<div dir="ltr">I see the following while performing a ping from 172.31.255.138 -> 192.168.11.2<div><br></div><div># tcpdump -nnn udp and port 4500<br>tcpdump: verbose output suppressed, use -v or -vv for full protocol decode<br>listening on ens5, link-type EN10MB (Ethernet), capture size 262144 bytes<br>17:39:32.013973 IP 172.31.255.19.4500 > 112.199.95.138.4500: isakmp-nat-keep-alive<br>17:39:38.181171 IP 172.31.255.19.4500 > 112.199.95.138.4500: NONESP-encap: isakmp: child_sa inf2[I]<br>17:39:38.371873 IP 112.199.95.138.4500 > 172.31.255.19.4500: NONESP-encap: isakmp: child_sa inf2[R]<br>17:40:02.014470 IP 172.31.255.19.4500 > 112.199.95.138.4500: isakmp-nat-keep-alive<br>17:40:08.181036 IP 172.31.255.19.4500 > 112.199.95.138.4500: NONESP-encap: isakmp: child_sa inf2[I]<br>17:40:08.381724 IP 112.199.95.138.4500 > 172.31.255.19.4500: NONESP-encap: isakmp: child_sa inf2[R]<br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Sep 20, 2019 at 5:16 AM Noel Kuntze <noel.kuntze+strongswan-users-ml@thermi.consulting> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">> office-netcube{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c319f8bf_i ce60b044_o<br>
<br>
Use `tcpdump -n udp and port 4500`<br>
<br>
Am 19.09.19 um 22:53 schrieb Doug Bell:<br>
> I have created an AWS instance running StrongSwan on Ubuntu to facilitate an IPSec tunnel back to an OPNSense firewall.<br>
> <br>
> AWS StrongSwan:<br>
> Internal IP: 172.31.255.19<br>
> External IP: 54.149.10.176<br>
> Internal Network: <a href="http://172.31.255.0/24" rel="noreferrer" target="_blank">172.31.255.0/24</a> <<a href="http://172.31.255.0/24" rel="noreferrer" target="_blank">http://172.31.255.0/24</a>><br>
> (I am also trying to use / route another AWS subnet of <a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">172.31.32.0/20</a> <<a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">http://172.31.32.0/20</a>>)<br>
> <br>
> OPNsense firewall:<br>
> External IP: 112.199.95.138<br>
> Internal Network: <a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">192.168.11.0/24</a> <<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">http://192.168.11.0/24</a>><br>
> <br>
> I can get the tunnel to come up in what appears to be a correct fashion, but I cannot get any pings to go across the tunnel, regardless of source or destination. From another machine on the same subnet I added a proper route and security group and I was able to see the ICMP echo requests come in on the VPN gateway, but looking at 'tcpdump esp' the traffic does not appear to be going over the tunnel..<br>
> <br>
> 20:32:14.436042 IP 172.31.255.138 > 192.168.11.221 <<a href="http://192.168.11.221" rel="noreferrer" target="_blank">http://192.168.11.221</a>>: ICMP echo request, id 26635, seq 1, length 64<br>
> 20:32:14.436077 IP 172.31.255.138 > 192.168.11.221 <<a href="http://192.168.11.221" rel="noreferrer" target="_blank">http://192.168.11.221</a>>: ICMP echo request, id 26635, seq 1, length 64<br>
> 20:32:15.449498 IP 172.31.255.138 > 192.168.11.221 <<a href="http://192.168.11.221" rel="noreferrer" target="_blank">http://192.168.11.221</a>>: ICMP echo request, id 26635, seq 2, length 64<br>
> <br>
> I am not running any IP masquerading as I need the hosts on the different endpoints able to recognize the proper source IPs.<br>
> <br>
> Thank you for your assistance.<br>
> <br>
> <br>
> Here are some diagnostics:<br>
> <br>
> --ipsec.conf--<br>
> config setup<br>
> # strictcrlpolicy=yes<br>
> # uniqueids = no<br>
> #charonstart=yes<br>
> <br>
> # Add connections here.<br>
> conn sts-base<br>
> fragmentation=yes<br>
> dpdaction=restart<br>
> keyingtries=%forever<br>
> leftid=172.31.255.19<br>
> leftsubnet=<a href="http://172.31.255.0/32,172.31.32.0/20" rel="noreferrer" target="_blank">172.31.255.0/32,172.31.32.0/20</a> <<a href="http://172.31.255.0/32,172.31.32.0/20" rel="noreferrer" target="_blank">http://172.31.255.0/32,172.31.32.0/20</a>><br>
> leftauth=psk<br>
> rightauth=psk<br>
> <br>
> conn office-netcube<br>
> also=sts-base<br>
> mobike=no<br>
> keyexchange=ikev2<br>
> ike=aes128-sha256-modp3072<br>
> esp=aes128-sha256-modp3072<br>
> right=112.199.95.138<br>
> rightsubnet=<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">192.168.11.0/24</a> <<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">http://192.168.11.0/24</a>><br>
> installpolicy=yes<br>
> type=tunnel<br>
> auto=start<br>
> --end configuration--<br>
> <br>
> <br>
> # ipsec statusall<br>
> Status of IKE charon daemon (strongSwan 5.6.2, Linux 4.15.0-1050-aws, x86_64):<br>
> uptime: 2 minutes, since Sep 19 19:44:35 2019<br>
> malloc: sbrk 2568192, mmap 0, used 643504, free 1924688<br>
> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 4<br>
> loaded plugins: charon aesni aes rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters<br>
> Listening IP addresses:<br>
> 172.31.255.19<br>
> Connections:<br>
> office-netcube: %any...112.199.95.138 IKEv2, dpddelay=30s<br>
> office-netcube: local: [172.31.255.19] uses pre-shared key authentication<br>
> office-netcube: remote: [112.199.95.138] uses pre-shared key authentication<br>
> office-netcube: child: <a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">172.31.255.0/32</a> <<a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">http://172.31.255.0/32</a>> <a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">172.31.32.0/20</a> <<a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">http://172.31.32.0/20</a>> === <a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">192.168.11.0/24</a> <<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">http://192.168.11.0/24</a>> TUNNEL, dpdaction=restart<br>
> Routed Connections:<br>
> office-netcube{2}: ROUTED, TUNNEL, reqid 1<br>
> office-netcube{2}: <a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">172.31.32.0/20</a> <<a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">http://172.31.32.0/20</a>> <a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">172.31.255.0/32</a> <<a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">http://172.31.255.0/32</a>> === <a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">192.168.11.0/24</a> <<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">http://192.168.11.0/24</a>><br>
> Security Associations (1 up, 0 connecting):<br>
> office-netcube[1]: ESTABLISHED 2 minutes ago, 172.31.255.19[172.31.255.19]...112.199.95.138[112.199.95.138]<br>
> office-netcube[1]: IKEv2 SPIs: c2c2cd729e85a9f2_i* 92478c72f25bd4a8_r, pre-shared key reauthentication in 2 hours<br>
> office-netcube[1]: IKE proposal: AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072<br>
> office-netcube{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c319f8bf_i ce60b044_o<br>
> office-netcube{1}: AES_CBC_256/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 40 minutes<br>
> office-netcube{1}: <a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">172.31.32.0/20</a> <<a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">http://172.31.32.0/20</a>> <a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">172.31.255.0/32</a> <<a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">http://172.31.255.0/32</a>> === <a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">192.168.11.0/24</a> <<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">http://192.168.11.0/24</a>><br>
> <br>
> # ip addr list<br>
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000<br>
> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00<br>
> inet <a href="http://127.0.0.1/8" rel="noreferrer" target="_blank">127.0.0.1/8</a> <<a href="http://127.0.0.1/8" rel="noreferrer" target="_blank">http://127.0.0.1/8</a>> scope host lo<br>
> valid_lft forever preferred_lft forever<br>
> inet6 ::1/128 scope host<br>
> valid_lft forever preferred_lft forever<br>
> 2: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000<br>
> link/ether 06:07:f8:50:8b:96 brd ff:ff:ff:ff:ff:ff<br>
> inet <a href="http://172.31.255.19/24" rel="noreferrer" target="_blank">172.31.255.19/24</a> <<a href="http://172.31.255.19/24" rel="noreferrer" target="_blank">http://172.31.255.19/24</a>> brd 172.31.255.255 scope global dynamic ens5<br>
> valid_lft 3340sec preferred_lft 3340sec<br>
> inet6 fe80::407:f8ff:fe50:8b96/64 scope link<br>
> valid_lft forever preferred_lft forever<br>
> <br>
> # ip route show table all<br>
> default via 172.31.255.1 dev ens5 proto dhcp src 172.31.255.19 metric 100<br>
> <a href="http://172.31.255.0/24" rel="noreferrer" target="_blank">172.31.255.0/24</a> <<a href="http://172.31.255.0/24" rel="noreferrer" target="_blank">http://172.31.255.0/24</a>> dev ens5 proto kernel scope link src 172.31.255.19<br>
> 172.31.255.1 dev ens5 proto dhcp scope link src 172.31.255.19 metric 100<br>
> broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1<br>
> local <a href="http://127.0.0.0/8" rel="noreferrer" target="_blank">127.0.0.0/8</a> <<a href="http://127.0.0.0/8" rel="noreferrer" target="_blank">http://127.0.0.0/8</a>> dev lo table local proto kernel scope host src 127.0.0.1<br>
> local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1<br>
> broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1<br>
> broadcast 172.31.255.0 dev ens5 table local proto kernel scope link src 172.31.255.19<br>
> local 172.31.255.19 dev ens5 table local proto kernel scope host src 172.31.255.19<br>
> broadcast 172.31.255.255 dev ens5 table local proto kernel scope link src 172.31.255.19<br>
> local ::1 dev lo proto kernel metric 256 pref medium<br>
> fe80::/64 dev ens5 proto kernel metric 256 pref medium<br>
> local ::1 dev lo table local proto kernel metric 0 pref medium<br>
> local fe80::407:f8ff:fe50:8b96 dev ens5 table local proto kernel metric 0 pref medium<br>
> ff00::/8 dev ens5 table local metric 256 pref medium<br>
> <br>
> # ip xfrm policy show<br>
> src <a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">172.31.255.0/32</a> <<a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">http://172.31.255.0/32</a>> dst <a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">192.168.11.0/24</a> <<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">http://192.168.11.0/24</a>><br>
> dir out priority 371327<br>
> tmpl src 172.31.255.19 dst 112.199.95.138<br>
> proto esp spi 0xce60b044 reqid 1 mode tunnel<br>
> src <a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">192.168.11.0/24</a> <<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">http://192.168.11.0/24</a>> dst <a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">172.31.255.0/32</a> <<a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">http://172.31.255.0/32</a>><br>
> dir fwd priority 371327<br>
> tmpl src 112.199.95.138 dst 172.31.255.19<br>
> proto esp reqid 1 mode tunnel<br>
> src <a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">192.168.11.0/24</a> <<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">http://192.168.11.0/24</a>> dst <a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">172.31.255.0/32</a> <<a href="http://172.31.255.0/32" rel="noreferrer" target="_blank">http://172.31.255.0/32</a>><br>
> dir in priority 371327<br>
> tmpl src 112.199.95.138 dst 172.31.255.19<br>
> proto esp reqid 1 mode tunnel<br>
> src <a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">172.31.32.0/20</a> <<a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">http://172.31.32.0/20</a>> dst <a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">192.168.11.0/24</a> <<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">http://192.168.11.0/24</a>><br>
> dir out priority 377471<br>
> tmpl src 172.31.255.19 dst 112.199.95.138<br>
> proto esp spi 0xce60b044 reqid 1 mode tunnel<br>
> src <a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">192.168.11.0/24</a> <<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">http://192.168.11.0/24</a>> dst <a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">172.31.32.0/20</a> <<a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">http://172.31.32.0/20</a>><br>
> dir fwd priority 377471<br>
> tmpl src 112.199.95.138 dst 172.31.255.19<br>
> proto esp reqid 1 mode tunnel<br>
> src <a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">192.168.11.0/24</a> <<a href="http://192.168.11.0/24" rel="noreferrer" target="_blank">http://192.168.11.0/24</a>> dst <a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">172.31.32.0/20</a> <<a href="http://172.31.32.0/20" rel="noreferrer" target="_blank">http://172.31.32.0/20</a>><br>
> dir in priority 377471<br>
> tmpl src 112.199.95.138 dst 172.31.255.19<br>
> proto esp reqid 1 mode tunnel<br>
> src <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">http://0.0.0.0/0</a>><br>
> socket in priority 0<br>
> src <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">http://0.0.0.0/0</a>><br>
> socket out priority 0<br>
> src <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">http://0.0.0.0/0</a>><br>
> socket in priority 0<br>
> src <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">http://0.0.0.0/0</a>> dst <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">http://0.0.0.0/0</a>><br>
> socket out priority 0<br>
> src ::/0 dst ::/0<br>
> socket in priority 0<br>
> src ::/0 dst ::/0<br>
> socket out priority 0<br>
> src ::/0 dst ::/0<br>
> socket in priority 0<br>
> src ::/0 dst ::/0<br>
> socket out priority 0<br>
> <br>
> # iptables-save<br>
> # Generated by iptables-save v1.6.1 on Thu Sep 19 20:44:46 2019<br>
> *filter<br>
> :INPUT ACCEPT [2151:364680]<br>
> :FORWARD ACCEPT [24:2016]<br>
> :OUTPUT ACCEPT [2132:344479]<br>
> COMMIT<br>
> # Completed on Thu Sep 19 20:44:46 2019<br>
> <br>
> # ip rule<br>
> 0: from all lookup local<br>
> 220: from all lookup 220<br>
> 32766: from all lookup main<br>
> 32767: from all lookup default<br>
> <br>
> # egrep -v "(^$|#)" /etc/sysctl.conf<br>
> net.ipv4.ip_forward=1<br>
> net.ipv4.conf.all.accept_redirects = 0<br>
> net.ipv4.conf.all.secure_redirects = 0<br>
> net.ipv4.conf.default.accept_redirects = 0<br>
> net.ipv4.conf.default.secure_redirects = 0<br>
> net.ipv4.conf.all.send_redirects = 0<br>
> net.ipv4.conf.default.send_redirects = 0<br>
> net.ipv4.conf.ens5.send_redirects = 0<br>
> net.ipv4.conf.all.accept_source_route = 0<br>
> net.ipv4.conf.all.log_martians = 1<br>
> net.ipv4.icmp_echo_ignore_broadcasts = 1<br>
> net.ipv4.conf.default.accept_source_route = 0<br>
> net.ipv4.icmp_ignore_bogus_error_responses = 1<br>
> net.ipv4.tcp_syncookies = 1<br>
> net.ipv4.conf.all.rp_filter = 1<br>
> net.ipv4.conf.default.rp_filter = 1<br>
> net.ipv4.tcp_mtu_probing = 1<br>
> <br>
> -- <br>
> Doug Bell<br>
<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr">Doug Bell</div></div></div></div>