<div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr">Den sön 11 nov. 2018 kl 10:10 skrev Gilles Printemps <<a href="mailto:gprintemps@gmail.com">gprintemps@gmail.com</a>>:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Hi,<div>Several months ago, I tried to setup Strongswan as client for a connection to a VPN server using VTI without any success (unlike with OpenVPN). I'm now restarting again this task from the beginning in order to use only Strongswan as client and server.</div><div><br></div><div>My first questions are related to the keyword "mark". What's the behaviour of Strongswan if the conn mark plugin is enabled, but the is not set to transport?</div><div><br></div><div>Is it normal that the flag is only set in one way?</div><div>Thanks for help...</div><div><br></div><div>result of sudo ip xfrm state:</div><div><div><font size="1">src 10.211.55.26 dst 46.166.179.50</font></div><div><font size="1"> proto esp spi 0xce5f4fa3 reqid 1 mode tunnel</font></div><div><font size="1"> replay-window 0 flag af-unspec</font></div><div><font size="1"> mark 0x2/0xffffffff</font></div><div><font size="1"> auth-trunc hmac(sha512) 0x935928d1affa6c98af5f81d2aba45614cb6ee966bcb75fe51eb1f8110886fd7315ea9ac1c6b621e1deb20ee81b08b23a63870085364e6ad8c29f3d1fcdc79abf 256</font></div><div><font size="1"> enc cbc(aes) 0xac8aa7382eb1278c2e5cdaf04ca1850716859ed23e3bed87f410d78013d76949</font></div><div><font size="1"> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</font></div><div><font size="1"> anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</font></div><div><font size="1">src 46.166.179.50 dst 10.211.55.26</font></div><div><font size="1"> proto esp spi 0xc592d4be reqid 1 mode tunnel</font></div><div><font size="1"> replay-window 32 flag af-unspec</font></div><div><font size="1"> auth-trunc hmac(sha512) 0x117520099367715a781b88662055f1151b5b4ffb319b6d5d986c442f1fadcc7f93a83a54324ba4c01b13101440464adc159b44e4c32968aa7480763503ad1a2f 256</font></div><div><font size="1"> enc cbc(aes) 0x6eeb81a67c539685af3216523615a940aa756b76ffbd57434a573d3ac838b3e4</font></div><div><font size="1"> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</font></div><div><font size="1"> anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</font></div></div><div><br></div><div>etc/ipsec.conf</div><div><div><font size="1">config setup</font></div><div><font size="1"> charondebug="ike 2, knl 3, cfg 0"</font></div><div><font size="1"><br></font></div><div><font size="1">conn VPNInterface</font></div><div><font size="1"> mark=2</font></div><div><font size="1"> keyexchange=ike</font></div><div><font size="1"> dpdaction=clear</font></div><div><font size="1"> dpddelay=300s</font></div><div><font size="1"> eap_identity=<username></font></div><div><font size="1"> leftupdown=/etc/<a href="http://ipsec.vti.sh" target="_blank">ipsec.vti.sh</a></font></div><div><font size="1"> leftauth=eap-mschapv2</font></div><div><font size="1"> left=%defaultroute</font></div><div><font size="1"> leftsourceip=%config</font></div><div><font size="1"> right=<VPN server name></font></div><div><font size="1"> rightauth=pubkey</font></div><div><font size="1"> rightsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></font></div><div><font size="1"> rightid=%any</font></div><div><font size="1"> auto=add</font></div></div><div><br></div><div>/etc/<a href="http://ipsec.vti.sh" target="_blank">ipsec.vti.sh</a></div><div><div><font size="1">#!/bin/bash</font></div><div><font size="1"><br></font></div><div><font size="1">set -o nounset</font></div><div><font size="1">set -o errexit</font></div><div><font size="1"><br></font></div><div><font size="1">STD_IF="enp0s5"</font></div><div><font size="1">VTI_IF="vpn${PLUTO_UNIQUEID}"</font></div><div><font size="1"><br></font></div><div><font size="1">case "${PLUTO_VERB}" in</font></div><div><font size="1"> up-client)</font></div><div><font size="1"> ip tunnel add "${VTI_IF}" local "${PLUTO_ME}" remote "${PLUTO_PEER}" mode vti \</font></div><div><font size="1"> okey "${PLUTO_MARK_OUT%%/*}" ikey "${PLUTO_MARK_IN%%/*}"</font></div><div><font size="1"> ip addr add "${PLUTO_MY_SOURCEIP}" dev "${VTI_IF}"</font></div><div><font size="1"> sysctl -w "net.ipv4.conf.${VTI_IF}.disable_policy=1"</font></div><div><font size="1"> ip link set "${VTI_IF}" up</font></div><div><br></div><div><font size="1"> sysctl -w "net.ipv4.conf.all.rp_filter=2"</font></div><div><font size="1"> sysctl -w "net.ipv4.conf.default.rp_filter=2"</font></div><div><font size="1"> sysctl -w "net.ipv4.conf.${STD_IF}.rp_filter=2"</font></div><div><font size="1"> ;;</font></div><div><font size="1"> down-client)</font></div><div><font size="1"> ip tunnel del "${VTI_IF}"</font></div><div><font size="1"> ;;</font></div><div><font size="1">esac</font></div></div><div><br></div><div>Extract after starting the interface...</div><div><div><font size="1">sending packet: from 10.211.55.26[4500] to 46.166.179.50[4500] (160 bytes)</font></div><div><font size="1">received packet: from 46.166.179.50[4500] to 10.211.55.26[4500] (336 bytes)</font></div><div><font size="1">parsed IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS DNS) SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) ]</font></div><div><font size="1">authentication of 'C=MY, ST=Wilayah Persekutuan, L=Labuan, O=eVenture Limited, CN=*.<a href="http://hide.me" target="_blank">hide.me</a>' with EAP successful</font></div><div><font size="1">IKE_SA VPNInterface[1] established between 10.211.55.26[10.211.55.26]...46.166.179.50[C=MY, ST=Wilayah Persekutuan, L=Labuan, O=eVenture Limited, CN=*.<a href="http://hide.me" target="_blank">hide.me</a>]</font></div><div><font size="1">scheduling reauthentication in 9773s</font></div><div><font size="1">maximum IKE_SA lifetime 10313s</font></div><div><font size="1">installing DNS server 46.166.179.49 via resolvconf</font></div><div><font size="1">installing DNS server 46.166.179.51 via resolvconf</font></div><div><font size="1">installing new virtual IP 10.3.142.180</font></div><div><font size="1">selected proposal: ESP:AES_CBC_256/HMAC_SHA2_512_256/NO_EXT_SEQ</font></div><div><font size="1">CHILD_SA VPNInterface{1} established with SPIs c592d4be_i ce5f4fa3_o and TS <a href="http://10.3.142.180/32" target="_blank">10.3.142.180/32</a> === <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></font></div><div><font size="1">updown: net.ipv4.conf.vpn1.disable_policy = 1</font></div><div><font size="1">updown: net.ipv4.conf.all.rp_filter = 2</font></div><div><font size="1">updown: net.ipv4.conf.default.rp_filter = 2</font></div><div><font size="1">updown: net.ipv4.conf.enp0s5.rp_filter = 2</font></div><div><font size="1">received AUTH_LIFETIME of 86400s, reauthentication already scheduled in 9773s</font></div><div><font size="1">peer supports MOBIKE</font></div><div><font size="1">connection 'VPNInterface' established successfully</font></div></div><div><br></div></div></div></div></div></div></div>
</blockquote></div></div>