[strongSwan] Masquerade iptables statements override strongswan policies
readme at catastrophe.net
readme at catastrophe.net
Sun Apr 3 00:01:27 CEST 2022
Hi,
I have strongSwan running on a raspberry pi that has ipsec connections to
an OpenBSD iked gateway and it is working well. However, clients on the
network behind the pi seem to have issues sending traffic over tunnels
unless I remove my masquerading iptables configuration; specifically, this
one:
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere
Without this entry I'm seeing packets sent upstream outside of the tunnel.
In ASCII art, I'm trying to achieve this fairly standard configuration:
+@@@@@@@@@@+
@ Internet @
+@@@@@@@@@@+
|
| 0/0 route
|
wlan1:192.168.31.26 (DHCP assigned)
+----+ +-------+
|swan|~~~~~~~~~~~~~~ipsec tunnel~~~~~~~~|openbsd|
+----+ +-------+
eth0:10.254.223.1/25 em0:100.64.1.92
wlan0:10.254.223.129/25 lan:10.254.255.1/24
When I start strongSwan without any NAT rules, I'm able to ping from clients
behind the pi device (swan: 10.254.223.128/25, etc.) to 10.254.255.1, but
default route traffic gets dropped from the upstream Internet device (as it
is RFC1918 space and filtered).
Are there specific NAT statements that need to be in place as an exception
to the traffic that will be encapsulated by strongSwan and sent to the
remote peer?
Any help is appreciated; thank you very much in advance.
# ip xfrm policy
src 10.254.223.0/24 dst 192.168.72.0/22
dir out priority 376447
tmpl src 192.168.31.26 dst 100.64.1.92
proto esp spi 0xe112339a reqid 1 mode tunnel
src 10.254.223.0/24 dst 10.254.255.0/24
dir out priority 375423
tmpl src 192.168.31.26 dst 100.64.1.92
proto esp spi 0xe112339a reqid 1 mode tunnel
src 10.254.223.0/24 dst 10.253.255.0/24
dir out priority 375423
tmpl src 192.168.31.26 dst 100.64.1.92
proto esp spi 0xe112339a reqid 1 mode tunnel
src 192.168.72.0/22 dst 10.254.223.0/24
dir fwd priority 376447
tmpl src 100.64.1.92 dst 192.168.31.26
proto esp reqid 1 mode tunnel
src 192.168.72.0/22 dst 10.254.223.0/24
dir in priority 376447
tmpl src 100.64.1.92 dst 192.168.31.26
proto esp reqid 1 mode tunnel
src 10.254.255.0/24 dst 10.254.223.0/24
dir fwd priority 375423
tmpl src 100.64.1.92 dst 192.168.31.26
proto esp reqid 1 mode tunnel
src 10.254.255.0/24 dst 10.254.223.0/24
dir in priority 375423
tmpl src 100.64.1.92 dst 192.168.31.26
proto esp reqid 1 mode tunnel
src 10.253.255.0/24 dst 10.254.223.0/24
dir fwd priority 375423
tmpl src 100.64.1.92 dst 192.168.31.26
proto esp reqid 1 mode tunnel
src 10.253.255.0/24 dst 10.254.223.0/24
dir in priority 375423
tmpl src 100.64.1.92 dst 192.168.31.26
proto esp reqid 1 mode tunnel
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0
src ::/0 dst ::/0
socket in priority 0
src ::/0 dst ::/0
socket out priority 0
src ::/0 dst ::/0
socket in priority 0
src ::/0 dst ::/0
socket out priority 0
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT udp -- anywhere 10.254.223.129 udp dpt:domain to:127.0.0.1:53
DNAT tcp -- anywhere 10.254.223.129 tcp dpt:domain to:127.0.0.1:53
DNAT udp -- anywhere 10.254.223.1 udp dpt:domain to:127.0.0.1:53
DNAT tcp -- anywhere 10.254.223.1 tcp dpt:domain to:127.0.0.1:53
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere
# cat /etc/ipsec.conf
config setup
charondebug="all"
uniqueids=yes
conn openbsd
type=tunnel
auto=start
keyexchange=ikev2
authby=secret
left=%any4
leftsubnet=10.254.223.0/24
leftauth=secret
leftid=swan.example.com
leftfirewall=yes
right=100.64.1.92
rightsubnet=10.253.255.0/24,10.254.255.0/24,192.168.72.0/22
rightid=openbsd.example.com
rightauth=secret
ike=aes256-sha512-prfsha512-ecp521
esp=aes256-sha512-prfsha512-ecp521
ikelifetime=4h
keyingtries=%forever
dpddelay=30s
dpdtimeout=120s
dpdaction=restart
# cat /var/log/charon_debug.log
Sat, 2022-04-02, 16:32:40 00[DMN] Starting IKE charon daemon (strongSwan 5.9.1, Linux 5.10.103-v7+, armv7l)
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'aes': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'rc2': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'sha2': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'sha1': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'md5': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'mgf1': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'random': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'nonce': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'x509': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'revocation': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'constraints': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'pubkey': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'pkcs1': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'pkcs7': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'pkcs8': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'pkcs12': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'pgp': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'dnskey': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'sshkey': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'pem': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'openssl': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'fips-prf': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'gmp': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'agent': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'xcbc': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'hmac': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'gcm': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'drbg': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'attr': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'kernel-netlink': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'resolve': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'socket-default': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'connmark': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'stroke': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'updown': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'eap-mschapv2': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'xauth-generic': loaded successfully
Sat, 2022-04-02, 16:32:40 00[LIB] plugin 'counters': loaded successfully
Sat, 2022-04-02, 16:32:40 00[KNL] known interfaces and IP addresses:
Sat, 2022-04-02, 16:32:40 00[KNL] lo
Sat, 2022-04-02, 16:32:40 00[KNL] 127.0.0.1
Sat, 2022-04-02, 16:32:40 00[KNL] ::1
Sat, 2022-04-02, 16:32:40 00[KNL] eth0
Sat, 2022-04-02, 16:32:40 00[KNL] 10.254.223.1
Sat, 2022-04-02, 16:32:40 00[KNL] wlan0
Sat, 2022-04-02, 16:32:40 00[KNL] 10.254.223.129
Sat, 2022-04-02, 16:32:40 00[KNL] wlan1
Sat, 2022-04-02, 16:32:40 00[KNL] 192.168.31.26
Sat, 2022-04-02, 16:32:40 00[LIB] feature PUBKEY:BLISS in plugin 'pem' has unmet dependency: PUBKEY:BLISS
Sat, 2022-04-02, 16:32:40 00[LIB] feature PUBKEY:DSA in plugin 'pem' has unmet dependency: PUBKEY:DSA
Sat, 2022-04-02, 16:32:40 00[LIB] feature PRIVKEY:DSA in plugin 'pem' has unmet dependency: PRIVKEY:DSA
Sat, 2022-04-02, 16:32:40 00[LIB] feature PRIVKEY:BLISS in plugin 'pem' has unmet dependency: PRIVKEY:BLISS
Sat, 2022-04-02, 16:32:40 00[LIB] feature CERT_DECODE:OCSP_REQUEST in plugin 'pem' has unmet dependency: CERT_DECODE:OCSP_REQUEST
Sat, 2022-04-02, 16:32:40 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
Sat, 2022-04-02, 16:32:40 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
Sat, 2022-04-02, 16:32:40 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
Sat, 2022-04-02, 16:32:40 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
Sat, 2022-04-02, 16:32:40 00[CFG] loading crls from '/etc/ipsec.d/crls'
Sat, 2022-04-02, 16:32:40 00[CFG] loading secrets from '/etc/ipsec.secrets'
Sat, 2022-04-02, 16:32:40 00[CFG] loaded IKE secret for "swan.example.com" "openbsd.example.com"
Sat, 2022-04-02, 16:32:40 00[CFG] loaded IKE secret for "swan.example.com" "openbsd.example.com"
Sat, 2022-04-02, 16:32:40 00[LIB] loaded plugins: charon aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm drbg attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters
Sat, 2022-04-02, 16:32:40 00[LIB] unable to load 5 plugin features (5 due to unmet dependencies)
Sat, 2022-04-02, 16:32:40 00[LIB] dropped capabilities, running as uid 0, gid 0
Sat, 2022-04-02, 16:32:40 00[JOB] spawning 16 worker threads
Sat, 2022-04-02, 16:32:40 01[LIB] created thread 01 [1714]
Sat, 2022-04-02, 16:32:40 02[LIB] created thread 02 [1715]
Sat, 2022-04-02, 16:32:40 03[LIB] created thread 03 [1716]
Sat, 2022-04-02, 16:32:40 04[LIB] created thread 04 [1717]
Sat, 2022-04-02, 16:32:40 05[LIB] created thread 05 [1718]
Sat, 2022-04-02, 16:32:40 06[LIB] created thread 06 [1719]
Sat, 2022-04-02, 16:32:40 07[LIB] created thread 07 [1720]
Sat, 2022-04-02, 16:32:40 08[LIB] created thread 08 [1721]
Sat, 2022-04-02, 16:32:40 09[LIB] created thread 09 [1722]
Sat, 2022-04-02, 16:32:40 10[LIB] created thread 10 [1723]
Sat, 2022-04-02, 16:32:40 11[LIB] created thread 11 [1724]
Sat, 2022-04-02, 16:32:40 12[LIB] created thread 12 [1725]
Sat, 2022-04-02, 16:32:40 13[LIB] created thread 13 [1726]
Sat, 2022-04-02, 16:32:40 14[LIB] created thread 14 [1727]
Sat, 2022-04-02, 16:32:40 15[LIB] created thread 15 [1728]
Sat, 2022-04-02, 16:32:40 16[LIB] created thread 16 [1729]
Sat, 2022-04-02, 16:32:40 06[CFG] received stroke: add connection 'openbsd'
Sat, 2022-04-02, 16:32:40 06[CFG] conn openbsd
Sat, 2022-04-02, 16:32:40 06[CFG] left=%any4
Sat, 2022-04-02, 16:32:40 06[CFG] leftsubnet=10.254.223.0/24
Sat, 2022-04-02, 16:32:40 06[CFG] leftauth=secret
Sat, 2022-04-02, 16:32:40 06[CFG] leftid=swan.example.com
Sat, 2022-04-02, 16:32:40 06[CFG] leftupdown=ipsec _updown iptables
Sat, 2022-04-02, 16:32:40 06[CFG] right=100.64.1.92
Sat, 2022-04-02, 16:32:40 06[CFG] rightsubnet=10.253.255.0/24,10.254.255.0/24,192.168.72.0/22
Sat, 2022-04-02, 16:32:40 06[CFG] rightauth=secret
Sat, 2022-04-02, 16:32:40 06[CFG] rightid=openbsd.example.com
Sat, 2022-04-02, 16:32:40 06[CFG] ike=aes256-sha512-prfsha512-ecp521
Sat, 2022-04-02, 16:32:40 06[CFG] esp=aes256-sha512-prfsha512-ecp521
Sat, 2022-04-02, 16:32:40 06[CFG] dpddelay=30
Sat, 2022-04-02, 16:32:40 06[CFG] dpdtimeout=120
Sat, 2022-04-02, 16:32:40 06[CFG] dpdaction=3
Sat, 2022-04-02, 16:32:40 06[CFG] sha256_96=no
Sat, 2022-04-02, 16:32:40 06[CFG] mediation=no
Sat, 2022-04-02, 16:32:40 06[CFG] keyexchange=ikev2
Sat, 2022-04-02, 16:32:40 06[KNL] 100.64.1.92 is not a local address or the interface is down
Sat, 2022-04-02, 16:32:40 06[CFG] added configuration 'openbsd'
Sat, 2022-04-02, 16:32:40 07[CFG] received stroke: initiate 'openbsd'
Sat, 2022-04-02, 16:32:40 07[KNL] <openbsd|1> using 192.168.31.26 as address to reach 100.64.1.92/32
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> queueing IKE_VENDOR task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> queueing IKE_INIT task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> queueing IKE_NATD task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> queueing IKE_CERT_PRE task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> queueing IKE_AUTH task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> queueing IKE_CERT_POST task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> queueing IKE_CONFIG task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> queueing IKE_AUTH_LIFETIME task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> queueing IKE_MOBIKE task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> queueing IKE_ME task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> queueing CHILD_CREATE task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating new tasks
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating IKE_VENDOR task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating IKE_INIT task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating IKE_NATD task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating IKE_CERT_PRE task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating IKE_ME task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating IKE_AUTH task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating IKE_CERT_POST task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating IKE_CONFIG task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating CHILD_CREATE task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating IKE_AUTH_LIFETIME task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> activating IKE_MOBIKE task
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> initiating IKE_SA openbsd[1] to 100.64.1.92
Sat, 2022-04-02, 16:32:40 07[IKE] <openbsd|1> IKE_SA openbsd[1] state change: CREATED => CONNECTING
Sat, 2022-04-02, 16:32:40 07[CFG] <openbsd|1> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/HMAC_SHA1_96/AES_XCBC_96/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/CURVE_448/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048, IKE:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/CHACHA20_POLY1305/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/CURVE_448/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
Sat, 2022-04-02, 16:32:40 07[CFG] <openbsd|1> sending supported signature hash algorithms: sha256 sha384 sha512 identity
Sat, 2022-04-02, 16:32:40 07[ENC] <openbsd|1> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Sat, 2022-04-02, 16:32:40 07[NET] <openbsd|1> sending packet: from 192.168.31.26[500] to 100.64.1.92[500] (880 bytes)
Sat, 2022-04-02, 16:32:40 09[NET] <openbsd|1> received packet: from 100.64.1.92[500] to 192.168.31.26[500] (322 bytes)
Sat, 2022-04-02, 16:32:40 09[ENC] <openbsd|1> parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) ]
Sat, 2022-04-02, 16:32:40 09[IKE] <openbsd|1> received SIGNATURE_HASH_ALGORITHMS notify
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> selecting proposal:
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> proposal matches
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> received proposals: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/HMAC_SHA1_96/AES_XCBC_96/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/CURVE_448/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048, IKE:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/CHACHA20_POLY1305/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/CURVE_448/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/ECP_521
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> received supported signature hash algorithms: sha256 sha384 sha512
Sat, 2022-04-02, 16:32:40 09[IKE] <openbsd|1> local host is behind NAT, sending keep alives
Sat, 2022-04-02, 16:32:40 09[IKE] <openbsd|1> reinitiating already active tasks
Sat, 2022-04-02, 16:32:40 09[IKE] <openbsd|1> IKE_CERT_PRE task
Sat, 2022-04-02, 16:32:40 09[IKE] <openbsd|1> IKE_AUTH task
Sat, 2022-04-02, 16:32:40 09[IKE] <openbsd|1> authentication of 'swan.example.com' (myself) with pre-shared key
Sat, 2022-04-02, 16:32:40 09[IKE] <openbsd|1> successfully created shared key MAC
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> proposing traffic selectors for us:
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> 10.254.223.0/24
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> proposing traffic selectors for other:
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> 10.253.255.0/24
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> 10.254.255.0/24
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> 192.168.72.0/22
Sat, 2022-04-02, 16:32:40 09[CFG] <openbsd|1> configured proposals: ESP:AES_CBC_256/HMAC_SHA2_512_256/NO_EXT_SEQ, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/HMAC_SHA1_96/AES_XCBC_96/NO_EXT_SEQ, ESP:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256
Sat, 2022-04-02, 16:32:40 09[IKE] <openbsd|1> establishing CHILD_SA openbsd{1}
Sat, 2022-04-02, 16:32:40 09[KNL] <openbsd|1> got SPI cda16a87
Sat, 2022-04-02, 16:32:40 09[ENC] <openbsd|1> generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Sat, 2022-04-02, 16:32:40 09[NET] <openbsd|1> sending packet: from 192.168.31.26[4500] to 100.64.1.92[4500] (544 bytes)
Sat, 2022-04-02, 16:32:40 10[NET] <openbsd|1> received packet: from 100.64.1.92[4500] to 192.168.31.26[4500] (336 bytes)
Sat, 2022-04-02, 16:32:40 10[ENC] <openbsd|1> parsed IKE_AUTH response 1 [ IDr AUTH N(MOBIKE_SUP) SA TSi TSr ]
Sat, 2022-04-02, 16:32:40 10[IKE] <openbsd|1> authentication of 'openbsd.example.com' with pre-shared key successful
Sat, 2022-04-02, 16:32:40 10[IKE] <openbsd|1> IKE_SA openbsd[1] established between 192.168.31.26[swan.example.com]...100.64.1.92[openbsd.example.com]
Sat, 2022-04-02, 16:32:40 10[IKE] <openbsd|1> IKE_SA openbsd[1] state change: CONNECTING => ESTABLISHED
Sat, 2022-04-02, 16:32:40 10[IKE] <openbsd|1> scheduling reauthentication in 13362s
Sat, 2022-04-02, 16:32:40 10[IKE] <openbsd|1> maximum IKE_SA lifetime 13902s
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> selecting proposal:
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> proposal matches
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> received proposals: ESP:AES_CBC_256/HMAC_SHA2_512_256/NO_EXT_SEQ
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> configured proposals: ESP:AES_CBC_256/HMAC_SHA2_512_256/ECP_521/NO_EXT_SEQ, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/HMAC_SHA1_96/AES_XCBC_96/NO_EXT_SEQ, ESP:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> selected proposal: ESP:AES_CBC_256/HMAC_SHA2_512_256/NO_EXT_SEQ
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> selecting traffic selectors for us:
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 10.254.223.0/24, received: 10.254.223.0/24 => match: 10.254.223.0/24
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> selecting traffic selectors for other:
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 10.253.255.0/24, received: 192.168.72.0/22 => no match
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 10.253.255.0/24, received: 10.253.255.0/24 => match: 10.253.255.0/24
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 10.253.255.0/24, received: 10.254.255.0/24 => no match
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 10.253.255.0/24, received: 10.255.255.0/24 => no match
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 10.254.255.0/24, received: 192.168.72.0/22 => no match
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 10.254.255.0/24, received: 10.253.255.0/24 => no match
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 10.254.255.0/24, received: 10.254.255.0/24 => match: 10.254.255.0/24
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 10.254.255.0/24, received: 10.255.255.0/24 => no match
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 192.168.72.0/22, received: 192.168.72.0/22 => match: 192.168.72.0/22
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 192.168.72.0/22, received: 10.253.255.0/24 => no match
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 192.168.72.0/22, received: 10.254.255.0/24 => no match
Sat, 2022-04-02, 16:32:40 10[CFG] <openbsd|1> config: 192.168.72.0/22, received: 10.255.255.0/24 => no match
Sat, 2022-04-02, 16:32:40 10[CHD] <openbsd|1> CHILD_SA openbsd{1} state change: CREATED => INSTALLING
Sat, 2022-04-02, 16:32:40 10[CHD] <openbsd|1> using AES_CBC for encryption
Sat, 2022-04-02, 16:32:40 10[CHD] <openbsd|1> using HMAC_SHA2_512_256 for integrity
Sat, 2022-04-02, 16:32:40 10[CHD] <openbsd|1> adding inbound ESP SA
Sat, 2022-04-02, 16:32:40 10[CHD] <openbsd|1> SPI 0xcda16a87, src 100.64.1.92 dst 192.168.31.26
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> adding SAD entry with SPI cda16a87 and reqid {1}
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using encryption algorithm AES_CBC with key size 256
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using integrity algorithm HMAC_SHA2_512_256 with key size 512
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using replay window of 32 packets
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> HW offload: no
Sat, 2022-04-02, 16:32:40 10[CHD] <openbsd|1> adding outbound ESP SA
Sat, 2022-04-02, 16:32:40 10[CHD] <openbsd|1> SPI 0x7e5fb1a3, src 192.168.31.26 dst 100.64.1.92
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> adding SAD entry with SPI 7e5fb1a3 and reqid {1}
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using encryption algorithm AES_CBC with key size 256
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using integrity algorithm HMAC_SHA2_512_256 with key size 512
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using replay window of 0 packets
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> HW offload: no
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> adding policy 10.253.255.0/24 === 10.254.223.0/24 in [priority 375423, refcount 1]
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> adding policy 10.253.255.0/24 === 10.254.223.0/24 fwd [priority 375423, refcount 1]
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> adding policy 10.254.223.0/24 === 10.253.255.0/24 out [priority 375423, refcount 1]
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting a local address in traffic selector 10.254.223.0/24
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using host 10.254.223.1
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting iface name for index 4
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using 192.168.28.1 as nexthop and wlan1 as dev to reach 100.64.1.92/32
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> installing route: 10.253.255.0/24 via 192.168.28.1 src 10.254.223.1 dev wlan1
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting iface index for wlan1
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> adding policy 10.254.255.0/24 === 10.254.223.0/24 in [priority 375423, refcount 1]
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> adding policy 10.254.255.0/24 === 10.254.223.0/24 fwd [priority 375423, refcount 1]
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> adding policy 10.254.223.0/24 === 10.254.255.0/24 out [priority 375423, refcount 1]
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting a local address in traffic selector 10.254.223.0/24
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using host 10.254.223.1
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting iface name for index 4
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using 192.168.28.1 as nexthop and wlan1 as dev to reach 100.64.1.92/32
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> installing route: 10.254.255.0/24 via 192.168.28.1 src 10.254.223.1 dev wlan1
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting iface index for wlan1
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> adding policy 192.168.72.0/22 === 10.254.223.0/24 in [priority 376447, refcount 1]
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> adding policy 192.168.72.0/22 === 10.254.223.0/24 fwd [priority 376447, refcount 1]
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> adding policy 10.254.223.0/24 === 192.168.72.0/22 out [priority 376447, refcount 1]
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting a local address in traffic selector 10.254.223.0/24
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using host 10.254.223.1
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting iface name for index 4
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using 192.168.28.1 as nexthop and wlan1 as dev to reach 100.64.1.92/32
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> installing route: 192.168.72.0/22 via 192.168.28.1 src 10.254.223.1 dev wlan1
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting iface index for wlan1
Sat, 2022-04-02, 16:32:40 10[IKE] <openbsd|1> CHILD_SA openbsd{1} established with SPIs cda16a87_i 7e5fb1a3_o and TS 10.254.223.0/24 === 10.253.255.0/24 10.254.255.0/24 192.168.72.0/22
Sat, 2022-04-02, 16:32:40 10[CHD] <openbsd|1> CHILD_SA openbsd{1} state change: INSTALLING => INSTALLED
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting iface name for index 4
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using 192.168.28.1 as nexthop and wlan1 as dev to reach 100.64.1.92/32
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting iface name for index 4
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using 192.168.28.1 as nexthop and wlan1 as dev to reach 100.64.1.92/32
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> getting iface name for index 4
Sat, 2022-04-02, 16:32:40 10[KNL] <openbsd|1> using 192.168.28.1 as nexthop and wlan1 as dev to reach 100.64.1.92/32
Sat, 2022-04-02, 16:32:40 10[IKE] <openbsd|1> peer supports MOBIKE
Sat, 2022-04-02, 16:32:40 10[IKE] <openbsd|1> activating new tasks
Sat, 2022-04-02, 16:32:40 10[IKE] <openbsd|1> nothing to initiate
More information about the Users
mailing list