmail-"><br>
On 04.06.2018 00:10, Gilles Printemps wrote:<br>
> Hi,<br>
> To illustrate my issue and in addition to the configuration described previously,<br>
> - I enabled more trace in the ipsec.conf [charondebug="ike 2, knl 3, cfg 0"]. <br>
</span>> [Log can be downloaded using the following link "<a href="http://www.printemps.cc/Temp/syslog.txt" rel="noreferrer" target="_blank">www.printemps.cc/Temp/syslog.<wbr>txt</a> <<a href="http://www.printemps.cc/Temp/syslog.txt" rel="noreferrer" target="_blank">http://www.printemps.cc/Temp/<wbr>syslog.txt</a>>"]<br>
<span class="gmail-">> - I tried to launch a set of commands [See "cmds.txt" in attachment]<br>
><br>
> Executed commands:<br>
> - After starting ipsec, I establish the VPN connection.<br>
> As you can see in "cmds.txt", connection is established correctly<br>
> - I execute the following command to see if the traffic for the user is going through the VPN<br>
</span>> $ sudo -u vpn -i -- curl <a href="http://ipinfo.io" rel="noreferrer" target="_blank">ipinfo.io</a> <<a href="http://ipinfo.io/" rel="noreferrer" target="_blank">http://ipinfo.io/</a>><br>
<span class="gmail-">> Result is the expected one.<br>
> - A little bit later (After 17:14:34 in the syslog.02/Less than 2mins after previous cmd], I execute the same command<br>
</span>> Result fails with the following status: curl: (6) Could not resolve host: <a href="http://ipinfo.io" rel="noreferrer" target="_blank">ipinfo.io</a> <<a href="http://ipinfo.io/" rel="noreferrer" target="_blank">http://ipinfo.io/</a>><br>
<span class="gmail-">> - I decide to wait and after 2 additional minutes, I try to execute again the same command<br>
> Command is not failing but I can see that my IP address allocated but the VPN has changed.<br>
><br>
> To summarise,<br>
> - VPN connection is established correctly and the route defined through the scripts are working<br>
> Traffic for the "vpn" user is going through the VPN<br>
> - After few minutes (less than 2) without any activity through the VPN, connection is no more working.<br>
> I have to wait additional minutes, to get a working connection.<br>
> - Few minutest later, connection is killed again...<br>
><br>
> - Why is the VPN connection killed after less than 2 minutes?<br>
> - Is the issue come from the VPN server or from my configuration?<br>
> - Why is it so long to re-establish a new working connection?<br>
> - How to keep the connection longer?<br>
><br>
> If someone can check the log and see where the issue is coming from, I would really appreciate because, currently, I'm lost...<br>
</span><span class="gmail-">> Thanks for your help,<br>
> Gilles<br>
><br>
</span><span class="gmail-">> On Tue, May 29, 2018 at 10:51 AM, Gilles Printemps <<a href="mailto:gprintemps@gmail.com">gprintemps@gmail.com</a> <mailto:<a href="mailto:gprintemps@gmail.com">gprintemps@gmail.com</a>>> wrote:<br>
><br>
> Hi,<br>
> After several days, I finally have a configuration which force all the traffic from a specific user to be routed from a VPN via a vti interface.<br>
><br>
> After creating the vti interface and establishing the different route, I can successfully check if the traffic is currently routed using the following commands:<br>
><br>
</span>> sudo -u vpn -i -- curl <a href="http://ipinfo.io" rel="noreferrer" target="_blank">ipinfo.io</a> <<a href="http://ipinfo.io" rel="noreferrer" target="_blank">http://ipinfo.io</a>><br>
><br>
> ping -I vti0 <a href="http://www.google.com" rel="noreferrer" target="_blank">www.google.com</a> <<a href="http://www.google.com" rel="noreferrer" target="_blank">http://www.google.com</a>><br>
<span class="gmail-">><br>
><br>
> Unfortunately, after a period d of time, it is no more working and I can see several error packets on the vti interface. several minute later, connection is established again with the VPN but with a new connection (IP has changed).<br>
><br>
><br>
> It seems this issue occurs after "sending keep alive" from IKE.<br>
><br>
> Is something missing or wrong in my ipsec.conf?<br>
><br>
><br>
> Thanks for your help,<br>
><br>
> Gilles<br>
><br>
><br>
> /etc/ipsec.conf<br>
><br>
> config setup<br>
> charondebug="ike 2, knl 3, cfg 0"<br>
> conn %default<br>
> ### Key Exchange<br>
> keyexchange=ikev2<br>
> ike=aes256-sha256-ecp384 # Algorithms used for the connection [phase1/ISAKMP SA]<br>
> esp=aes256-sha256-ecp384,<wbr>aes256-sha256 # Algorithms offered/accepted for a phase2 negotiation<br>
> conn VPN<br>
> dpdaction=restart<br>
</span>> leftupdown=/etc/<a href="http://ipsec.script.sh" rel="noreferrer" target="_blank">ipsec.script.<wbr>sh</a> <<a href="http://ipsec.script.sh" rel="noreferrer" target="_blank">http://ipsec.script.sh</a>><br>
> left=%defaultroute<br>
> leftsourceip=%config4<br>
> leftauth=eap-mschapv2<br>
> eap_identity=gprintemps<br>
> right=<a href="http://free-nl.hide.me" rel="noreferrer" target="_blank">free-nl.hide.me</a> <<a href="http://free-nl.hide.me" rel="noreferrer" target="_blank">http://free-nl.hide.me</a>><br>
> rightauth=pubkey<br>
> rightid=%any<br>
> rightsubnet=<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">http://0.0.0.0/0</a>><br>
> auto=start<br>
> mark=2<br>
><br>
><br>
> /etc/<a href="http://ipsec.script.sh" rel="noreferrer" target="_blank">ipsec.script.sh</a> <<a href="http://ipsec.script.sh" rel="noreferrer" target="_blank">http://ipsec.script.sh</a>><br>
<span class="gmail-">><br>
> set -o nounset<br>
> set -o errexit<br>
> VPN_USER="vpn"<br>
> VTI_INTERFACE="vti0"<br>
> case "${PLUTO_VERB}" in<br>
> up-client)<br>
> ip tunnel add "${VTI_INTERFACE}" local "${PLUTO_ME}" remote "${PLUTO_PEER}" mode vti \<br>
> okey "${PLUTO_MARK_OUT%%/*}" ikey "${PLUTO_MARK_IN%%/*}"<br>
> ip link set "${VTI_INTERFACE}" up<br>
> sysctl -w "net.ipv4.conf.${VTI_<wbr>INTERFACE}.disable_policy=1"<br>
> sysctl -w "net.ipv4.conf.${VTI_<wbr>INTERFACE}.rp_filter=2"<br>
> ip addr add ${PLUTO_MY_SOURCEIP} dev "${VTI_INTERFACE}"<br>
> if [[ `ip rule list | grep -c 0x1` == 0 ]]; then<br>
> ip rule add from all fwmark 0x1 lookup $VPN_USER<br>
> fi<br>
> # Launch routing script<br>
</span>> /etc/<a href="http://ipsec.route.sh" rel="noreferrer" target="_blank">ipsec.route.sh</a> <<a href="http://ipsec.route.sh" rel="noreferrer" target="_blank">http://ipsec.route.sh</a>><br>
<span class="gmail-">> ;;<br>
> down-client)<br>
> ip tunnel del "${VTI_INTERFACE}"<br>
> ;;<br>
> esac<br>
><br>
><br>
</span>> /etc/<a href="http://ipsec.route.sh" rel="noreferrer" target="_blank">ipsec.route.sh</a> <<a href="http://ipsec.route.sh" rel="noreferrer" target="_blank">http://ipsec.route.sh</a>><br>
<div class="gmail-HOEnZb"><div class="gmail-h5">><br>
> export TABLE_ID="vpn"<br>
> export VPN_USER="vpn"<br>
> export VTI_INTERFACE="vti0"<br>
> export LOCAL_IP="10.211.55.3"<br>
><br>
> # Flush iptables rules<br>
> iptables -F -t nat<br>
> iptables -F -t mangle<br>
> iptables -F -t filter<br>
> # Mark packets from $VPN_USER<br>
> iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark<br>
> iptables -t mangle -A OUTPUT ! --dest $LOCAL_IP -m owner --uid-owner $VPN_USER -j MARK --set-mark 0x1<br>
> iptables -t mangle -A OUTPUT ! --src $LOCAL_IP -j MARK --set-mark 0x1<br>
> iptables -t mangle -A OUTPUT -j CONNMARK --save-mark<br>
> # Deny $VPN_USER to access other interfaces than lo<br>
> # iptables -A OUTPUT ! -o lo -m owner --uid-owner $VPN_USER -j DROP<br>
> # Allow $VPN_USER to access lo and VPN interfaces<br>
> iptables -A OUTPUT -o lo -m owner --uid-owner $VPN_USER -j ACCEPT<br>
> iptables -A OUTPUT -o $VTI_INTERFACE -m owner --uid-owner $VPN_USER -j ACCEPT<br>
><br>
> # Allow response from $VPN_INTERFACE<br>
> iptables -A INPUT -i $VTI_INTERFACE -m conntrack --ctstate ESTABLISHED -j ACCEPT<br>
> # Masquarade packets on $VPN_INTERFACE<br>
> iptables -t nat -A POSTROUTING -o $VTI_INTERFACE -j MASQUERADE<br>
> # Routing rules<br>
> GATEWAY=$(ifconfig $VTI_INTERFACE |<br>
> egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' |<br>
> egrep -v '255|(127\.[0-9]{1,3}\.[0-9]{<wbr>1,3}\.[0-9]{1,3})' | tail -n1)<br>
> ip route replace default via $GATEWAY table $TABLE_ID<br>
> ip route append default via 127.0.0.1 dev lo table $TABLE_ID<br>
> ip route flush cache<br>
><br>
><br>
<br>
</div></div></blockquote></div><br></div></div></div>