[strongSwan] firewall issue?

Harald Dunkel harald.dunkel at aixigo.de
Fri Jul 1 15:48:38 CEST 2016


Hi folks,

environment:
	IPsec gateway/firewall, Debian 8
	strongswan 5.4.0
	kernel 4.5.4-1~bpo8+1
	about 30 road warriors (OS X, iphones)
	IKEv1, IPv4 only, NAT at both sides

problem:

I see a number of DNS queries via IPsec blocked at the
internal firewall each day (apparently on the incoming
side eth0 pointing to the internet). Most of the queries
are not blocked, though.

Within the last month the percentage of blocked DNS
queries became worse. Much worse. Users started
complaining.

Sample:
:
Jul  1 14:56:55 gate1 kernel: [11376.265578] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.62 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=8365 PROTO=UDP SPT=53772 DPT=53 LEN=46
Jul  1 14:56:55 gate1 kernel: [11376.265606] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.62 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=9010 PROTO=UDP SPT=59360 DPT=53 LEN=46
Jul  1 15:04:21 gate1 kernel: [11822.343540] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.64 DST=172.19.96.123 LEN=67 TOS=0x00 PREC=0x00 TTL=254 ID=3336 PROTO=UDP SPT=65510 DPT=53 LEN=47
Jul  1 15:04:21 gate1 kernel: [11822.343549] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.64 DST=172.19.96.123 LEN=67 TOS=0x00 PREC=0x00 TTL=254 ID=16828 PROTO=UDP SPT=65055 DPT=53 LEN=47
Jul  1 15:04:21 gate1 kernel: [11822.343933] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.64 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=41728 PROTO=UDP SPT=49163 DPT=53 LEN=46
Jul  1 15:04:21 gate1 kernel: [11822.343939] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.64 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=3549 PROTO=UDP SPT=54079 DPT=53 LEN=46
Jul  1 15:04:21 gate1 kernel: [11822.393433] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.66 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=64135 PROTO=UDP SPT=64653 DPT=53 LEN=46
Jul  1 15:04:21 gate1 kernel: [11822.393448] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.66 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=4824 PROTO=UDP SPT=60342 DPT=53 LEN=46
Jul  1 15:04:21 gate1 kernel: [11822.393455] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.66 DST=172.19.96.123 LEN=67 TOS=0x00 PREC=0x00 TTL=254 ID=27700 PROTO=UDP SPT=54769 DPT=53 LEN=47
Jul  1 15:04:21 gate1 kernel: [11822.393461] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.66 DST=172.19.96.123 LEN=67 TOS=0x00 PREC=0x00 TTL=254 ID=17238 PROTO=UDP SPT=51462 DPT=53 LEN=47
Jul  1 15:04:25 gate1 kernel: [11825.955926] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.59 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=48167 PROTO=UDP SPT=55059 DPT=53 LEN=46
Jul  1 15:04:25 gate1 kernel: [11825.955939] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.59 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=22942 PROTO=UDP SPT=59174 DPT=53 LEN=46
Jul  1 15:04:25 gate1 kernel: [11826.071637] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.60 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=26638 PROTO=UDP SPT=50563 DPT=53 LEN=46
Jul  1 15:04:25 gate1 kernel: [11826.071651] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.60 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=41367 PROTO=UDP SPT=62579 DPT=53 LEN=46
Jul  1 15:04:25 gate1 kernel: [11826.071944] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.60 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=39892 PROTO=UDP SPT=61569 DPT=53 LEN=46
Jul  1 15:04:25 gate1 kernel: [11826.072200] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.60 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=6242 PROTO=UDP SPT=59746 DPT=53 LEN=46
Jul  1 15:06:07 gate1 kernel: [11927.933124] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.69 DST=172.19.96.123 LEN=79 TOS=0x00 PREC=0x00 TTL=254 ID=25119 PROTO=UDP SPT=57108 DPT=53 LEN=59
Jul  1 15:06:07 gate1 kernel: [11927.933179] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.69 DST=172.19.96.123 LEN=79 TOS=0x00 PREC=0x00 TTL=254 ID=12174 PROTO=UDP SPT=51598 DPT=53 LEN=59
Jul  1 15:06:07 gate1 kernel: [11927.933422] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.69 DST=172.19.96.123 LEN=68 TOS=0x00 PREC=0x00 TTL=254 ID=16509 PROTO=UDP SPT=58484 DPT=53 LEN=48
Jul  1 15:06:07 gate1 kernel: [11927.933465] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.69 DST=172.19.96.123 LEN=68 TOS=0x00 PREC=0x00 TTL=254 ID=7646 PROTO=UDP SPT=61916 DPT=53 LEN=48
Jul  1 15:06:07 gate1 kernel: [11927.933505] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.69 DST=172.19.96.123 LEN=67 TOS=0x00 PREC=0x00 TTL=254 ID=20788 PROTO=UDP SPT=53271 DPT=53 LEN=47
Jul  1 15:09:45 gate1 kernel: [12146.056788] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.67 DST=172.19.96.123 LEN=63 TOS=0x00 PREC=0x00 TTL=254 ID=22379 PROTO=UDP SPT=65313 DPT=53 LEN=43
Jul  1 15:09:45 gate1 kernel: [12146.056806] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.67 DST=172.19.96.123 LEN=63 TOS=0x00 PREC=0x00 TTL=254 ID=60135 PROTO=UDP SPT=52471 DPT=53 LEN=43
Jul  1 15:10:28 gate1 kernel: [12189.111651] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.82 DST=172.19.96.123 LEN=67 TOS=0x00 PREC=0x00 TTL=254 ID=37592 PROTO=UDP SPT=57635 DPT=53 LEN=47
Jul  1 15:10:28 gate1 kernel: [12189.111665] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.82 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=38421 PROTO=UDP SPT=56817 DPT=53 LEN=46
Jul  1 15:19:29 gate1 kernel: [12730.187809] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.82 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=8935 PROTO=UDP SPT=63992 DPT=53 LEN=46
Jul  1 15:19:29 gate1 kernel: [12730.187820] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.82 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=47825 PROTO=UDP SPT=64264 DPT=53 LEN=46
Jul  1 15:19:29 gate1 kernel: [12730.188127] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.82 DST=172.19.96.123 LEN=67 TOS=0x00 PREC=0x00 TTL=254 ID=33733 PROTO=UDP SPT=51037 DPT=53 LEN=47
Jul  1 15:19:29 gate1 kernel: [12730.188140] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.82 DST=172.19.96.123 LEN=67 TOS=0x00 PREC=0x00 TTL=254 ID=54296 PROTO=UDP SPT=59694 DPT=53 LEN=47
Jul  1 15:23:52 gate1 kernel: [12993.250567] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.85 DST=172.19.96.123 LEN=67 TOS=0x00 PREC=0x00 TTL=254 ID=29862 PROTO=UDP SPT=57199 DPT=53 LEN=47
Jul  1 15:23:52 gate1 kernel: [12993.250577] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.85 DST=172.19.96.123 LEN=67 TOS=0x00 PREC=0x00 TTL=254 ID=2437 PROTO=UDP SPT=52012 DPT=53 LEN=47
Jul  1 15:23:52 gate1 kernel: [12993.250810] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.85 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=59470 PROTO=UDP SPT=63261 DPT=53 LEN=46
Jul  1 15:23:52 gate1 kernel: [12993.250817] iptables-dropped: IN=eth0 OUT=eth1 MAC=80:ee:73:a2:e6:17:00:00:5e:00:01:3d:08:00 SRC=172.19.97.85 DST=172.19.96.123 LEN=66 TOS=0x00 PREC=0x00 TTL=254 ID=46145 PROTO=UDP SPT=58775 DPT=53 LEN=46
:

How comes? Did I miss a config item "maximum number of
iptables entries" somewhere in the set of strongswan
config files?

Every helpful comment is highly appreciated.


Regards
Harri
-- 
aixigo AG, Karl-Friedrich-Strasse 68, 52072 Aachen, Germany
phone: +49 241 559709-79, fax: +49 241 559709-99
eMail: harald.dunkel at aixigo.de, web: http://www.aixigo.de
Amtsgericht Aachen - HRB 8057, Vorstand: Erich Borsch, Christian Friedrich, Tobias Haustein, Vors. des Aufsichtsrates: Prof. Dr. Ruediger von Nitzsch
-------------- next part --------------
config setup
	charondebug="dmn 1, mgr 1, ike 1, chd 1, cfg 1, net 1"

conn %default
	left		= gate1.example.com
	leftcert	= gate1.example.com.pem
	leftsendcert	= always
	leftsubnet	= 172.19.96.0/19,172.22.111.0/24,10.47.11.0/24,...
	leftfirewall	= yes
	ikelifetime	= 3h
	lifetime	= 1h
	rekey		= yes
        dpdaction       = none
        dpdtimeout      = 300s		# default: 150s, used for IKEv1 only
        dpddelay        = 60s		# default: 30s

#
# IKEv2 using RSA authentication
conn IPSec-IKEv2
	keyexchange	= ikev2
        ike             = aes256-sha256-modp2048,aes256-sha1-modp1024,aes128-sha1-modp1024!
        esp             = aes256-sha256-modp2048,aes256-sha1-modp1024,aes128-sha1-modp1024,aes256-sha256,aes256-sha1,aes128-sha1!
	right		= %any
	rightauth	= pubkey
	rightsendcert	= ifasked
	rightsourceip	= %dhcp
	# fragmentation = yes
	auto		= add

#
# IKEv1 using xauth
conn CiscoIPSec
	keyexchange	= ikev1
	ike		= aes256-sha1-modp1536!
	esp		= aes256-sha1!
	rightauth	= pubkey
	right		= %any
	rightsourceip	= %dhcp
	rightauth2	= xauth
	auto		= add


More information about the Users mailing list