[strongSwan] Problem Routing Decrypted Packets
Noel Kuntze
noel at familie-kuntze.de
Sat May 9 01:11:26 CEST 2015
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Hello Sajal,
Tunneling 0.0.0.0/32 == 0.0.0.0/32 does not work. What do you try to do?
You need to decide on the subnets you want to tunnel or negotiate 0.0.0.0/0 == 0.0.0.0/0
and then use mark(,_in,_out) to give the kernel information how to handle the packets.
Mit freundlichen Grüßen/Kind Regards,
Noel Kuntze
GPG Key ID: 0x63EC6658
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658
Am 08.05.2015 um 12:53 schrieb Sajal Malhotra:
> Hi,
>
> I am using following Setup in my Lab:
>
> Host A<---->SeGW<-----(ESP Tunnel)---->(eth1)Strongswan (Linux PC) (eth0)<--->Host B
>
> So there is one Tunnel Established between SeGW and Linux PC which is running Strongswan Stack v5.2.2.
> The Linux is connected to SeGW via its eth1 interface
> and Host B is connected via eth0 Interface.
>
> What we want is that:
> 1. Any traffic that we want to send from Host A to Host B should go via SeGW where it is sent encrypted towards Linux Box.
> 2. The Linux Box running strongswan should then decrypt the traffic and route it to Host B
> 3. As expected, the reverse path to be followed for traffic from Host B to Host A.
>
> What we observe is that:
> 1. SeGW is successfully able to encrypt the traffic and send ESP frames to Linux PC
> 2. the linux PC also decrypts it successfully
> 3. However after decryption *it is not able to route *the traffic towards interface connected to Host B. *On the contrary we see that decrypted traffic is seen on the same interface from which it received the ESP frames. i.e. the interface connected to SeGW. i.e. both Encrypted and decrypted packet seen on same interface.*
>
> The routing configured on Linux PC also looks to be correct as when I send ping traffic from Host A to Host B (this traffic is not encrypted), i see that Linux PC is correctly able to route this ICMP traffic towards Host B without any Issue.
>
> Can you let me know what could be the possible issue here. Or provide some indication on how to debug it.
>
> Below are the logs and configuration. Let me know if any additional detail is needed that i missed--:
>
> Here is the ipsec.conf connection setting:
>
>
>
> conn saM
>
> ikelifetime=24h
>
> keyexchange=ikev2
>
> keyingtries=%forever
>
> keylife=5m
>
> reauth=no
>
> rekey=yes
>
> mobike=no
>
> dpdaction=clear
>
> dpddelay=10
>
> rekeymargin=1m
>
> ike=aes128-sha1-modp1024,3des-sha1-modp1024!
>
> esp=aes128-sha1-modp1024,3des-sha1-modp1024!
>
> authby=rsasig
>
> left=31.31.31.22
>
> leftsubnet=0.0.0.0/32 <http://0.0.0.0/32>
>
> right=31.31.31.31
>
> rightsubnet=0.0.0.0/32 <http://0.0.0.0/32>
>
> leftprotoport=%any/%any
>
> rightprotoport=%any/%any
>
> leftcert=/usr/local/etc/ipsec.d/certs/linux.pem
>
> rightid=%any
>
> auto=add
>
>
> Host A IP: 172.18.21.232
>
> Host B IP: 10.3.4.22
>
>
> *Routing Table on Linux PC:*
>
>
> Kernel IP routing table
>
> Destination Gateway Genmask Flags Metric Ref Use Iface
>
> 172.18.21.0 * 255.255.255.0 U 0 0 0 eth1
>
> *10.3.4.0 * 255.255.255.0 U 1 0 0 eth0 <<<this route should have worked*
>
> 192.168.122.0 * 255.255.255.0 U 0 0 0 virbr0
>
> 31.31.31.0 * 255.255.255.0 U 0 0 0 eth1
>
> 172.18.0.0 * 255.255.0.0 U 0 0 0 eth1
>
> default 10.3.4.1 0.0.0.0 UG 0 0 0 eth0
>
> default 10.3.4.1 0.0.0.0 UG 0 0 0 eth0
>
>
> *ifconfig output:*
> [root at root ~]# ifconfig
> eth0 Link encap:Ethernet HWaddr A4:1F:72:8E:66:F5
> inet addr:10.3.4.139 Bcast:10.3.4.255 Mask:255.255.255.0
> inet6 addr: fe80::a61f:72ff:fe8e:66f5/64 Scope:Link
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:33355 errors:0 dropped:0 overruns:0 frame:0
> TX packets:32425 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:1000
> RX bytes:18132226 (17.2 MiB) TX bytes:28624412 (27.2 MiB)
> Interrupt:46 Base address:0x2000
>
> eth1 Link encap:Ethernet HWaddr 00:0A:F7:16:7E:5D
> inet addr:31.31.31.22 Bcast:31.31.31.255 Mask:255.255.255.0
> inet6 addr: fe80::20a:f7ff:fe16:7e5d/64 Scope:Link
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:2807 errors:0 dropped:0 overruns:0 frame:0
> TX packets:265 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:1000
> RX bytes:395217 (385.9 KiB) TX bytes:35486 (34.6 KiB)
> Interrupt:17
>
> eth1:1 Link encap:Ethernet HWaddr 00:0A:F7:16:7E:5D
> inet addr:172.18.21.1 Bcast:172.18.255.255 Mask:255.255.0.0
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> Interrupt:17
>
> Wireshark logs captured on eth1 interface are attached, which show both encrypted and decrypted packets on same interface.
> *
> *
> Thanks and Regards
> Sajal
>
>
>
> _______________________________________________
> Users mailing list
> Users at lists.strongswan.org
> https://lists.strongswan.org/mailman/listinfo/users
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJVTUKcAAoJEDg5KY9j7GZYEGYP/jpjpvawlNjYUMOKMTEjjnaj
8uYnMqXOWwCyOYXw8Dcz3/qNheuPj4GsyvijWi/jnY4MU/Q5oxOgRfF/r+ptBlg2
vOPRCguGqIFmXNS0vXciICwCGwO3FuxelxGBtCJ8vZa8ZWbJcG3PnMjhulVJ9mDg
jxN88GHhvr5jRTNMgxqSQF7i5Q7MY8/DIScdQjukTqTWe9QGBibWnNNCep7/onkk
VH8aTsgNiquoZqucuzAWUIQLfUdGfedUnZxfFjMF36HddVqmdpy0ulmLIR9sn+0e
aTKgleTjllo7D7CK55bzfXiminfibT7Q37q8gSAVqeGBGlEXgYKZUjOB4yKYltuP
XY8uXjK6VeWu7Du8ZXm1uu4v53ipDpgIvCG4iPL/a9n29yHqng71/wpmKisC1J/S
Ubyth2yi9L4RV3HOzv0xVlcOTsh/X5VCFmlQBZpYQiS/eHjlyDmzJoAi4DkH0kIy
YfVXCgUVYVsA19/zaZgQGM0+wR4O6r+K5cRz2OVD7QF3ZrlP9zPk8vEnbu/RQuHQ
ek1sdmk+xqR38rU3iMqZSNJdzjWFg1Obk8L3BxYNdQIXoXSfgNq9mKfBBb+C7Sl2
hYwVumONbvHT6BcqWRQqPMoaZK5RDkeghs4Lmyg2Vfe0yrcMBVr5o9OKRYCriShd
Td5xUest5XOdDn44kgp5
=tg6H
-----END PGP SIGNATURE-----
More information about the Users
mailing list