Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have setup a tunnel between a UBUNTU SERVER linux box and a CISCO ROUTER.

This is what's the topology looks like:

host 1 ------ UBUNTU SERVER IPSEC <---> CISCO ROUTER ------ host 2
   |                    |                      |               |
   |                    |                      |               |
192.168.64.0/24      1.2.3.4                4.3.2.1      10.10.20.0/24

Here's my problem: the tunnel is setup and running correctly. I can definitely ping from the CISCO ROUTER to any host on the 192.168.64.0/24 network. But I can not ping from the 192.168.64.0/24 network to any host on the 10.10.20.0/24 network.

Here's some info:

ipsec.conf:

conn my_vpn
auto=start
authby=secret
ike=aes256-md5
phase2=esp
phase2alg=aes256-md5
type=tunnel
left=1.2.3.4
leftsubnet=192.168.64.0/24
    leftnexthop=%defaultroute
leftupdown="ipsec _updown --route yes"
keyingtries=3
keyexchange=ike
pfs=no
    right=4.3.2.1
    rightsubnet=10.10.20.0/24   

ipsec look command output:

XFRM state:
src 4.3.2.1 dst 1.2.3.4
    proto esp spi 0x0f9898dd reqid 16385 mode tunnel
    replay-window 32 flag af-unspec
    auth-trunc hmac(md5) 0xSOMEVALUE
    enc cbc(aes) 0xSOMEOHTERVALUE
src 1.2.3.4 dst 4.3.2.1
    proto esp spi 0x667b62d8 reqid 16385 mode tunnel
    replay-window 32 flag af-unspec
    auth-trunc hmac(md5) 0xSOMEVALUE
    enc cbc(aes) 0xSOMEOHTERVALUE
XFRM policy:
src 192.168.64.0/24 dst 10.10.20.0/24 
    dir out priority 2344 
    tmpl src 1.2.3.4 dst 4.3.2.1
        proto esp reqid 16385 mode tunnel
src 10.10.20.0/24 dst 192.168.64.0/24 
    dir fwd priority 2344 
    tmpl src 4.3.2.1 dst 1.2.3.4
        proto esp reqid 16385 mode tunnel
src 10.10.20.0/24 dst 192.168.64.0/24 
    dir in priority 2344 
    tmpl src 4.3.2.1 dst 1.2.3.4
        proto esp reqid 16385 mode tunnel
src ::/0 dst ::/0 
    socket out priority 0 
src ::/0 dst ::/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
XFRM done
IPSEC mangle TABLES
iptables: No chain/target/match by that name.
ip6tables: No chain/target/match by that name.
NEW_IPSEC_CONN mangle TABLES
iptables: No chain/target/match by that name.
ip6tables: No chain/target/match by that name.
ROUTING TABLES
default dev ppp0  scope link 
10.10.20.0/24 via 1.2.3.GW dev ppp0 
1.2.3.GW dev ppp0  proto kernel  scope link  src 1.2.3.4

Where 1.2.3.GW is 1.2.3.4's gateway.

ipsec verify command output:

Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.37/K3.2.0-38-generic-pae (netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                           [N/A]
 NETKEY:  Testing XFRM related proc values                      [OK]
    [OK]
    [OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [FAILED]
Two or more interfaces found, checking IP forwarding            [FAILED]
Checking NAT and MASQUERADEing                                  [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [WARNING]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]

I must add: UBUNTU has a ppp0 connection which has its public IP address: 1.2.3.4.

Static route information:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         0.0.0.0         0.0.0.0         U         0 0          0 ppp0
10.10.20.0      1.2.3.GW        255.255.255.0   UG        0 0          0 ppp0

Any ideas?

share|improve this question
    
if you traceroute from the 192.168 sub to the 10.10 where does it die? –  Jason1891 Mar 7 '13 at 15:07
    
traceroute to 10.10.20.1 (10.10.20.1), 30 hops max, 60 byte packets 1 1.2.3.GW 7.873 ms 11.754 ms 13.326 ms 2 HOST from ISP 1.480 ms * * 3 * * * –  Pablo Santa Cruz Mar 7 '13 at 15:26
    
It dies after two hops. On my ISP. I don't know if traffic is actually being routed through the tunnel. Don't know how to check that either. –  Pablo Santa Cruz Mar 7 '13 at 15:27
    
I feel like we're missing a route to the 10.10 subnet, can you confirm static routes? –  Jason1891 Mar 7 '13 at 15:56
    
updated the question with static route information. –  Pablo Santa Cruz Mar 7 '13 at 16:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.