[strongSwan] Cannot assign IP address from DHCP
fratermajor at interia.pl
fratermajor at interia.pl
Wed Oct 22 13:53:18 CEST 2014
Hello,
after hours of digging I managed to run DHCP assigning. I have successfully test it in the LAN environment. I will send confirmation when I will have possibility to test it somewhere outside my house. Maybe this post will help someone in the similar problem.
The problem was in bad DHCP DISCOVER packet cheksum.
Look at the tcpdump log:
tcpdump -n dst portrange 67-68 -i any -vvvv
13:14:32.669231 IP (tos 0x0, ttl 64, id 3674, offset 0, flags [DF], proto UDP (17), length 328)
192.168.1.1.68 > 192.168.1.255.67: [bad udp cksum 0x8596 -> 0x608a!] BOOTP/DHCP, Request from 7a:a7:3d:09:66:2d, length 300, xid 0x3d09662d, Flags [none] (0x0000)
Gateway-IP 192.168.1.1
Client-Ethernet-Address 7a:a7:3d:09:66:2d
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Hostname Option 12, length 5: "artur"
Client-ID Option 61, length 5: hardware-type 97, 72:74:75:72
Parameter-Request Option 55, length 2:
Domain-Name-Server, Netbios-Name-Server
END Option 255, length 0
PAD Option 0, length 0, occurs 38
Of course this packet, when coming to DHCP server, generates only sometimes log message about bad cheksum.
Then I found at google that wrong packet cheksum is a very often problem in virtual interfaces and tunneling. I added this rule to firewall script:
iptables -t mangle -A POSTROUTING -o br0 -p udp -m udp --dport 67 -j CHECKSUM --checksum-fill
and after restarting firewall I’ve got DHCP OFFER response from my DHCP server
13:21:18.883035 IP (tos 0x0, ttl 64, id 3656, offset 0, flags [DF], proto UDP (17), length 328)
192.168.1.1.68 > 192.168.1.255.67: [udp sum ok] BOOTP/DHCP, Request from 7a:a7:d4:87:9e:97, length 300, xid 0xd4879e97, Flags [none] (0x0000)
Gateway-IP 192.168.1.1
Client-Ethernet-Address 7a:a7:d4:87:9e:97
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Hostname Option 12, length 5: "artur"
Client-ID Option 61, length 5: hardware-type 97, 72:74:75:72
Parameter-Request Option 55, length 2:
Domain-Name-Server, Netbios-Name-Server
END Option 255, length 0
PAD Option 0, length 0, occurs 38
13:21:18.883830 IP (tos 0x0, ttl 64, id 56887, offset 0, flags [DF], proto UDP (17), length 328)
MY_PUBLIC_IP > 192.168.1.1.67: [bad udp cksum 0xedf9 -> 0x0f8d!] BOOTP/DHCP, Reply, length 300, xid 0xd4879e97, Flags [none] (0x0000)
Your-IP 192.168.1.4
Gateway-IP 192.168.1.1
Client-Ethernet-Address 7a:a7:d4:87:9e:97
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Offer
Server-ID Option 54, length 4: 192.168.1.1
Lease-Time Option 51, length 4: 43200
Domain-Name-Server Option 6, length 4: 192.168.1.1
Subnet-Mask Option 1, length 4: 255.255.255.0
END Option 255, length 0
PAD Option 0, length 0, occurs 32
I had to make additional configuration according to manual to make everything work. Very important thing is to set "server" in dhcp charon plugin to broadcast of the subnet rather that server itself. When it was pointing at DHCP server address, the DHCP REQUEST packet wasn't able to reach server. Now my settings are:
#### /etc/init.d/firewall
#!/bin/bash
### BEGIN INIT INFO
# Provides: firewall.sh
# Required-Start: $local_fs $remote_fs
# Required-Stop: $local_fs $remote_fs
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start daemon at boot time
# Description: Enable service provided by daemon.
### END INIT INFO
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -F -t filter
iptables -X -t filter
iptables -F -t mangle
iptables -X -t mangle
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 500 --j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 4500 --j ACCEPT
iptables -A INPUT -i eth0 -p 50 --j ACCEPT
iptables -A INPUT -i eth0 -p udp -s 10.233.0.1 --sport 67 --dport 68 --j ACCEPT # My ISP DHCP
iptables -t mangle -A POSTROUTING -o br0 -p udp -m udp --dport 67 -j CHECKSUM --checksum-fill
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -m policy --dir out --pol ipsec -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP
#### /etc/ipsec.conf
conn %default
auto=add
left=%any
lefthostaccess=yes
leftsubnet=0.0.0.0/0
right=%any
rightsourceip=%dhcp
leftfirewall=yes
forceencaps=yes
compress=yes
ike=aes256-sha1-modp1024!
esp=aes256-sha1!
rekey=no
conn win7
leftid=@MY_DNS_NAME_THE_SAME_AS_IN_CERT
keyexchange=ikev2
dpdaction=clear
dpddelay=300s
leftauth=pubkey
leftcert=vpnCert.pem
rightauth=eap-mschapv2
rightsendcert=never # see note
eap_identity=%any
include /var/lib/strongswan/ipsec.conf.inc
#### /etc/strongswan.conf
# strongswan.conf - strongSwan configuration file
#
# Refer to the strongswan.conf(5) manpage for details
#
# Configuration changes should be made in the included files
charon {
load_modular = yes
plugins {
include strongswan.d/charon/*.conf
}
}
include strongswan.d/*.conf
#### /etc/strongswan.d/charon/dhcp.conf
dhcp {
# Whether to load the plugin. Can also be an integer to increase the
# priority of this plugin.
load = yes
force_server_address = yes
server = 192.168.1.255
}
#### /etc/dhcp/dhcpd.conf
log-facility local7;
ddns-updates on;
ddns-update-style interim;
update-static-leases on;
include "/etc/bind/rndc.key";
allow unknown-clients;
use-host-decl-names on;
allow client-updates;
zone home. {
primary 192.168.1.1;
key rndc-key;
}
zone 1.168.192.in-addr.arpa. {
primary 192.168.1.1;
key rndc-key;
}
subnet 192.168.1.0 netmask 255.255.255.0 {
authoritative;
range 192.168.1.2 192.168.1.254;
option subnet-mask 255.255.255.0;
option routers lan.home;
option broadcast-address 192.168.1.255;
option domain-name-servers lan.home;
option domain-name "home";
ddns-domainname "home.";
ddns-rev-domainname "in-addr.arpa.";
}
host lan.home {
fixed-address 192.168.1.1;
hardware ethernet 00:25:d3:f6:03:85;
}
More information about the Users
mailing list