[strongSwan] Ping does not come back / but its visible in tcpdump
Valeri Geiser
valeri.geiser at km-logistik-service.de
Mon Nov 25 07:38:44 CET 2019
Hi,
I am new to strongswan and I just had to setup a connection to a Lancom
router. So far, I worked through the documentation and the ikev2 tunnel
gets established and policy-based routing installed.
Now I am trying to ping the vpn gateway using the internal network
address. I can see the packet leaving in tcpdump, I can see in the
Lancom traces the receipt and response created (to correct virtual
address using correct tunnel) and I can see in tcpdump on the client
also that a package comes back. However, ping says it did not get
anything. This is the same also when I shut down the firewall and set
everything to accept, so it should not be a firewall issue.
Here is my swanctl.conf
connections {
home {
version = 2
local_addrs = A.A.A.A (external IP of client, no NAT involved)
remote_addrs = B.B.B.B(external IP of lancom, no NAT involved)
local {
auth = psk
id = clst01 at km-logistik-service.de
}
remote {
auth = psk
id = B.B.B.B
}
children {
home {
remote_ts = 10.131.208.0/24,10.166.47.8/29
updown = /usr/lib/ipsec/_updown iptables
}
}
vips = 0.0.0.0
}
}
secrets {
ike {
secret = *****
id = B.B.B.B
}
}
Here is connection start with swanctl
swanctl --initiate --child home
[IKE] initiating IKE_SA home[1] to B.B.B.B
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP)
N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
[NET] sending packet: from A.A.A.A[500] to B.B.B.B[500] (760 bytes)
[NET] received packet: from B.B.B.B[500] to [500] (38 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
[IKE] peer didn't accept DH group ECP_256, it requested MODP_2048
[IKE] initiating IKE_SA home[1] to B.B.B.B
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP)
N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
[NET] sending packet: from A.A.A.A[500] to B.B.B.B[500] (952 bytes)
[NET] received packet: from B.B.B.B[500] to A.A.A.A[500] (464 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP)
N(FRAG_SUP) V ]
[ENC] received unknown vendor ID:
81:75:2e:b5:91:4d:73:5c:df:cd:c8:58:c3:a8:ed:7c:1c:66:d1:42
[CFG] selected proposal:
IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
[IKE] authentication of 'clst01 at km-logistik-service.de' (myself) with
pre-shared key
[IKE] establishing CHILD_SA home{1}
[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH
CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(EAP_ONLY)
N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from A.A.A.A[4500] to B.B.B.B[4500] (384 bytes)
[NET] received packet: from B.B.B.B[4500] to A.A.A.A[4500] (256 bytes)
[ENC] parsed IKE_AUTH response 1 [ IDr AUTH CPRP(DNS ADDR) TSi TSr
N(INIT_CONTACT) SA ]
[IKE] authentication of 'B.B.B.B' with pre-shared key successful
[IKE] IKE_SA home[1] established between
A.A.A.A[clst01 at km-logistik-service.de]...B.B.B.B[B.B.B.B]
[IKE] scheduling rekeying in 14018s
[IKE] maximum IKE_SA lifetime 15458s
[IKE] installing DNS server 10.166.47.12 to /etc/resolv.conf
[IKE] installing new virtual IP 172.16.103.12
[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ
[IKE] CHILD_SA home{1} established with SPIs ca7ea316_i efb49814_o and
TS 172.16.103.12/32 === 10.166.47.8/29
initiate completed successfully
Here is policies for routing (relevant parts):
ip -s xfrm policy
src 172.16.103.12/32 dst 10.166.47.8/29 uid 0
dir out action allow index 1217 priority 368767 ptype main share
any flag (0x00000000)
lifetime config:
limit: soft (INF)(bytes), hard (INF)(bytes)
limit: soft (INF)(packets), hard (INF)(packets)
expire add: soft 0(sec), hard 0(sec)
expire use: soft 0(sec), hard 0(sec)
lifetime current:
0(bytes), 0(packets)
add 2019-11-23 22:15:04 use 2019-11-23 22:16:46
tmpl src A.A.A.A dst B.B.B.B
proto esp spi 0xefb49814(4021590036) reqid 1(0x00000001) mode
tunnel
level required share any
enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff
src 10.166.47.8/29 dst 172.16.103.12/32 uid 0
dir fwd action allow index 1210 priority 368767 ptype main share
any flag (0x00000000)
lifetime config:
limit: soft (INF)(bytes), hard (INF)(bytes)
limit: soft (INF)(packets), hard (INF)(packets)
expire add: soft 0(sec), hard 0(sec)
expire use: soft 0(sec), hard 0(sec)
lifetime current:
0(bytes), 0(packets)
add 2019-11-23 22:15:04 use -
tmpl src B.B.B.B dst A.A.A.A
proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel
level required share any
enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff
src 10.166.47.8/29 dst 172.16.103.12/32 uid 0
dir in action allow index 1200 priority 368767 ptype main share any
flag (0x00000000)
lifetime config:
limit: soft (INF)(bytes), hard (INF)(bytes)
limit: soft (INF)(packets), hard (INF)(packets)
expire add: soft 0(sec), hard 0(sec)
expire use: soft 0(sec), hard 0(sec)
lifetime current:
0(bytes), 0(packets)
add 2019-11-23 22:15:04 use -
tmpl src B.B.B.B dst A.A.A.A
proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel
level required share any
enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff
Here is tcpdump from what I think is the ping and its response (pinging
10.166.47.12 which is assigned to Lancom on ethernet port 1):
22:03:20.304824 IP (tos 0x0, ttl 64, id 1894, offset 0, flags [DF],
proto ESP (50), length 140)
A.A.A.A > B.B.B.B: ESP(spi=0xbf3e0bb5,seq=0x224), length 120
22:03:20.320540 IP (tos 0x0, ttl 57, id 34530, offset 0, flags [none],
proto UDP (17), length 148)
B.B.B.B.ipsec-nat-t > A.A.A.A.ipsec-nat-t: [no cksum] UDP-encap:
ESP(spi=0xc9012da8,seq=0x223), length 120
I am just clueless now and any help is appreciated. Let me know if any
further information is required.
--
Bei Fragen oder Unklarheiten stehen wir Ihnen gerne zur Verfügung.
MFG, Valeri Geiser
*KM Logistik - Service GmbH
Hauptstraße 2
66459 Kirkel-Limbach*
*
Phone: *(+49) 68417567899
*Fax: *(+49) 6841 9933441
*Email:*valeri.geiser at km-logistik-service.de
<mailto:valeri.geiser at km-logistik-service.de>
*Web:*http://km-logistik-service.de <http://km-logistik-service.de/>
KM Logistik - Service Gesellschaft mit beschränkter Haftung
Sitz der Gesellschaft: 66459 Kirkel | Geschäftsführer: Klaus Miosga |
Registergericht: Homburg HRB 17405
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20191125/d74c7b6c/attachment.html>
More information about the Users
mailing list