[strongSwan] StrongSwan w/ multiple local subnets.

TomK tomkcpr at mdevsys.com
Sat Jun 27 00:36:12 CEST 2020


On 6/26/2020 10:04 AM, TomK wrote:
> On 6/24/2020 10:40 AM, TomK wrote:
>> On 6/24/2020 9:19 AM, Tobias Brunner wrote:
>>> Hi Tom,
>>>
>>>> May I ask which exact line above told you I'm missing sfrm_user?  The
>>>> ones that start with CUSTOM?
>>>
>>> Yes, the first one is logged after the kernel-netlink plugin failed to
>>> open a Netlink/XFRM socket, plus it is obviously missing in the module
>>> lists you posted after that.
>>
>> Kool
>>
>>>
>>>> This is DD-WRT so it's a minimized router kernel. I was surprised as 
>>>> the
>>>> next guy learning that module isn't available.
>>>
>>> Yeah, makes not much sense to enable the other IPsec-related modules
>>> without a means to actually use them.  But why did you use the 2.6.23
>>> kernel sources to build the missing module if your router uses a 4.4.190
>>> kernel?
>>
>> Was questions my sanity around that as well but initially only found 
>> the wiki page for 2.6.33 .  The SVN appeared a bit messy to me, 
>> probably because I'm not familiar with it yet, so wasn't sure if they 
>> just reused the folder name or if it was truly for Linux 2.6.33.  And 
>> couldn't find the Linux 4.4's at the time until I rummaged through the 
>> SVN the next day.
>>
>> Look further down on the post.  I've tried the Linux 4.4 branch but 
>> couldn't get that to work.  There's some missing Makefiles.
>>
>>>
>>>> I tinkered around with this at some point.  I had it originating from
>>>> 192.168.0.6 > 10.10.0.4 but same results.  Based on what you wrote,
>>>> unless I get xfrm_user module installed, this won't work regardless of
>>>> what source IP it's coming from?
>>>
>>> No, that's unrelated.  You need that module to use the IPsec stack in
>>> the kernel (i.e. to run without kernel-libipsec or ipsec0 interface).
>>> The whole point of the userland IPsec stack is that it bypasses the
>>> kernel and can run with reduced privileges (e.g. on Android where apps
>>> can create TUN devices via VpnService API but can't access the kernel's
>>> IPsec stack via Netlink/XFRM).
>>>
>>>> instead of originating from the WAN IP. No reply of course.  My routes
>>>
>>> Are ESP packets sent?  If yes, are any returned?  If not, then this
>>> seems to be an issue on the other end.  So try to follow the traffic 
>>> there.
>>
>> That is what I'm not sure about.  Between StrongSwan (SSW) and Azure 
>> VPN Gateway, I'm not able to find which one is it.  I've setup a 
>> packet trace from the Azure VPN Gateway but the only option it gave me 
>> as a target was against one of the Azure VM's.  Not between Azure VPN 
>> Gateway and the on-prem gateway.
>>
>> So in the least I was hoping to confirm if everything was sent 
>> correctly from SSW then I'll be more sure that the issue is really 
>> with Azure VPN Gateway blocking traffic.
>>
>> What I do know is that I can ping from the Azure VM's back down to my 
>> on-prem VLAN (192.168.0.X/24 ) but NOT FROM my router that's running 
>> SSW. In other words, traffic flows only one way.  Down.
>>
>> So to me this looked like an issue where:
>>
>> 1) Like you said, ESP packets are not getting sent properly from SSW 
>> to Azure VPN Gateway.  (  How do I confirm this with 100% certainty?  
>> What should I look for to determine if there's any dropped packets on 
>> my on-prem F/W that's on this router? )
>>
>> 2) The Azure VPN Gateway is blocking on-prem to itself.  I've made 
>> sure the F/W on the Azure side is not an issue.
>>
>>
>>
>>>
>>>> root at DD-WRT:~# ip route
>>>
>>> Again, strongSwan installs its routes in table 220, that is, use `ip
>>> route show table 220` (or `all`).
>>
>> root at DD-WRT:~# ip route show table all
>> default via 100.100.100.50 dev vlan2
>> 10.0.0.0/24 via 192.168.0.1 dev br0  metric 20
>> 10.1.0.0/24 via 192.168.0.1 dev br0  metric 20
>> 10.1.1.0/24 dev tun2 scope link  src 10.1.1.1
>> 10.2.0.0/24 via 192.168.0.1 dev br0  metric 20
>> 10.3.0.0/24 via 192.168.0.1 dev br0  metric 20
>> 100.100.100.75/27 dev vlan2 scope link  src 100.100.100.100
>> 127.0.0.0/8 dev lo scope link
>> 192.168.0.0/24 dev br0 scope link  src 192.168.0.6
>> 192.168.45.0/24 dev wl0.1 scope link  src 192.168.45.1
>> 192.168.75.0/24 dev wl1.1 scope link  src 192.168.75.1
>> broadcast 10.1.1.0 dev tun2 table local scope link  src 10.1.1.1
>> local 10.1.1.1 dev tun2 table local scope host  src 10.1.1.1
>> broadcast 10.1.1.255 dev tun2 table local scope link  src 10.1.1.1
>> broadcast 100.100.100.75 dev vlan2 table local scope link  src 
>> 100.100.100.100
>> local 100.100.100.100 dev vlan2 table local scope host  src 
>> 100.100.100.100
>> broadcast 100.100.100.25 dev vlan2 table local scope link  src 
>> 100.100.100.100
>> broadcast 127.0.0.0 dev lo table local scope link  src 127.0.0.1
>> local 127.0.0.0/8 dev lo table local scope host  src 127.0.0.1
>> local 127.0.0.1 dev lo table local scope host  src 127.0.0.1
>> broadcast 127.255.255.255 dev lo table local scope link  src 127.0.0.1
>> broadcast 192.168.0.0 dev br0 table local scope link  src 192.168.0.6
>> local 192.168.0.6 dev br0 table local scope host  src 192.168.0.6
>> broadcast 192.168.0.255 dev br0 table local scope link  src 192.168.0.6
>> broadcast 192.168.45.0 dev wl0.1 table local scope link  src 192.168.45.1
>> local 192.168.45.1 dev wl0.1 table local scope host  src 192.168.45.1
>> broadcast 192.168.45.255 dev wl0.1 table local scope link  src 
>> 192.168.45.1
>> broadcast 192.168.75.0 dev wl1.1 table local scope link  src 192.168.75.1
>> local 192.168.75.1 dev wl1.1 table local scope host  src 192.168.75.1
>> broadcast 192.168.75.255 dev wl1.1 table local scope link  src 
>> 192.168.75.1
>> root at DD-WRT:~#
>>
>>
>> root at DD-WRT:~# ip route show table 220
>> root at DD-WRT:~#
>>
>>
>> ( Redacted the IP hence why you see 100.100.100.X for the ISP GW )
>>
>>>
>>> Regards,
>>> Tobias
>>>
>>
>>
> 
> What are the dependencies of all these modules listed here?  I'm close 
> and was able to load quite a few:
> 
> https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1209261#1209261
> 
> https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules
> 
> but xfrm_user.ko doesn't insert and suspecting due to missing dependencies:
> 
> root at DD-WRT:/opt/xfrm4# lsmod
> Module                  Size  Used by
> tunnel6                 1691  0
> xfrm4_mode_tunnel       1354  0
> xfrm4_mode_transport      778  0
> xfrm4_mode_beet         1418  0
> ah4                     4540  0
> esp4                    5175  0
> xfrm_ipcomp             2853  0
> xfrm4_tunnel            1368  0
> xfrm_algo               3645  3 ah4,esp4,xfrm_ipcomp
> ip_tunnel              10496  0
> tunnel4                 1692  1 xfrm4_tunnel
> ext4                  319105  1
> jbd2                   50250  1 ext4
> mbcache                 7009  1 ext4
> crc16                   1060  1 ext4
> vhci_hcd               12705  0
> usbip_host             12201  0
> usbip_core              4593  2 vhci_hcd,usbip_host
> usblp                   8913  0
> usb_storage            37587  1
> sr_mod                 11005  0
> cdrom                  24153  1 sr_mod
> sd_mod                 24627  1
> scsi_mod               83966  3 usb_storage,sr_mod,sd_mod
> xhci_plat_hcd           2116  0
> xhci_pci                2632  0
> xhci_hcd               84444  2 xhci_plat_hcd,xhci_pci
> ohci_pci                2157  0
> ohci_hcd               23292  1 ohci_pci
> ehci_pci                2829  0
> ehci_hcd               33905  1 ehci_pci
> usbcore               127988 12 
> vhci_hcd,usbip_host,usblp,usb_storage,xhci_plat_hcd,xhci_pci,xhci_hcd,ohci_pci,ohci_hcd,ehci_pci,ehci_hcd 
> 
> usb_common              1589  2 vhci_hcd,usbcore
> ip6_tables              9261  0
> xt_ndpi               344541  0
> tun                    15569  4
> fast_classifier       138897  0
> jffs2                  92216  1
> lzo_decompress          1764  0
> lzo_compress            1828  0
> lzma_decompress         8228  1 jffs2
> lzma_compress          23664  1 jffs2
> wl                   4384906  0
> switch_robo            13611  0
> switch_core             5449  1 switch_robo
> et                     42648  0
> root at DD-WRT:/opt/xfrm4#
> 
> 
> All others insert just fine as long as they are added in a specific 
> sequence:
> 
> 
> root at DD-WRT:/opt/xfrm4# for mods in $(echo tunnel4.ko ip_tunnel.ko 
> xfrm_algo.ko xfrm4_tunnel.ko xfrm_ipcomp.ko esp4.ko ah4.ko 
> xfrm4_mode_beet.ko xfrm4
> _mode_beet.ko xfrm4_mode_transport.ko xfrm4_mode_tunnel.ko 
> xfrm_user.ko); do insmod $mods; done
> insmod: cannot insert 'tunnel4.ko': File exists
> insmod: cannot insert 'ip_tunnel.ko': File exists
> insmod: cannot insert 'xfrm_algo.ko': File exists
> insmod: cannot insert 'xfrm4_tunnel.ko': File exists
> insmod: cannot insert 'xfrm_ipcomp.ko': File exists
> insmod: cannot insert 'esp4.ko': File exists
> insmod: cannot insert 'ah4.ko': File exists
> insmod: cannot insert 'xfrm4_mode_beet.ko': File exists
> insmod: cannot insert 'xfrm4_mode_beet.ko': File exists
> insmod: cannot insert 'xfrm4_mode_transport.ko': File exists
> insmod: cannot insert 'xfrm4_mode_tunnel.ko': File exists
> insmod: cannot insert 'xfrm_user.ko': unknown symbol in module
> root at DD-WRT:/opt/xfrm4#
> 
> 
> root at DD-WRT:/opt/xfrm4# strings xfrm_user.ko|grep -Ei depends
> depends=xfrm_algo
> root at DD-WRT:/opt/xfrm4# insmod xfrm_algo.ko
> insmod: cannot insert 'xfrm_algo.ko': File exists
> root at DD-WRT:/opt/xfrm4# lsmod|grep xfrm_algo
> xfrm_algo               3645  3 ah4,esp4,xfrm_ipcomp
> root at DD-WRT:/opt/xfrm4#
> 
> 
> 

Is the xfrm_user.ko module used for both traffic going out and coming 
back in via StrongSwan / IPSEC ?



-- 
Thx,
TK.


More information about the Users mailing list