[strongSwan] StrongSwan(optware) on Asus RT-AC66U (merlin build)-can't access LAN IPs

Noel Kuntze noel at familie-kuntze.de
Thu Nov 7 08:04:54 CET 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello Luka,

See http://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling For solutions to this problem.

Regards
Noel Kuntze

Am 07.11.2013 07:54, schrieb Luka:
> Hi.
> I've successfully installed StrongSwan 5.0.4 IPsec server on my Asus RT-AC66U Firmware:3.0.0.4.374.34_2 (Merlin build), followed tutorial on:
> http://wiki.strongswan.org/projects/strongswan/wiki/IOS_(Apple)
> I'm trying to achieve this(diagram):
> https://dl.dropboxusercontent.com/u/2261256/forums/ipsec/IPsec_diagram.png
> 
> I can connect to vpn server with my iPhone, using Cisco IPsec, but problem is that*I can't access any of my home LAN IPs*.
> Here is strongswan log file(removed IPs):
> https://dl.dropboxusercontent.com/u/2261256/forums/ipsec/strongswancharon.log
> 
> Router firewall is temporary disabled.
> I probably need to add some iptables routes or something ?
> 
> Can someone tell me what should I put for left/right subnet and left/right ip ?
> Here is my config:
> Ipsec.conf file:
> 
> conn ios                                              
>        keyexchange=ikev1                              
>        authby=xauthrsasig                             
>        xauth=server                                   
>        left=%defaultroute                             
>        #left=%any                                     
>        leftfirewall=yes                               
>        leftsubnet=0.0.0.0/0 <http://0.0.0.0/0>                           
>        #leftsubnet=192.168.2.0/24 <http://192.168.2.0/24>                     
>        leftcert=server.pem                    
>        right=%any                                     
>        rightsubnet=10.0.0.0/24 <http://10.0.0.0/24>                        
>        #rightsubnet=192.168.2.0/24 <http://192.168.2.0/24>                    
>        rightsourceip=10.0.0.2                         
>        #rightsourceip=%dhcp                           
>        rightcert=client.pem                   
>        #forceencaps=yes                               
>        auto=add
> 
> 
> strongswan.conf file:
> 
> charon {
> 
>         # number of worker threads in charon
>         threads = 16
> 
>         dns1 = 192.168.2.1
> 
>         plugins {
>                 dhcp {
>                       server = 192.168.2.1
>                 }
> 
>         }
>  }
> 
> 
> 
> ipsec statusall command:
> 
> ipsec statusall
> Status of IKE charon daemon (strongSwan 5.0.4, Linux 2.6.22.19, mips):
>   uptime: 27 minutes, since Nov 06 22:32:15 2013
>   malloc: sbrk 225280, mmap 0, used 201584, free 23696
>   worker threads: 3 of 16 idle, 12/1/0/0 working, job queue: 0/0/0/0, scheduled: 5
>   loaded plugins: charon test-vectors curl ldap mysql sqlite pkcs11 aes des blowfish sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs8 pgp dnskey pem openssl gcrypt fips-prf gmp agent xcbc cmac hmac ctr ccm gcm attr kernel-pfkey kernel-klips kernel-netlink resolve socket-default socket-dynamic farp stroke smp updown eap-identity eap-md5 eap-mschapv2 eap-radius xauth-generic xauth-eap dhcp whitelist led duplicheck addrblock unity
> Virtual IP pools (size/online/offline):
>   10.0.0.2 <http://10.0.0.2>: 1/1/0
> Listening IP addresses:
>   <wan.ip.removed>
>   192.168.2.1
>   10.8.2.1
>   10.8.0.6
> Connections:
>          ios:  %any...%any  IKEv1
>          ios:   local:  [C=CA,... <removed>] uses public key authentication
>          ios:    cert:  "C=CA,... <removed>"
>          ios:   remote: [C=CA, ... <removed>] uses public key authentication
>          ios:    cert:  "C=CA,... <removed>"
>          ios:   remote: uses XAuth authentication: any
>          ios:   child:  0.0.0.0/0 <http://0.0.0.0/0> === 10.0.0.0/24 <http://10.0.0.0/24> TUNNEL
> Security Associations (1 up, 0 connecting):
>          ios[4]: ESTABLISHED 23 seconds ago, <wan.ip.removed>[C=CA,... <removed>]...<iphone.wan.ip.removed>[C=CA,... <removed>]
>          ios[4]: Remote XAuth identity: <removed>
>          ios[4]: IKEv1 SPIs: 884d6e82b7e59a56_i a4cea15bd0aeff20_r*, public key reauthentication in 2 hours
>          ios[4]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
>          ios{2}:  INSTALLED, TUNNEL, ESP SPIs: c5177fea_i 070a1d6b_o
>          ios{2}:  AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 45 minutes
>          ios{2}:   0.0.0.0/0 <http://0.0.0.0/0> === 10.0.0.2/32 <http://10.0.0.2/32>
> 
> 
> Some more info:
> 
> 
> iptables -L -t nat
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination         
> ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:1194 
> VSERVER    all  --  anywhere             cpe-86-<removed>
> 
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination         
> MASQUERADE  all  --  192.168.2.0/24 <http://192.168.2.0/24>       anywhere            
> MASQUERADE  all  -- !cpe-86-<removed>  anywhere            
> MASQUERADE  all  --  anywhere             anywhere            MARK match 0xd001 
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination         
> 
> Chain LOCALSRV (0 references)
> target     prot opt source               destination         
> 
> Chain VSERVER (1 references)
> target     prot opt source               destination         
> DNAT       tcp  --  anywhere             anywhere            tcp dpt:1184 to:192.168.2.100:1194 <http://192.168.2.100:1194> 
> DNAT       udp  --  anywhere             anywhere            udp dpt:1184 to:192.168.2.100:1194 <http://192.168.2.100:1194> 
> VUPNP      all  --  anywhere             anywhere            
> 
> Chain VUPNP (1 references)
> target     prot opt source               destination         
> 
> Chain YADNS (0 references)
> target     prot opt source               destination
> 
> 
> 
> netstat -r
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
> 10.8.0.5        *               255.255.255.255 UH        0 0          0 tun11
> 10.8.0.1        10.8.0.5        255.255.255.255 UGH       0 0          0 tun11
> 10.8.2.2        *               255.255.255.255 UH        0 0          0 tun21
> 86.58.119.1     *               255.255.255.255 UH        0 0          0 eth0
> 86.58.119.0     *               255.255.255.0   U         0 0          0 eth0
> 10.8.2.0        10.8.2.2        255.255.255.0   UG        0 0          0 tun21
> 192.168.2.0     *               255.255.255.0   U         0 0          0 br0
> 192.168.1.0     10.8.0.5        255.255.255.0   UG        0 0          0 tun11
> 127.0.0.0       *               255.0.0.0       U         0 0          0 lo
> default         <removed> 0.0.0.0         UG        0 0          0 eth0
> 
> 
> (ignore that tunnel to 192.168.1.0)
> 
> What should I do to make that tunnel work ?
> 
> Regards.
> 
> Luka
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Users mailing list
> Users at lists.strongswan.org
> https://lists.strongswan.org/mailman/listinfo/users
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJSezuWAAoJEDg5KY9j7GZYIlQP/jOYYLtuYAemzYH0pyzZimbo
No3Td9nhGbpi2QPBm6W7cBa3qo/xikaH80RRjG07raDVKJdxhQKjf/hYNG3daF3C
HTBZuaMBU8afwumQpknLprhapec+FZ5uNc4KE1OL4CObTQlv/ZBcFBvwIitGfJKX
tHcR54FEC8ElrzRrqjLItx+1oEr47AFa8yj1/AJV3c8T08vgqAJbOoTpThuJweF7
8pbJcnDUwf3c4Xm+GKKI5lK3H5B4MF6ybhTn4EWNKy7IEe9tn3M0PuWTabyQ5W0h
StiAVWS1U0GVT22eGTLIAAJ6izm6XH4KC5vvlZlS3y0wdyYrrupiNwgegFVd2gMS
Om3WeG5KVEHpl9WqUO5cBKBHFQlrvL5pxcRP0rTmncGBNUKYNc28HiTpQZQZne/1
BLcIdCChJZCKn6ncVLibhYdFSxag0KKiAmlD26rzGR2V7AYzbr0zRBvTGhbvI8du
0S1xfIpXv56tGt3DBxD1s4/VGbhSpFlOEkqDQqzMPtAeUjNjjK/PeX2qSs0kJYGU
LDpkI815MQFtnIdQ7Wy79UzmnK2Q/2Bpy5+ckOZPzbkRuSizYYcKhgD2Kmdd4EWp
rneKSob9OgtE7Q8cAtauJgJRLBrDHVuvg0Zc5d2sVc0dkxFwzcs7dtWJQnD5qDU4
x1mkt92ogJMXnEy7D6eo
=TCnj
-----END PGP SIGNATURE-----




More information about the Users mailing list