<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Hello Noel,<div><br></div>You're right. It's interesting that I always get the following error right after that. "unable to install source route for %any".<br><br>Please find both the IPv4 and IPv6 routing tables as well as the ipsec.conf below.</div><div dir="ltr"><br></div><div>Please note that IPv6 is disabled since my configuration wasn't entirely supported on the latest Ubuntu 18.04 as we had established previously.</div><div dir="ltr"><br></div><div dir="ltr"><b>IPv4</b><br></div><div dir="ltr"><br></div><div dir="ltr"><div dir="ltr"><font face="courier new, monospace"># Generated by iptables-save v1.6.1 on Thu Jul 18 06:54:18 2019</font></div><div dir="ltr"><font face="courier new, monospace">*filter</font></div><div dir="ltr"><font face="courier new, monospace">:INPUT DROP [2615693:262169077]</font></div><div dir="ltr"><font face="courier new, monospace">:FORWARD DROP [4655474:1206379130]</font></div><div dir="ltr"><font face="courier new, monospace">:OUTPUT ACCEPT [8219816926:9451426041332]</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -i lo -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -p tcp -m tcp --dport 2022 -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -p udp -m udp --dport 500 -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -p udp -m udp --dport 4500 -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A FORWARD -s <a href="http://10.10.0.0/17">10.10.0.0/17</a> -d <a href="http://10.10.0.0/17">10.10.0.0/17</a> -j DROP</font></div><div dir="ltr"><font face="courier new, monospace">-A FORWARD -m policy --dir in --pol ipsec -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A FORWARD -m policy --dir out --pol ipsec -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">COMMIT</font></div><div dir="ltr"><font face="courier new, monospace"># Completed on Thu Jul 18 06:54:18 2019</font></div><div dir="ltr"><font face="courier new, monospace"># Generated by iptables-save v1.6.1 on Thu Jul 18 06:54:18 2019</font></div><div dir="ltr"><font face="courier new, monospace">*nat</font></div><div dir="ltr"><font face="courier new, monospace">:PREROUTING ACCEPT [212142454:17804580572]</font></div><div dir="ltr"><font face="courier new, monospace">:INPUT ACCEPT [1326262:431133155]</font></div><div dir="ltr"><font face="courier new, monospace">:OUTPUT ACCEPT [174309:20072403]</font></div><div dir="ltr"><font face="courier new, monospace">:POSTROUTING ACCEPT [174309:20072403]</font></div><div dir="ltr"><font face="courier new, monospace">-A POSTROUTING -s <a href="http://10.10.0.0/17">10.10.0.0/17</a> -o enp2s0 -m policy --dir out --pol ipsec -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A POSTROUTING -s <a href="http://10.10.0.0/17">10.10.0.0/17</a> -o enp2s0 -j MASQUERADE</font></div><div dir="ltr"><font face="courier new, monospace">COMMIT</font></div><div dir="ltr"><font face="courier new, monospace"># Completed on Thu Jul 18 06:54:18 2019</font></div><div dir="ltr"><font face="courier new, monospace"># Generated by iptables-save v1.6.1 on Thu Jul 18 06:54:18 2019</font></div><div dir="ltr"><font face="courier new, monospace">*mangle</font></div><div dir="ltr"><font face="courier new, monospace">:PREROUTING ACCEPT [78101233478:52605889723396]</font></div><div dir="ltr"><font face="courier new, monospace">:INPUT ACCEPT [28473561018:8872181346525]</font></div><div dir="ltr"><font face="courier new, monospace">:FORWARD ACCEPT [49618124462:43732105143957]</font></div><div dir="ltr"><font face="courier new, monospace">:OUTPUT ACCEPT [34893259071:40508743962892]</font></div><div dir="ltr"><font face="courier new, monospace">:POSTROUTING ACCEPT [84492095926:84235652892511]</font></div><div dir="ltr"><font face="courier new, monospace">-A FORWARD -s <a href="http://10.10.0.0/17">10.10.0.0/17</a> -o enp2s0 -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360</font></div><div dir="ltr"><font face="courier new, monospace">COMMIT</font></div><div dir="ltr"><font face="courier new, monospace"># Completed on Thu Jul 18 06:54:18 2019</font></div><div dir="ltr"><br></div><div><b>and IPv6</b></div></div><div dir="ltr"><br></div><div dir="ltr"><div dir="ltr"><font face="courier new, monospace"># Generated by ip6tables-save v1.6.1 on Thu Jul 18 06:55:55 2019</font></div><div dir="ltr"><font face="courier new, monospace">*filter</font></div><div dir="ltr"><font face="courier new, monospace">:INPUT DROP [53380:3843262]</font></div><div dir="ltr"><font face="courier new, monospace">:FORWARD DROP [0:0]</font></div><div dir="ltr"><font face="courier new, monospace">:OUTPUT ACCEPT [54922:3965190]</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -i lo -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -p tcp -m tcp --dport 2022 -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -p udp -m udp --dport 500 -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A INPUT -p udp -m udp --dport 4500 -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A FORWARD -s fdd2:54c4:4c90:1::/113 -d fdd2:54c4:4c90:1::/113 -j DROP</font></div><div dir="ltr"><font face="courier new, monospace">-A FORWARD -m policy --dir in --pol ipsec -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A FORWARD -m policy --dir out --pol ipsec -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">COMMIT</font></div><div dir="ltr"><font face="courier new, monospace"># Completed on Thu Jul 18 06:55:55 2019</font></div><div dir="ltr"><font face="courier new, monospace"># Generated by ip6tables-save v1.6.1 on Thu Jul 18 06:55:55 2019</font></div><div dir="ltr"><font face="courier new, monospace">*nat</font></div><div dir="ltr"><font face="courier new, monospace">:PREROUTING ACCEPT [16411485:1786456120]</font></div><div dir="ltr"><font face="courier new, monospace">:INPUT ACCEPT [2:392]</font></div><div dir="ltr"><font face="courier new, monospace">:OUTPUT ACCEPT [232:18788]</font></div><div dir="ltr"><font face="courier new, monospace">:POSTROUTING ACCEPT [232:18788]</font></div><div dir="ltr"><font face="courier new, monospace">-A POSTROUTING -s fdd2:54c4:4c90:1::/113 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT</font></div><div dir="ltr"><font face="courier new, monospace">-A POSTROUTING -s fdd2:54c4:4c90:1::/113 -o eth0 -j MASQUERADE</font></div><div dir="ltr"><font face="courier new, monospace">COMMIT</font></div><div dir="ltr"><font face="courier new, monospace"># Completed on Thu Jul 18 06:55:55 2019</font></div><div dir="ltr"><br></div><div><b>and ipsec.conf</b></div></div><div dir="ltr"><br></div><div dir="ltr"><div dir="ltr"><font face="courier new, monospace">config setup</font></div><div dir="ltr"><font face="courier new, monospace"> strictcrlpolicy=yes</font></div><div dir="ltr"><font face="courier new, monospace"> uniqueids=never</font></div><div dir="ltr"><font face="courier new, monospace">conn Falkenstein-2</font></div><div dir="ltr"><font face="courier new, monospace"> auto=add</font></div><div dir="ltr"><font face="courier new, monospace"> compress=no</font></div><div dir="ltr"><font face="courier new, monospace"> type=tunnel</font></div><div dir="ltr"><font face="courier new, monospace"> keyexchange=ikev2</font></div><div dir="ltr"><font face="courier new, monospace"> fragmentation=yes</font></div><div dir="ltr"><font face="courier new, monospace"> forceencaps=yes</font></div><div dir="ltr"><font face="courier new, monospace"> ike=aes256gcm16-aes192gcm16-aes128gcm16-prfsha256-ecp521-ecp256-modp4096-modp2048, aes256-sha256-ecp521-ecp256-modp4096-modp2048!</font></div><div dir="ltr"><font face="courier new, monospace"> esp=aes256gcm16-aes192gcm16-aes128gcm16-ecp521-ecp256-modp4096-modp2048, aes256-sha256-sha1-ecp521-ecp256-modp4096-modp2048, aes256-sha256-sha1!</font></div><div dir="ltr"><font face="courier new, monospace"> dpdaction=clear</font></div><div dir="ltr"><font face="courier new, monospace"> dpddelay=180s</font></div><div dir="ltr"><font face="courier new, monospace"> dpdtimeout=3600s</font></div><div dir="ltr"><font face="courier new, monospace"> rekey=no</font></div><div dir="ltr"><font face="courier new, monospace"> left=%any</font></div><div dir="ltr"><font face="courier new, monospace"> leftid=@<a href="http://de-fsn-2.xxxxx.net">de-fsn-2.xxxxx.net</a></font></div><div dir="ltr"><font face="courier new, monospace"> leftcert=cert.pem</font></div><div dir="ltr"><font face="courier new, monospace"> leftsendcert=always</font></div><div dir="ltr"><font face="courier new, monospace"> leftsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a>, ::/0</font></div><div dir="ltr"><font face="courier new, monospace"> right=%any</font></div><div dir="ltr"><font face="courier new, monospace"> rightid=%any</font></div><div dir="ltr"><font face="courier new, monospace"> rightauth=eap-radius</font></div><div dir="ltr"><font face="courier new, monospace"> eap_identity=%any</font></div><div dir="ltr"><font face="courier new, monospace"> rightdns=8.8.8.8,8.8.4.4</font></div><div dir="ltr"><font face="courier new, monospace"> rightsourceip=<a href="http://10.10.10.0/17,fdd2:54c4:4c90:1::300/113">10.10.10.0/17,fdd2:54c4:4c90:1::300/113</a></font></div><div dir="ltr"><font face="courier new, monospace"> leftfirewall=no</font></div></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div>Many Thanks,</div><div>Houman</div></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, 18 Jul 2019 at 07:42, Noel Kuntze <noel.kuntze@thermi.consulting> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Hello Houman,<br>
<br>
That happens when the main routing table (Or other tables in newer kernels) does not have any routes that allow the new route to be installed (next hop is not reachable over a local interface).<br>
For the exact reason, you'd need to at least provide the IPv6 routing tables.<br>
<br>
Kind regards<br>
<br>
Noel<br>
<br>
Am 18.07.19 um 00:47 schrieb Houman:<br>
> Hello,<br>
><br>
> I'm getting this error in the syslog.<br>
><br>
> It still connects but I keep getting this error sometimes:<br>
> *charon: 15[KNL] received netlink error: Network is unreachable (101)*<br>
><br>
> Why is that?<br>
><br>
> *Syslog:*<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[CFG] reassigning offline lease to 'c8c09c88-8a67-4af6-8620-xxxxxx'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[IKE] assigning virtual IP 10.10.55.127 to peer 'c8c09c88-8a67-4af6-8620-xxxxxx'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[IKE] peer requested virtual IP %any6<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[CFG] reassigning offline lease to 'c8c09c88-8a67-4af6-8620-xxxxxx'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[IKE] assigning virtual IP fdd2:54c4:4c90:1::307f to peer 'c8c09c88-8a67-4af6-8620-xxxxxx'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[KNL] received netlink error: Network is unreachable (101)<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[KNL] unable to install source route for %any<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[IKE] CHILD_SA Falkenstein-2{455771} established with SPIs c6b5caac_i 0c8a8cdf_o and TS <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">http://0.0.0.0/0</a>> ::/0 === <a href="http://10.10.55.127/32" rel="noreferrer" target="_blank">10.10.55.127/32</a> <<a href="http://10.10.55.127/32" rel="noreferrer" target="_blank">http://10.10.55.127/32</a>> fdd2:54c4:4c90:1::307f/128<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[CFG] sending RADIUS Accounting-Request to server 'server-a'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[NET] received packet: from 109.177.xx.xxx[4500] to 136.243.xxx.xxx[4500] (112 bytes)<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[CFG] received RADIUS Accounting-Response from server 'server-a'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[ENC] generating IKE_AUTH response 6 [ AUTH CPRP(ADDR ADDR6 DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) ]<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[ENC] parsed IKE_AUTH request 6 [ AUTH ]<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 09[NET] sending packet: from 136.243.xxx.xxx[4500] to 86.97.xx.xxx[4500] (368 bytes)<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] authentication of 'VPN' with EAP successful<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] authentication of '<a href="http://de-fsn-2.xxxxx.net" rel="noreferrer" target="_blank">de-fsn-2.xxxxx.net</a> <<a href="http://de-fsn-2.xxxxx.net" rel="noreferrer" target="_blank">http://de-fsn-2.xxxxx.net</a>>' (myself) with EAP<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] IKE_SA Falkenstein-2[549905] established between 136.243.xxx.xxx[<a href="http://de-fsn-2.xxxxx.net" rel="noreferrer" target="_blank">de-fsn-2.xxxxx.net</a> <<a href="http://de-fsn-2.xxxxx.net" rel="noreferrer" target="_blank">http://de-fsn-2.xxxxx.net</a>>]...109.177.xx.xxx[VPN]<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] peer requested virtual IP %any<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[CFG] reassigning offline lease to 'b05ccf72-7bad-425e-95e0-xxxxx'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] assigning virtual IP 10.10.50.102 to peer 'b05ccf72-7bad-425e-95e0-xxxxx'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] peer requested virtual IP %any6<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[CFG] reassigning offline lease to 'b05ccf72-7bad-425e-95e0-xxxxx'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] assigning virtual IP fdd2:54c4:4c90:1::2b66 to peer 'b05ccf72-7bad-425e-95e0-xxxxx'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[KNL] received netlink error: Network is unreachable (101)<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[KNL] unable to install source route for %any<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] CHILD_SA Falkenstein-2{455772} established with SPIs c23f2271_i 07d2a903_o and TS <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">http://0.0.0.0/0</a>> ::/0 === <a href="http://10.10.50.102/32" rel="noreferrer" target="_blank">10.10.50.102/32</a> <<a href="http://10.10.50.102/32" rel="noreferrer" target="_blank">http://10.10.50.102/32</a>> fdd2:54c4:4c90:1::2b66/128<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[CFG] sending RADIUS Accounting-Request to server 'server-a'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 13[NET] received packet: from 94.206.xxx.xxx[4500] to 136.243.xxx.xxx[4500] (368 bytes)<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[CFG] received RADIUS Accounting-Response from server 'server-a'<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[ENC] generating IKE_AUTH response 6 [ AUTH CPRP(ADDR ADDR6 DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) ]<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 13[ENC] unknown attribute type (25)<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 13[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 DNS6 (25)) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(EAP_ONLY) ]<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 15[NET] sending packet: from 136.243.xxx.xxx[4500] to 109.177.xx.xxx[4500] (368 bytes)<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 13[CFG] looking for peer configs matching 136.243.xxx.xxx[<a href="http://de-fsn-2.xxxxx.net" rel="noreferrer" target="_blank">de-fsn-2.xxxxx.net</a> <<a href="http://de-fsn-2.xxxxx.net" rel="noreferrer" target="_blank">http://de-fsn-2.xxxxx.net</a>>]...94.206.xxx.xxx[VPN]<br>
><br>
> Jul 17 21:31:08 de-fsn-2 charon: 13[CFG] selected peer config 'Falkenstein-2'<br>
><br>
><br>
> Many Thanks,<br>
><br>
> Houman<br>
><br>
<br>
-- <br>
Noel Kuntze<br>
IT security consultant<br>
<br>
GPG Key ID: 0x0739AD6C<br>
Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C<br>
<br>
<br>
</blockquote></div>