[strongSwan] Migration from Openswan to Strongswan

Pavel Arnošt pavel.arnost at valvera.cz
Tue May 10 13:19:55 CEST 2011


Hi, thanks, I managed to get similar system with the same software versions 
but simplier setup where I can test it at will. At the beginning, I have 
Openswan:

/etc/ipsec.conf:

version 2.0

config setup
   plutodebug="parsing"

conn %default
   authby=secret

conn CONN
   type=tunnel
   left=A.A.A.A
   leftsubnet=172.24.26.64/26
   right=B.B.B.B
   rightsubnet=172.27.96.15/32
   auto=start
   auth=esp
   keylife=3600s
   ikelifetime=1440m
   compress=no
   ike=aes256-sha1,aes128-md5
   esp=aes256-sha1,aes128-md5
   pfs=yes

# ping -I 172.24.26.65 172.27.96.15
PING 172.27.96.15 (172.27.96.15) from 172.24.26.65 : 56(84) bytes of data.
64 bytes from 172.27.96.15: icmp_seq=1 ttl=123 time=6.32 ms
64 bytes from 172.27.96.15: icmp_seq=2 ttl=123 time=5.69 ms
64 bytes from 172.27.96.15: icmp_seq=3 ttl=123 time=5.58 ms

Then I uninstall Openswan and install Strongswan:

/etc/ipsec.conf:

version 2.0

config setup
   plutodebug="parsing"
   charonstart=no

conn %default
   keyexchange=ikev1
   authby=secret
   leftfirewall=yes
   lefthostaccess=yes

conn CONN
   type=tunnel
   left=A.A.A.A
   leftsubnet=172.24.26.64/26
   right=B.B.B.B
   rightsubnet=172.27.96.15/32
   auto=start
   auth=esp
   keylife=3600s
   ikelifetime=1440m
   compress=no
   ike=aes256-sha1,aes128-md5
   esp=aes256-sha1,aes128-md5
   pfs=yes

# ping -I 172.24.26.65 172.27.96.15
PING 172.27.96.15 (172.27.96.15) from 172.24.26.65 : 56(84) bytes of data.
ping: sendmsg: No such process
ping: sendmsg: No such process
ping: sendmsg: No such process

SAs are established:

000 #2: "CONN" STATE_QUICK_I2 (sent QI2, IPsec SA established); 
EVENT_SA_REPLACE in 2719s; newest IPSEC; eroute owner
000 #2: "CONN" esp.bfbfcee8 at 194.228.96.46 (0 bytes) 
esp.c7b835a6 at 213.180.34.38 (0 bytes); tunnel
000 #1: "CONN" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 
85277s; newest ISAKMP

Policies are in place:

src 172.27.96.15/32 dst 172.24.26.64/26
        dir in priority 1819
        tmpl src B.B.B.B dst A.A.A.A
                proto esp reqid 16384 mode tunnel
src 172.24.26.64/26 dst 172.27.96.15/32
        dir out priority 1819
        tmpl src A.A.A.A dst B.B.B.B
                proto esp reqid 16386 mode tunnel
src 172.27.96.15/32 dst 172.24.26.64/26
        dir fwd priority 1819
        tmpl src B.B.B.B dst A.A.A.A
                proto esp reqid 16385 mode tunnel

Firewall policies also in place:

Chain INPUT (policy DROP 63626 packets, 5624K bytes)
 pkts bytes target     prot opt in     out     source 
destination
    0     0 ACCEPT     all  --  eth1   *       172.27.96.15 
172.24.26.64/26     policy match dir in pol ipsec reqid 16384 proto 50

Chain FORWARD (policy DROP 106K packets, 4269K bytes)
 pkts bytes target     prot opt in     out     source 
destination
    0     0 ACCEPT     all  --  eth1   *       172.27.96.15 
172.24.26.64/26     policy match dir in pol ipsec reqid 16384 proto 50

Chain OUTPUT (policy ACCEPT 21M packets, 21G bytes)
 pkts bytes target     prot opt in     out     source 
destination
    0     0 ACCEPT     all  --  *      eth1    172.24.26.64/26 
172.27.96.15        policy match dir out pol ipsec reqid 16384 proto 50

All zeroes, I would expect something in the OUTPUT chain (from ping -I 
172.24.26.65 172.27.96.15).

eth1 is external interface and eth0 is internal interface with IP 
172.24.26.65 assigned:

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 
1000
    link/ether 00:18:fe:32:56:08 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.1/24 brd 192.168.0.255 scope global eth0
    inet 172.24.26.65/26 brd 172.24.26.127 scope global eth0:0

What am I missing?

Thanks,
Regards,
Pavel Arnost

--------------------------------------------------
From: "Andreas Steffen" <andreas.steffen at strongswan.org>
Sent: Tuesday, May 10, 2011 12:12 PM
To: "Pavel Arnošt" <pavel.arnost at valvera.cz>
Cc: <users at lists.strongswan.org>
Subject: Re: [strongSwan] Migration from Openswan to Strongswan

> Hello Pavel,
>
> if you have iptables in place and you ping the internal interface
> of the VPN gateway then you need an INPUT/OUTPUT iptables rule
> to access that interface. Thus you'll need
>
>    leftfirewall=yes
>    lefthostaccess=yes
>
> If you have a MASQUERADING rule in place which NATs all traffic
> from the internal network to the outer IP address of the gateway
> then you must exempt traffic to be tunneled from this rule by adding
>
> iptables -t nat -I POSTROUTING 1 -s 10.10.0.0/16 -o eth0 \
>          -m policy --dir out --pol ipsec --proto esp -j ACCEPT
>
> Regards
>
> Andreas
>
> On 05/10/2011 11:51 AM, Pavel Arnošt wrote:
>> Hi,
>> I tried to migrate our Openswan VPN (2.6.21) to Strongswan VPN (4.5.1)
>> on our CentOS 5 server. Openswan package is from official CentOS
>> repository (openswan-2.6.21-5.el5_6.4), Strongswan package have been
>> built from this spec file:
>> http://developer.intra2net.com/git/?p=strongswan-rpm;a=blob_plain;f=strongswan.spec;hb=e2bb0076fce6d44ee80cff4b20d90a0eee1fa689
>> I slightly modified configuration for IKEv1 keying, ipsec.conf looks 
>> like:
>> config setup
>> charonstart=no
>> plutodebug="control"
>> conn %default
>> keyexchange=ikev1
>> authby=secret
>> conn CONN
>> type=tunnel
>> left=A.A.A.A
>> leftsubnet=192.168.52.0/24
>> right=B.B.B.B
>> rightsubnet=10.10.0.0/16
>> auto=start
>> auth=esp
>> ikelifetime=28800s
>> keylife=3600s
>> compress=no
>> ike=3des-sha1-modp1024
>> esp=3des-sha1
>> pfs=yes
>> dpddelay=30
>> dpdtimeout=120
>> dpdaction=restart
>> Both ISAKMP and IPsec SA were succesfully established, ip xfrm policy
>> output was the same as output from Openswan. But...
>> In tcpdump, I saw incoming ESP traffic from B.B.B.B, but no ESP traffic
>> from our address A.A.A.A. Ping to 10.10.255.1 returned no response, so I
>> think that policies were in place (with turned off VPN, ping returned
>> "host unreachable" from far away gateway). I added "iptables -I FORWARD
>> -j ACCEPT" rule to iptables to rule out problem with firewall.
>> Do you have any idea what can be wrong?
>> Thanks,
>> Regards,
>> Pavel Arnost
>>
>>
>>
>> _______________________________________________
>> Users mailing list
>> Users at lists.strongswan.org
>> https://lists.strongswan.org/mailman/listinfo/users
>
>
> -- 
> ======================================================================
> Andreas Steffen                         andreas.steffen at strongswan.org
> strongSwan - the Linux VPN Solution!                www.strongswan.org
> Institute for Internet Technologies and Applications
> University of Applied Sciences Rapperswil
> CH-8640 Rapperswil (Switzerland)
> ===========================================================[ITA-HSR]==
> 




More information about the Users mailing list