[strongSwan] Tunnel is connected but the traffic is not routed through it

Roberto Majadas Lopez roberto.majadas at openshine.com
Fri May 24 17:15:38 CEST 2013


Hello:

I have just set up a vpn tunnel site-to-site with strongswan (4.5). The
tunnel looks fine and connected to the other side, but seems there is a
problem routing traffic through the tunnel.

Any idea?

Thanks!

Network diagram
===============

http://pastebin.com/N8RGJady

Software
========
* debian wheezy
* strongswan 4.5.2-1.5+deb7u1

/etc/ipsec.conf
===============
root at starfleet ~ # cat /etc/ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
    plutodebug="all"
    plutostderrlog=/var/log/pluto-ipsec
charonstart=no
plutostart=yes

conn net-net
     ikelifetime=86400s
     keylife=3600s
     rekeymargin=3m
     keyingtries=1
     keyexchange=ikev1
     authby=secret
     ike=aes256-sha-modp1024!
     esp=aes256-sha
     right=YY.YYY.YYY.155
     rightsubnet=172.30.20.0/27
     left=XX.XX.XX.195
     leftsubnet=192.168.100.0/24
     leftfirewall=yes
     pfs=no
     auto=add

Ipsec up
========
root at starfleet ~ # ipsec up net-net
002 "net-net" #1: initiating Main Mode
102 "net-net" #1: STATE_MAIN_I1: initiate
003 "net-net" #1: ignoring Vendor ID payload [FRAGMENTATION c0000000]
104 "net-net" #1: STATE_MAIN_I2: sent MI2, expecting MR2
003 "net-net" #1: ignoring Vendor ID payload [Cisco-Unity]
003 "net-net" #1: received Vendor ID payload [XAUTH]
003 "net-net" #1: ignoring Vendor ID payload
[###############################]
003 "net-net" #1: ignoring Vendor ID payload [Cisco VPN 3000 Series]
106 "net-net" #1: STATE_MAIN_I3: sent MI3, expecting MR3
002 "net-net" #1: Peer ID is ID_IPV4_ADDR: 'YY.YYY.YYY.155'
002 "net-net" #1: ISAKMP SA established
004 "net-net" #1: STATE_MAIN_I4: ISAKMP SA established
002 "net-net" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using
isakmp#1}
110 "net-net" #2: STATE_QUICK_I1: initiate
002 "net-net" #2: sent QI2, IPsec SA established {ESP=>0x8a12ab22
<0xa01abba1}
004 "net-net" #2: STATE_QUICK_I2: sent QI2, IPsec SA established
{ESP=>0x8a12ab22 <0xa01abba1}

root at starfleet ~ # ipsec status
000 "net-net":
192.168.100.0/24===XX.XX.XX.195[XX.XX.XX.195]...YY.YYY.YYY.155[YY.YYY.YYY.155]===172.30.20.0/27;
erouted; eroute owner: #2
000 "net-net":   newest ISAKMP SA: #1; newest IPsec SA: #2;
000
000 #2: "net-net" STATE_QUICK_I2 (sent QI2, IPsec SA established);
EVENT_SA_REPLACE in 3331s; newest IPSEC; eroute owner
000 #2: "net-net" esp.8a12ab22 at YY.YYY.YYY.155 (0 bytes)
esp.a01abba1 at XX.XX.XX.195 (0 bytes); tunnel
000 #1: "net-net" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE
in 86050s; newest ISAKMP
000

Network information
===================
* tun0 interface is used by openvpn server.
* virbr1 interface is a kvm network

root at starfleet ~ # ip -4 a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
    inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
UP qlen 1000
    inet XX.XX.XX.195/29 brd XX.XX.XX.199 scope global eth0
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc
pfifo_fast state UNKNOWN qlen 100
    inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
5: virbr1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state
UP
    inet 192.168.100.1/24 brd 192.168.100.255 scope global virbr1

root at starfleet ~ # ip -4 r s t 0
default via XX.XX.XX.193 dev eth0
10.8.0.0/16 via 10.8.0.2 dev tun0
10.8.0.2 dev tun0  proto kernel  scope link  src 10.8.0.1
XX.XX.XX.192/29 via XX.XX.XX.193 dev eth0
XX.XX.XX.192/29 dev eth0  proto kernel  scope link  src XX.XX.XX.195
192.168.100.0/24 dev virbr1  proto kernel  scope link  src 192.168.100.1
local 10.8.0.1 dev tun0  table local  proto kernel  scope host  src
10.8.0.1
broadcast XX.XX.XX.192 dev eth0  table local  proto kernel  scope link  src
XX.XX.XX.195
local XX.XX.XX.195 dev eth0  table local  proto kernel  scope host  src
XX.XX.XX.195
broadcast XX.XX.XX.199 dev eth0  table local  proto kernel  scope link  src
XX.XX.XX.195
broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src
127.0.0.1
local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src
127.0.0.1
local 127.0.0.1 dev lo  table local  proto kernel  scope host  src
127.0.0.1
broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link
 src 127.0.0.1
broadcast 192.168.100.0 dev virbr1  table local  proto kernel  scope link
 src 192.168.100.1
local 192.168.100.1 dev virbr1  table local  proto kernel  scope host  src
192.168.100.1
broadcast 192.168.100.255 dev virbr1  table local  proto kernel  scope link
 src 192.168.100.1

root at starfleet ~ # ip xfrm state
src XX.XX.XX.195 dst YY.YYY.YYY.155
proto esp spi 0x8a12ab22 reqid 16384 mode tunnel
replay-window 32 flag af-unspec
auth-trunc hmac(sha1) 0x######################################## 96
enc cbc(aes)
0x################################################################
src YY.YYY.YYY.155 dst XX.XX.XX.195
proto esp spi 0xa01abba1 reqid 16384 mode tunnel
replay-window 32 flag af-unspec
auth-trunc hmac(sha1) 0x######################################## 96
enc cbc(aes)
0x################################################################

root at starfleet ~ # ip xfrm policy
src 192.168.100.0/24 dst 172.30.20.0/27
dir out priority 1847 ptype main
tmpl src XX.XX.XX.195 dst YY.YYY.YYY.155
proto esp reqid 16384 mode tunnel
src 172.30.20.0/27 dst 192.168.100.0/24
dir fwd priority 1847 ptype main
tmpl src YY.YYY.YYY.155 dst XX.XX.XX.195
proto esp reqid 16384 mode tunnel
src 172.30.20.0/27 dst 192.168.100.0/24
dir in priority 1847 ptype main
tmpl src YY.YYY.YYY.155 dst XX.XX.XX.195
proto esp reqid 16384 mode tunnel
src ::/0 dst ::/0
socket out priority 0 ptype main
src ::/0 dst ::/0
socket in priority 0 ptype main
src ::/0 dst ::/0
socket out priority 0 ptype main
src ::/0 dst ::/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main

root at starfleet ~ # ip route show table 220
root at starfleet ~ #

root at starfleet ~ # route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use
Iface
0.0.0.0         XX.XX.XX.193    0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.0.0     UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
XX.XX.XX.192    XX.XX.XX.193    255.255.255.248 UG    0      0        0 eth0
XX.XX.XX.192    0.0.0.0         255.255.255.248 U     0      0        0 eth0
192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0
virbr1

Iptables
========
root at starfleet ~ # iptables-save
# Generated by iptables-save v1.4.14 on Fri May 24 16:07:39 2013
*nat
:PREROUTING ACCEPT [11:368]
:INPUT ACCEPT [1:48]
:OUTPUT ACCEPT [13:1012]
:POSTROUTING ACCEPT [13:1012]
-A POSTROUTING -s 10.8.0.0/16 ! -d 10.8.0.0/16 -o virbr1 -j MASQUERADE
-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -p tcp -j
MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -p udp -j
MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -j MASQUERADE
COMMIT
# Completed on Fri May 24 16:07:39 2013
# Generated by iptables-save v1.4.14 on Fri May 24 16:07:39 2013
*mangle
:PREROUTING ACCEPT [271:19504]
:INPUT ACCEPT [261:19184]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [181:28686]
:POSTROUTING ACCEPT [181:28686]
-A POSTROUTING -o virbr1 -p udp -m udp --dport 68 -j CHECKSUM
--checksum-fill
COMMIT
# Completed on Fri May 24 16:07:39 2013
# Generated by iptables-save v1.4.14 on Fri May 24 16:07:39 2013
*filter
:INPUT ACCEPT [46:3380]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [36:5220]
-A INPUT -i virbr1 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr1 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr1 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr1 -p tcp -m tcp --dport 67 -j ACCEPT
-A FORWARD -s 172.30.20.0/27 -d 192.168.100.0/24 -i eth0 -m policy --dir in
--pol ipsec --reqid 16384 --proto esp -j ACCEPT
-A FORWARD -s 192.168.100.0/24 -d 172.30.20.0/27 -o eth0 -m policy --dir
out --pol ipsec --reqid 16384 --proto esp -j ACCEPT
-A FORWARD -s 10.8.0.0/16 -o virbr1 -j ACCEPT
-A FORWARD -i virbr1 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 192.168.100.0/24 -o virbr1 -m state --state
RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.100.0/24 -i virbr1 -j ACCEPT
-A FORWARD -i virbr1 -o virbr1 -j ACCEPT
-A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Fri May 24 16:07:39 2013

TcpDumping from 192.168.100.100 to 172.30.20.9
==============================================
*** All commands are running at the same time. ***

root at enterprise:~# ping 172.30.20.9
PING 172.30.20.9 (172.30.20.9) 56(84) bytes of data.
^C
--- 172.30.20.9 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 4999ms

root at enterprise:~# tcpdump -v -n dst net 172.30.20.0/27
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535
bytes
16:23:48.919819 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 1,
length 64
16:23:49.918949 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 2,
length 64
16:23:50.918950 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 3,
length 64
16:23:51.918952 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 4,
length 64
16:23:52.918954 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 5,
length 64
16:23:53.918951 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 6,
length 64

root at starfleet ~ # tcpdump -v -n dst net 172.30.20.0/27
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535
bytes
16:23:50.475100 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 1, length 64
16:23:51.474262 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 2, length 64
16:23:52.474280 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 3, length 64
16:23:53.474251 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 4, length 64
16:23:54.474213 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 5, length 64
16:23:55.474173 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP
(1), length 84)
    XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 6, length 64
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20130524/b1d771fd/attachment.html>


More information about the Users mailing list