This is a simplification of a bigger problem I'm experiencing, but I think it covers everything. The production issue is between a StrongSWAN VPN and a Juniper SSG550. The network setup is clearly not ideal, but I've inherited it and the client is unwilling to change anything unless absolutely necessary.
There's a subnet-subnet StrongSWAN VPN between an EC2 instance Bob and another non-EC2 instance George. There is also another EC2 instance Fred in the same subnet as Bob.
Bob and George are clean Ubuntu installs. 14.04 and 14.10 respectively. Fred is Oracle Linux Server 10.5
All EC2 instances have the source/destination check disabled.
---------------------- ----------------------
| | | |
| 192.168.1.0/24 | | 10.0.1.0/24 |
| | | |
| ---------------- | | ---------------- |
| | Bob | | | | George | |
| | 192.168.1.12 | | StrongSWAN | | 10.0.1.22 | |
| | |<-------------------->| | |
| | StrongSWAN | | | | StrongSWAN | |
| | | | | | | |
| ---------------- | | ---------------- |
| | | |
| ---------------- | ----------------------
| | Fred | |
| | 192.168.1.28 | |
| | | |
| ---------------- |
| |
----------------------
The ipsec.conf files are as follows:
Bob:
# Connections into AWS VPC
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
authby=secret
conn client
keyexchange=ikev1
ikelifetime=24h
ike=aes256-sha2_256-modp1024
esp=aes256-sha2_256-modp1024
aggressive=no
lifetime=1h
leftsubnet=192.168.0.0/16
[email protected]
leftfirewall=yes
rightfirewall=yes
right=PUBLIC_IP_OF_GEORGE
rightsubnet=10.0.1.0/24
[email protected]
auto=add
George:
# Connections into AWS VPC
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
authby=secret
conn client
keyexchange=ikev1
lifetime=24h
ike=aes256-sha2_256-modp1024
esp=aes256-sha2_256-modp1024
aggressive=no
leftfirewall=yes
leftsubnet=10.0.1.0/24
[email protected]
right=PUBLIC_IP_OF_BOB
rightsubnet=192.168.0.0/16
[email protected]
auto=add
I also added a route for Fred to George.
Fred> route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.0.1.0 192.168.1.12 255.255.255.0 UG 0 0 0 eth0
...
The problem I have is that traffic from George to Fred doesn't get there. Traffic from Fred to George does. Bob and Fred can both ping George. George can ping Bob.
I set up a listening socket on port 4000 on all three instances. Bob and Fred can both connect to the one on George and George can connect to the one on Bob. Obviously Bob and Fred can connect to each other.
Here's a tcpdump for the connection from George to Fred as seen on Bob.
Bob> tcpdump port 4000
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
11:55:37.791967 IP 10.0.1.22.46014 > 192.168.1.28.4000: Flags [S], seq 2922469699, win 29200, options [mss 1460,sackOK,TS val 3459391 ecr 0,nop,wscale 7], length 0
11:55:37.792052 IP 10.0.1.22.46014 > 192.168.1.28.4000: Flags [S], seq 2922469699, win 29200, options [mss 1460,sackOK,TS val 3459391 ecr 0,nop,wscale 7], length 0
11:55:38.792116 IP 10.0.1.22.46014 > 192.168.1.28.4000: Flags [S], seq 2922469699, win 29200, options [mss 1460,sackOK,TS val 3459641 ecr 0,nop,wscale 7], length 0
11:55:38.792188 IP 10.0.1.22.46014 > 192.168.1.28.4000: Flags [S], seq 2922469699, win 29200, options [mss 1460,sackOK,TS val 3459641 ecr 0,nop,wscale 7], length 0
11:56:07.434645 IP 10.0.1.22.46015 > 192.168.1.28.4000: Flags [S], seq 459738226, win 29200, options [mss 1460,sackOK,TS val 3466802 ecr 0,nop,wscale 7], length 0
11:56:07.434722 IP 10.0.1.22.46015 > 192.168.1.28.4000: Flags [S], seq 459738226, win 29200, options [mss 1460,sackOK,TS val 3466802 ecr 0,nop,wscale 7], length 0
11:56:08.436531 IP 10.0.1.22.46015 > 192.168.1.28.4000: Flags [S], seq 459738226, win 29200, options [mss 1460,sackOK,TS val 3467052 ecr 0,nop,wscale 7], length 0
11:56:08.436601 IP 10.0.1.22.46015 > 192.168.1.28.4000: Flags [S], seq 459738226, win 29200, options [mss 1460,sackOK,TS val 3467052 ecr 0,nop,wscale 7], length 0
^C
8 packets captured
8 packets received by filter
0 packets dropped by kernel
Nothing is seen on Fred.
The iptables rules for the two EC2 instances are as follows:
Bob:
Bob> iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 10.0.1.0/24 192.168.0.0/16 policy match dir in pol ipsec reqid 1 proto esp
ACCEPT all -- 192.168.0.0/16 10.0.1.0/24 policy match dir out pol ipsec reqid 1 proto esp
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Fred:
Fred> iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Any suggestions on what the problem might be would be much appreciated. At the moment I'm not sure if it's an EC2 problem or a networking issue.
iptables -t nat -L
)?Bob> iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
Bob> iptables -t nat -D POSTROUTING -s 10.0.1.0/24 -o eth0 -j MASQUERADE
Bob
andGeorge
are the servers, where are the StrongSWAN VPN and Juniper SSG550 in this? Can you print the routes for all 3 systems?