[strongSwan] pure ipsec openwrt

Rajiv Kulkarni rajivkulkarni69 at gmail.com
Tue Oct 4 09:33:01 CEST 2011


Hi

I would suggest you to do one more thing:

- Remove the "leftfirewall=yes" from the ipsec.conf on both peers (if it is
mentioned on remote peer too)

- Manually add/paste the mentioned iptable rules which is basically
simulating a split-tunnel scenario as shown in the attached png file. Also
add the forward-chain rules with br-lan interface also, if possible

- Logically speaking it should get solved with above steps

But looking at your device config (the interfaces mentioned), i guess the
issues may be because:

- are there VLANs/sub-interfaces/alias-interfaces defined on Eth0?

- Is there a Physical lan interface on your device? such as eth1 or eth2
(i.e other than eth0 which is i guess the wan interface)

- why are you bridging the wan interface (eth0.2 or pppoe-wan) with lan
(eth0.1). Although it should work, but the ipsec flow gets sometimes
disrupted due to routing issues, when everything is bridged together.

- I would generally keep the wan interface separate/standalone, and instead
bridge the lan and wifi interface together (and i do run dhcp-server on the
br0 interface to cater to the lan-side ethernet and wifi clients)

hope this works

thanks
rajiv




On Mon, Oct 3, 2011 at 6:57 PM, Andrea Nottoli <andreanottoli at gmail.com>wrote:

> Hi again,
> It doesn't works :(
> I still can ping router and also manage it trough webGui, but can't reach
> other machines :(
>
> I've edited the suggested rules for adjust to my ifconfig but without
> success, other ideas?
> Sure, the problem is related to nat from ppp/wan to lan and vice-versa.
>
> This is my ifconfig
> wan interface is eth0.2, wih a pppoe-wan connection over it.
> eth0.1 is the lan interface, bridget (br-lan) with eth0.2.
>
> so i've edited the rules suggested by Rajiv with eth0.2 instead eth0 (wan)
> and eth0.1 instead eth2 (lan). Also changed ppp0 with pppoe-wan according to
> ifconfig (below).
>
> Thanks again for your help, hope to finally solve this strange (and
> abnormal) issue with my ipsec config.
>
>
>
>  root at OpenWrt:~# ifconfig
> br-lan    Link encap:Ethernet  HWaddr 74:EA:3A:E4:47:52
>           inet addr:192.168.1.254  Bcast:192.168.1.255  Mask:255.255.255.0
>           inet6 addr: fe80::76ea:3aff:fee4:4752/64 Scope:Link
>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:9450776 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:21936047 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:0
>           RX bytes:1169972374 (1.0 GiB)  TX bytes:495910714 (472.9 MiB)
>
> eth0      Link encap:Ethernet  HWaddr 74:EA:3A:E4:47:52
>           inet6 addr: fe80::76ea:3aff:fee4:4752/64 Scope:Link
>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:32253959 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:31904139 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:1000
>           RX bytes:2811514789 (2.6 GiB)  TX bytes:1757630697 (1.6 GiB)
>           Interrupt:4
>
> eth0.1    Link encap:Ethernet  HWaddr 74:EA:3A:E4:47:52
>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:9841290 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:22001555 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:0
>           RX bytes:1856031729 (1.7 GiB)  TX bytes:306500736 (292.3 MiB)
>
> eth0.2    Link encap:Ethernet  HWaddr 74:EA:3A:E4:47:52
>           inet6 addr: fe80::76ea:3aff:fee4:4752/64 Scope:Link
>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:22412477 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:9902574 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:0
>           RX bytes:503906886 (480.5 MiB)  TX bytes:1451128324 (1.3 GiB)
>
> lo        Link encap:Local Loopback
>           inet addr:127.0.0.1  Mask:255.0.0.0
>           inet6 addr: ::1/128 Scope:Host
>           UP LOOPBACK RUNNING  MTU:16436  Metric:1
>           RX packets:58 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:58 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:0
>           RX bytes:5341 (5.2 KiB)  TX bytes:5341 (5.2 KiB)
>
> mon.wlan0 Link encap:UNSPEC  HWaddr
> 74-EA-3A-E4-47-52-00-00-00-00-00-00-00-00-00-00
>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:55353 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:1000
>           RX bytes:8881039 (8.4 MiB)  TX bytes:0 (0.0 B)
>
> pppoe-wan Link encap:Point-to-Point Protocol
>           inet addr:79.XX.XX.XXX  P-t-P:192.168.100.1  Mask:255.255.255.255
>           UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
>           RX packets:1818589 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:713853 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:3
>           RX bytes:2430544726 (2.2 GiB)  TX bytes:56985105 (54.3 MiB)
>
> wlan0     Link encap:Ethernet  HWaddr 74:EA:3A:E4:47:52
>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:494648 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:837753 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:1000
>           RX bytes:72276624 (68.9 MiB)  TX bytes:1022316479 (974.9 MiB)
>
>
>
>
>
>
>  Il giorno 27/set/2011, alle ore 09:47, Rajiv Kulkarni ha scritto:
>
>  Hi
>
> Assuming that you have NAT (MASQUERADE) enabled on wan (say eth0 interface)
> of your home router (with a pppoe connection to internet) and the LAN
> interface is identified as eth2, then i would request you to please try out
> the below iptable rules also:
>
> iptables -A INPUT -p esp -j ACCEPT
> iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT
> iptables -A OUTPUT -p esp -j ACCEPT
> iptables -A OUTPUT -p udp -m udp --dport 500 -j ACCEPT
> iptables -t nat -I POSTROUTING 1 -p esp -j ACCEPT
> iptables -t nat -I POSTROUTING 2 -s 192.168.1.0/24 -d 172.20.0.0/16 -j
> ACCEPT
> iptables -I FORWARD 3 -i eth2 -o ppp0 -j ACCEPT
> iptables -I FORWARD 4 -i eth2 -o eth0 -j ACCEPT
> iptables -I FORWARD 5 -i ppp0 -o eth2 -j ACCEPT
> iptables -I FORWARD 6 -i eth0 -o eth2 -j ACCEPT
>
> please Note: the rules for the nat table should be added before the
> MASQUERADE rule, if any. hence the numbers 1 and 2.
>
> The basic reason i think is that the packets aren't getting forwarded
> across the wan to lan interfaces and vice-versa, once the ipsec tunnel is
> up.
>
> 1. you can try only ipsec first by disabling firewall completely
> 2. next enable the existing firewall rules and ipsec and see where its
> getting dropped. also try to add some the rules mentioned above.
>
> i think it should work if 1 above works
>
> -rajiv
>
>
>
> On Mon, Sep 26, 2011 at 8:08 PM, Andrea Nottoli <andreanottoli at gmail.com>wrote:
>
>> Hi everybody and sorry for my really bad english.
>>
>> i've a problem with StrongSwan on latest OpenWRT firmware.
>> I followed the tutorial on the wiki for setting-up a vpn server for
>> connect to my home lan trough my iphone and ipad (so IKEv1 and PureIPSec).
>> I can connect and login (x509 cert) but i cant pin't my lan machine (es.
>> my NAS).
>> Seems iptables block navigation from wan to lan also during pure ipsec
>> connection.
>>
>> OpenWRT router ip: 192.168.1.254
>> Connection to internet: pppoe trough adsl modem
>>
>>
>> I've opened esp proto, 500 udp, 4500 udp, ah proto and added some policies
>> for forward ipsec traffics but seems that isn't enough (check bottom).
>>
>>
>> Someone can help me? Thanks since now strongswan team!
>>
>>
>>
>>
>> This is my ipsec.conf
>>
>> config setup
>>        strictcrlpolicy=no
>>        nat_traversal=yes
>>        charonstart=yes
>>
>> conn ios
>>       keyexchange=ikev1
>>       authby=xauthrsasig
>>       xauth=server
>>       leftfirewall=yes
>>       left=%defaultroute
>>       leftsubnet=0.0.0.0/0
>>       leftcert=serverCert.pem
>>       rightsourceip=192.168.1.25
>>       rightsubnet=192.168.1.0/24
>>       right=%any
>>       rightcert=clientCert.pem
>>       pfs=no
>>       auto=add
>>
>>
>>
>>
>>
>> this is my firewall.users (a text file for custom rules loaded during
>> firewall start from OpenWRT):
>>
>> /usr/sbin/iptables -I INPUT -m policy --dir in --pol ipsec --proto esp -j
>> ACCEPT
>> /usr/sbin/iptables -I FORWARD -m policy --dir in --pol ipsec --proto esp
>> -j ACCEPT
>> /usr/sbin/iptables -I FORWARD -m policy --dir out --pol ipsec --proto esp
>> -j ACCEPT
>> /usr/sbin/iptables -I OUTPUT -m policy --dir out --pol ipsec --proto esp
>> -j ACCEPT
>>
>>
>>
>>
>> this is my firewall.conf (the base file loaded fro firewall configuration
>> every start, after this openwrt load the firewall.users script):
>> config 'defaults'
>>        option 'syn_flood' '1'
>>        option 'input' 'ACCEPT'
>>        option 'output' 'ACCEPT'
>>        option 'drop_invalid' '1'
>>        option 'forward' 'ACCEPT'
>>
>> config 'zone'
>>        option 'name' 'lan'
>>        option 'network' 'lan'
>>        option 'input' 'ACCEPT'
>>        option 'output' 'ACCEPT'
>>        option 'forward' 'REJECT'
>>
>> config 'zone'
>>        option 'name' 'wan'
>>        option 'network' 'wan'
>>        option 'output' 'ACCEPT'
>>        option 'mtu_fix' '1'
>>        option 'masq' '1'
>>        option 'input' 'REJECT'
>>        option 'forward' 'REJECT'
>>
>> config 'rule'
>>        option 'src' 'wan'
>>        option 'proto' 'udp'
>>        option 'dest_port' '68'
>>        option 'target' 'ACCEPT'
>>        option 'family' 'ipv4'
>>
>> config 'rule'
>>        option 'src' 'wan'
>>        option 'proto' 'icmp'
>>        option 'icmp_type' 'echo-request'
>>        option 'target' 'ACCEPT'
>>
>> config 'include'
>>        option 'path' '/etc/firewall.user'
>>
>> config 'forwarding'
>>        option 'dest' 'wan'
>>        option 'src' 'lan'
>>
>> config 'redirect'
>>        option '_name' 'qBittorrent verso nas'
>>        option 'src' 'wan'
>>        option 'proto' 'tcp'
>>        option 'src_dport' '6881'
>>        option 'dest_ip' '192.168.1.1'
>>        option 'dest_port' '6881'
>>        option 'target' 'DNAT'
>>        option 'dest' 'lan'
>>
>> config 'rule'
>>        option 'target' 'ACCEPT'
>>        option '_name' 'PPPTP VPN'
>>        option 'src' 'wan'
>>        option 'proto' 'udp'
>>        option 'dest_port' '1723'
>>
>> config 'rule'
>>        option 'target' 'ACCEPT'
>>        option '_name' 'accetta esp'
>>        option 'src' 'wan'
>>        option 'proto' 'esp'
>>
>> config 'rule'
>>        option 'target' 'ACCEPT'
>>        option '_name' 'accetta ike'
>>        option 'src' 'wan'
>>        option 'proto' 'udp'
>>        option 'dest_port' '500'
>>
>> config 'rule'
>>        option 'target' 'ACCEPT'
>>        option '_name' 'accetta nat-t'
>>        option 'src' 'wan'
>>        option 'proto' 'udp'
>>        option 'dest_port' '4500'
>>
>> config 'rule'
>>        option 'target' 'ACCEPT'
>>        option '_name' 'accetta ah'
>>        option 'src' 'wan'
>>        option 'proto' 'ah'
>> _______________________________________________
>> Users mailing list
>> Users at lists.strongswan.org
>> https://lists.strongswan.org/mailman/listinfo/users
>>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20111004/71ef1a05/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: C1K-EVM - IPSec with NAPT.png
Type: image/png
Size: 11494 bytes
Desc: not available
URL: <http://lists.strongswan.org/pipermail/users/attachments/20111004/71ef1a05/attachment.png>


More information about the Users mailing list