<html><head></head><body>Hello Lew,<br><br>How exactly are you testing the tunnel?<br>Also, please provide the output of iptables-save.<br><br>Kind regards<br>Noel<br><br><div class="gmail_quote">Am July 5, 2021 7:28:19 AM UTC schrieb Lewis Shobbrook <l.shobbrook@base2services.com>:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Hi Guys,<br>I have an IKEv2 tunnel that is established and up, but I am unable to<br>route any packets across it.<br>All ACL's are configured to allow UDP 500,4500 & protocols 50, 51 &<br>icmp to/from the non aws end.<br>Local iptables are permissive with default policys ACCEPT<br>Security groups also allow anything outbound and the above ports &<br>protos inbound.<br>Here are a few particulars typically requested ahead of time.<br>ip_forward is enabled rp_filter disabled as follows...<br>net.ipv4.ip_forward = 1<br>net.ipv4.conf.all.send_redirects = 0<br>net.ipv4.conf.default.send_redirects = 0<br>net.ipv4.tcp_max_syn_backlog = 1280<br>net.ipv4.icmp_echo_ignore_broadcasts = 1<br>net.ipv4.conf.all.accept_source_route = 0<br>net.ipv4.conf.all.accept_redirects = 0<br>net.ipv4.conf.all.secure_redirects = 0<br>net.ipv4.conf.all.log_martians = 1<br>net.ipv4.conf.default.accept_source_route = 0<br>net.ipv4.conf.default.accept_redirects = 0<br>net.ipv4.conf.default.secure_redirects = 0<br>net.ipv4.icmp_echo_ignore_broadcasts = 1<br>net.ipv4.icmp_ignore_bogus_error_responses = 1<br>net.ipv4.tcp_syncookies = 1<br>net.ipv4.conf.all.rp_filter = 0<br>net.ipv4.conf.default.rp_filter = 0<br>net.ipv4.tcp_mtu_probing = 1<br><br>tcpdump just shows one way requests<br>Looking at the 220 rt table I can see that the auto added route<br>appears to be correct, and the xfrm policy nothing obvious to me, with<br>no xfrm vi's used.<br>Obfuscated ip's naturally...<br>ip r li ta 220<br>198.168.248.0/29 via 48.138.201.65 dev eth0 proto static src 48.138.201.70<br>ip xfrm policy<br>src 48.138.201.64/26 dst 198.168.248.0/29<br> dir out priority 371839 ptype main<br> tmpl src 48.138.201.70 dst 68.169.15.170<br> proto esp spi 0x2c1e849e reqid 1 mode tunnel<br>src 198.168.248.0/29 dst 48.138.201.64/26<br> dir fwd priority 371839 ptype main<br> tmpl src 68.148.15.170 dst 48.138.201.70<br> proto esp reqid 1 mode tunnel<br>src 198.168.248.0/29 dst 48.138.201.64/26<br> dir in priority 371839 ptype main<br> tmpl src 68.148.15.170 dst 48.138.201.70<br> proto esp reqid 1 mode tunnel<br>src 0.0.0.0/0 dst 0.0.0.0/0<br> socket in priority 0 ptype main<br>src 0.0.0.0/0 dst 0.0.0.0/0<br> socket out priority 0 ptype main<br>src 0.0.0.0/0 dst 0.0.0.0/0<br> socket in priority 0 ptype main<br>src 0.0.0.0/0 dst 0.0.0.0/0<br> socket out priority 0 ptype main<br>src ::/0 dst ::/0<br> socket in priority 0 ptype main<br>src ::/0 dst ::/0<br> socket out priority 0 ptype main<br>src ::/0 dst ::/0<br> socket in priority 0 ptype main<br>src ::/0 dst ::/0<br> socket out priority 0 ptype main<br>src 198.168.248.0/29 dst 48.138.201.64/26<br> dir fwd priority 371840 ptype main<br> tmpl src 68.148.15.170 dst 48.138.201.70<br> proto esp reqid 2 mode tunnel<br>src 198.168.248.0/29 dst 48.138.201.64/26<br> dir in priority 371840 ptype main<br> tmpl src 68.148.15.170 dst 48.138.201.70<br> proto esp reqid 2 mode tunnel<br>src 48.138.201.64/26 dst 198.168.248.0/29<br> dir out priority 371840 ptype main<br> tmpl src 48.138.201.70 dst 68.169.15.170<br> proto esp reqid 2 mode tunnel<br><br>ipsec statusall<br>Status of IKE charon daemon (strongSwan 5.7.2, Linux<br>4.14.232-177.418.amzn2.x86_64, x86_64):<br> uptime: 54 minutes, since Jul 05 06:10:30 2021<br> malloc: sbrk 2846720, mmap 0, used 1023696, free 1823024<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0,<br>scheduled: 1<br> loaded plugins: charon pkcs11 tpm aesni aes des rc2 sha2 sha1 md4<br>md5 mgf1 random nonce x509 revocation constraints acert pubkey pkcs1<br>pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt fips-prf gmp<br>curve25519 chapoly xcbc cmac hmac ctr ccm gcm curl attr kernel-netlink<br>resolve socket-default farp stroke vici updown eap-identity eap-sim<br>eap-aka eap-aka-3gpp eap-aka-3gpp2 eap-md5 eap-gtc eap-mschapv2<br>eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic<br>xauth-eap xauth-pam xauth-noauth dhcp led duplicheck unity counters<br>Listening IP addresses:<br> 48.138.201.70<br>Connections:<br>tunnel1: %any...68.148.15.170 IKEv2<br>tunnel1: local: uses pre-shared key authentication<br>tunnel1: remote: uses pre-shared key authentication<br>tunnel1: child: 48.138.201.64/26 === 198.168.248.0/29 TUNNEL<br>Security Associations (1 up, 0 connecting):<br>tunnel1[2]: ESTABLISHED 24 minutes ago,<br>48.138.201.70[48.138.201.70]...65.169.15.170[65.169.15.170]<br>tunnel1[2]: IKEv2 SPIs: d3e732eb14d78aec_i* b06860d1ceee2f9a_r,<br>rekeying disabled<br>tunnel1[2]: IKE proposal: AES_GCM_16_256/PRF_HMAC_SHA2_384/ECP_384<br>tunnel1{2}: INSTALLED, TUNNEL, reqid 2, ESP in UDP SPIs: cb651f89_i 479cff91_o<br>tunnel1{2}: AES_GCM_16_256, 0 bytes_i, 0 bytes_o, rekeying disabled<br>tunnel1{2}: 48.138.201.64/26 === 198.168.248.0/30<br><br>VPC flow logs show no proto 50, only 4500 & 500.<br>I've also tried to clamp mss not that I expect it would have changed 0<br>throughput<br>iptables -t mangle -A FORWARD -m policy --pol ipsec --dir in -p tcp -m<br>tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS<br>--set-mss 1360<br><br>I've spent hours searching but have not found anything to help.<br>Hoping someone here may have a suggestion ot two?<br>Cheers,<br><br>Lew<br></pre></blockquote></div><br>Sent from mobile</body></html>