Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to connect to my LAN with iPhone, using Cisco IPsec VPN connection. I can connect to VPN, but I can't access any LAN devices.

Hardware/Software:

  • Strongswan 5.0.4, running on router - Asus RT-AC66U Firmware:3.0.0.4.374.34_2 (Merlin build), asuswrt optware
  • iPhone (client)

Network info:

  • Router(=server) public IP: 86.x.x.x, private ip:192.168.2.1
  • iPhone public IP: 46.x.x.x

Network scheme, see image: https://dl.dropboxusercontent.com/u/2261256/forums/ipsec/IPsec_diagram.png (I've changed virtual IPs to 10.11.0.0/24)

ipsec.conf:

conn %default    
        keyexchange=ikev1
        authby=xauthrsasig   
        xauth=server

conn ios                                   
       left=%defaultroute                  
       leftsubnet=0.0.0.0/0                
       leftcert=serverLupoCert.pem         
       leftfirewall=yes                    
       right=%any             
       rightsubnet=10.11.0.0/24            
       rightsourceip=10.11.0.0/24          
       auto=add                            
       rightcert=clientLupoCert.pem

ip -4 a s:

1: lo: <LOOPBACK,MULTICAST,UP,10000> mtu 16436 qdisc noqueue 
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
    inet 86.x.x.x/24 brd 86.x.x.255 scope global eth0
6: br0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue 
    inet 192.168.2.1/24 brd 192.168.2.255 scope global br0
7: tun21: <POINTOPOINT,MULTICAST,NOARP,PROMISC,UP,10000> mtu 1500 qdisc pfifo_fast qlen 100
    inet 10.8.2.1 peer 10.8.2.2/32 scope global tun21
8: tun11: <POINTOPOINT,MULTICAST,NOARP,UP,10000> mtu 1500 qdisc pfifo_fast qlen 100
    inet 10.8.0.6 peer 10.8.0.5/32 scope global tun11

(tun21,tun11 are from OpenVPN server, which is also running on router - will remove it once I get IPsec to work)

iptables-save:

# Generated by iptables-save v1.3.8 on Fri Nov 15 20:55:26 2013
*nat
:PREROUTING ACCEPT [17927:1127507]
:POSTROUTING ACCEPT [704:67870]
:OUTPUT ACCEPT [703:67443]
:LOCALSRV - [0:0]
:VSERVER - [0:0]
:VUPNP - [0:0]
:YADNS - [0:0]
-A PREROUTING -p tcp -m tcp --dport 1194 -j ACCEPT 
-A PREROUTING -d 86.x.x.x -j VSERVER 
-A POSTROUTING -s 192.168.2.0/255.255.255.0 -o tun11 -j MASQUERADE 
-A POSTROUTING -s ! 86.x.x.x -o eth0 -j MASQUERADE 
-A POSTROUTING -m mark --mark 0xd001 -j MASQUERADE 
-A VSERVER -p tcp -m tcp --dport 1184 -j DNAT --to-destination 192.168.2.100:1194 
-A VSERVER -p udp -m udp --dport 1184 -j DNAT --to-destination 192.168.2.100:1194 
-A VSERVER -j VUPNP 
-A VUPNP -p udp -m udp --dport 49691 -j DNAT --to-destination 192.168.2.11:16402 
COMMIT
# Completed on Fri Nov 15 20:55:26 2013
# Generated by iptables-save v1.3.8 on Fri Nov 15 20:55:26 2013
*mangle
:PREROUTING ACCEPT [26923:1984100]
:INPUT ACCEPT [7606:841647]
:FORWARD ACCEPT [18118:1006712]
:OUTPUT ACCEPT [5967:2717306]
:POSTROUTING ACCEPT [8396:2870974]
-A PREROUTING -d 86.x.x.x -i ! eth0 -j MARK --set-mark 0xd001 
COMMIT
# Completed on Fri Nov 15 20:55:26 2013
# Generated by iptables-save v1.3.8 on Fri Nov 15 20:55:26 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [5912:2703854]
:FUPNP - [0:0]
:PControls - [0:0]
:logaccept - [0:0]
:logdrop - [0:0]
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT 
-A INPUT -p udp -m udp --dport 500 -j ACCEPT 
-A INPUT -i tun11 -j ACCEPT 
-A INPUT -i tun21 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT 
-A INPUT -m state --state INVALID -j logdrop 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -i lo -m state --state NEW -j ACCEPT 
-A INPUT -i br0 -m state --state NEW -j ACCEPT 
-A INPUT -p udp -m udp --sport 67 --dport 68 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 8082 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m tcp --dport 1723 -j ACCEPT 
-A INPUT -p gre -j ACCEPT 
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -j logdrop 
-A FORWARD -i tun11 -j ACCEPT 
-A FORWARD -i tun21 -j ACCEPT 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i ! br0 -o eth0 -j logdrop 
-A FORWARD -m state --state INVALID -j logdrop 
-A FORWARD -i br0 -o br0 -j ACCEPT 
-A FORWARD -i eth0 -p icmp -j DROP 
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT 
-A FORWARD -i br0 -j ACCEPT 
-A FUPNP -d 192.168.2.11 -p udp -m udp --dport 16402 -j ACCEPT 
-A PControls -j ACCEPT 
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options 
-A logaccept -j ACCEPT 
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP" --log-tcp-sequence --log-tcp-options --log-ip-options 
-A logdrop -j DROP 
COMMIT
# Completed on Fri Nov 15 20:55:26 2013

Strongswan log (loglevel 1):

Nov 15 20:38:38 00[DMN] Starting IKE charon daemon (strongSwan 5.0.4, Linux 2.6.22.19, mips)
Nov 15 20:38:38 00[LIB] openssl FIPS mode(0) unavailable
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[LIB] opening AF_ALG socket failed: Address family not supported by protocol
Nov 15 20:38:38 00[CFG] attr-sql plugin: database URI not set
Nov 15 20:38:38 00[LIB] plugin 'attr-sql': failed to load - attr_sql_plugin_create returned NULL
Nov 15 20:38:38 00[CFG] disabling load-tester plugin, not configured
Nov 15 20:38:38 00[LIB] plugin 'load-tester': failed to load - load_tester_plugin_create returned NULL
Nov 15 20:38:38 00[CFG] sql plugin: database URI not set
Nov 15 20:38:38 00[LIB] plugin 'sql': failed to load - sql_plugin_create returned NULL
Nov 15 20:38:38 00[CFG] loaded 0 RADIUS server configurations
Nov 15 20:38:38 00[CFG] HA config misses local/remote address
Nov 15 20:38:38 00[LIB] plugin 'ha': failed to load - ha_plugin_create returned NULL
Nov 15 20:38:38 00[CFG] coupling file path unspecified
Nov 15 20:38:38 00[LIB] plugin 'coupling': failed to load - coupling_plugin_create returned NULL
Nov 15 20:38:38 00[CFG] loading ca certificates from '/opt/etc/ipsec.d/cacerts'
Nov 15 20:38:38 00[CFG]   loaded ca certificate "C=SI, O=Lupo, CN=86.x.x.x" from '/opt/etc/ipsec.d/cacerts/caLupoCert.pem'
Nov 15 20:38:38 00[CFG] loading aa certificates from '/opt/etc/ipsec.d/aacerts'
Nov 15 20:38:38 00[CFG] loading ocsp signer certificates from '/opt/etc/ipsec.d/ocspcerts'
Nov 15 20:38:38 00[CFG] loading attribute certificates from '/opt/etc/ipsec.d/acerts'
Nov 15 20:38:38 00[CFG] loading crls from '/opt/etc/ipsec.d/crls'
Nov 15 20:38:38 00[CFG] loading secrets from '/opt/etc/ipsec.secrets'
Nov 15 20:38:39 00[CFG]   loaded RSA private key from '/opt/etc/ipsec.d/private/serverLupoKey.pem'
Nov 15 20:38:39 00[CFG]   loaded EAP secret for lupo
Nov 15 20:38:39 00[DMN] loaded plugins: charon test-vectors curl ldap mysql sqlite pkcs11 aes des blowfish sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs8 pgp dnskey pem openssl gcrypt fips-prf gmp agent xcbc cmac hmac ctr ccm gcm attr kernel-pfkey kernel-klips kernel-netlink resolve socket-default socket-dynamic farp stroke smp updown eap-identity eap-md5 eap-mschapv2 eap-radius xauth-generic xauth-eap dhcp whitelist led duplicheck addrblock unity
Nov 15 20:38:39 00[JOB] spawning 16 worker threads
Nov 15 20:38:39 11[CFG] received stroke: add connection 'ios'
Nov 15 20:38:39 11[CFG] left nor right host is our side, assuming left=local
Nov 15 20:38:39 11[CFG] adding virtual IP address pool 10.11.0.0/24
Nov 15 20:38:39 11[CFG]   loaded certificate "C=SI, O=Lupo, CN=86.x.x.x" from 'serverLupoCert.pem'
Nov 15 20:38:39 11[CFG]   id '%any' not confirmed by certificate, defaulting to 'C=SI, O=Lupo, CN=86.x.x.x'
Nov 15 20:38:39 11[CFG]   loaded certificate "C=SI, O=Lupo, CN=clientLupo" from 'clientLupoCert.pem'
Nov 15 20:38:39 11[CFG]   id '%any' not confirmed by certificate, defaulting to 'C=SI, O=Lupo, CN=clientLupo'
Nov 15 20:38:39 11[CFG] added configuration 'ios'
Nov 15 20:38:41 13[NET] received packet: from 46.x.x.x[500] to 86.x.x.x[500] (668 bytes)
Nov 15 20:38:41 13[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ]
Nov 15 20:38:41 13[IKE] received NAT-T (RFC 3947) vendor ID
Nov 15 20:38:41 13[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID
Nov 15 20:38:41 13[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID
Nov 15 20:38:41 13[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID
Nov 15 20:38:41 13[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID
Nov 15 20:38:41 13[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID
Nov 15 20:38:41 13[IKE] received draft-ietf-ipsec-nat-t-ike-04 vendor ID
Nov 15 20:38:41 13[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID
Nov 15 20:38:41 13[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Nov 15 20:38:41 13[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Nov 15 20:38:41 13[IKE] received XAuth vendor ID
Nov 15 20:38:41 13[IKE] received Cisco Unity vendor ID
Nov 15 20:38:41 13[IKE] received FRAGMENTATION vendor ID
Nov 15 20:38:41 13[IKE] received DPD vendor ID
Nov 15 20:38:41 13[IKE] 46.x.x.x is initiating a Main Mode IKE_SA
Nov 15 20:38:41 13[ENC] generating ID_PROT response 0 [ SA V V V ]
Nov 15 20:38:41 13[NET] sending packet: from 86.x.x.x[500] to 46.x.x.x[500] (136 bytes)
Nov 15 20:38:41 14[NET] received packet: from 46.x.x.x[500] to 86.x.x.x[500] (292 bytes)
Nov 15 20:38:41 14[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
Nov 15 20:38:41 14[IKE] sending cert request for "C=SI, O=Lupo, CN=86.x.x.x"
Nov 15 20:38:41 14[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]
Nov 15 20:38:41 14[NET] sending packet: from 86.x.x.x[500] to 46.x.x.x[500] (371 bytes)
Nov 15 20:38:42 12[NET] received packet: from 46.x.x.x[500] to 86.x.x.x[500] (1180 bytes)
Nov 15 20:38:42 12[ENC] parsed ID_PROT request 0 [ ID CERT SIG CERTREQ N(INITIAL_CONTACT) ]
Nov 15 20:38:42 12[IKE] ignoring certificate request without data
Nov 15 20:38:42 12[IKE] received end entity cert "C=SI, O=Lupo, CN=clientLupo"
Nov 15 20:38:42 12[CFG] looking for XAuthInitRSA peer configs matching 86.x.x.x...46.x.x.x[C=SI, O=Lupo, CN=clientLupo]
Nov 15 20:38:42 12[CFG] selected peer config "ios"
Nov 15 20:38:42 12[CFG]   using trusted ca certificate "C=SI, O=Lupo, CN=86.x.x.x"
Nov 15 20:38:42 12[CFG] checking certificate status of "C=SI, O=Lupo, CN=clientLupo"
Nov 15 20:38:42 12[CFG] certificate status is not available
Nov 15 20:38:42 12[CFG]   reached self-signed root ca with a path length of 0
Nov 15 20:38:42 12[CFG]   using trusted certificate "C=SI, O=Lupo, CN=clientLupo"
Nov 15 20:38:42 12[IKE] authentication of 'C=SI, O=Lupo, CN=clientLupo' with RSA successful
Nov 15 20:38:42 12[IKE] authentication of 'C=SI, O=Lupo, CN=86.x.x.x' (myself) successful
Nov 15 20:38:42 12[IKE] sending end entity cert "C=SI, O=Lupo, CN=86.x.x.x"
Nov 15 20:38:42 12[ENC] generating ID_PROT response 0 [ ID CERT SIG ]
Nov 15 20:38:42 12[NET] sending packet: from 86.x.x.x[500] to 46.x.x.x[500] (1212 bytes)
Nov 15 20:38:42 12[ENC] generating TRANSACTION request 561743567 [ HASH CP ]
Nov 15 20:38:42 12[NET] sending packet: from 86.x.x.x[500] to 46.x.x.x[500] (76 bytes)
Nov 15 20:38:42 11[NET] received packet: from 46.x.x.x[500] to 86.x.x.x[500] (92 bytes)
Nov 15 20:38:42 11[ENC] parsed TRANSACTION response 561743567 [ HASH CP ]
Nov 15 20:38:42 11[IKE] XAuth authentication of 'lupo' successful
Nov 15 20:38:42 11[ENC] generating TRANSACTION request 274787051 [ HASH CP ]
Nov 15 20:38:42 11[NET] sending packet: from 86.x.x.x[500] to 46.x.x.x[500] (76 bytes)
Nov 15 20:38:42 13[NET] received packet: from 46.x.x.x[500] to 86.x.x.x[500] (76 bytes)
Nov 15 20:38:42 13[ENC] parsed TRANSACTION response 274787051 [ HASH CP ]
Nov 15 20:38:42 13[IKE] IKE_SA ios[1] established between 86.x.x.x[C=SI, O=Lupo, CN=86.x.x.x]...46.x.x.x[C=SI, O=Lupo, CN=clientLupo]
Nov 15 20:38:42 13[IKE] scheduling reauthentication in 10255s
Nov 15 20:38:42 13[IKE] maximum IKE_SA lifetime 10795s
Nov 15 20:38:42 12[NET] received packet: from 46.x.x.x[500] to 86.x.x.x[500] (172 bytes)
Nov 15 20:38:42 12[ENC] unknown attribute type (28683)
Nov 15 20:38:42 12[ENC] parsed TRANSACTION request 3928555748 [ HASH CP ]
Nov 15 20:38:42 12[IKE] peer requested virtual IP %any
Nov 15 20:38:42 12[CFG] assigning new lease to 'lupo'
Nov 15 20:38:42 12[IKE] assigning virtual IP 10.11.0.1 to peer 'lupo'
Nov 15 20:38:42 12[ENC] generating TRANSACTION response 3928555748 [ HASH CP ]
Nov 15 20:38:42 12[NET] sending packet: from 86.x.x.x[500] to 46.x.x.x[500] (76 bytes)
Nov 15 20:38:43 11[NET] received packet: from 46.x.x.x[500] to 86.x.x.x[500] (300 bytes)
Nov 15 20:38:43 11[ENC] parsed QUICK_MODE request 1285665545 [ HASH SA No ID ID ]
Nov 15 20:38:43 11[ENC] generating QUICK_MODE response 1285665545 [ HASH SA No ID ID ]
Nov 15 20:38:43 11[NET] sending packet: from 86.x.x.x[500] to 46.x.x.x[500] (172 bytes)
Nov 15 20:38:43 12[NET] received packet: from 46.x.x.x[500] to 86.x.x.x[500] (60 bytes)
Nov 15 20:38:43 12[ENC] parsed QUICK_MODE request 1285665545 [ HASH ]
Nov 15 20:38:43 12[IKE] CHILD_SA ios{1} established with SPIs cc71b640_i 052f82c7_o and TS 0.0.0.0/0 === 10.11.0.1/32 
Nov 15 20:39:05 13[CFG] received stroke: initiate 'ios'
Nov 15 20:39:05 14[ENC] generating QUICK_MODE request 814387936 [ HASH SA No ID ID ]
Nov 15 20:39:05 14[NET] sending packet: from 86.x.x.x[500] to 46.x.x.x[500] (236 bytes)
Nov 15 20:39:06 11[NET] received packet: from 46.x.x.x[500] to 86.x.x.x[500] (172 bytes)
Nov 15 20:39:06 11[ENC] parsed QUICK_MODE response 814387936 [ HASH SA No ID ID ]
Nov 15 20:39:06 11[IKE] CHILD_SA ios{2} established with SPIs c32955c0_i 0a682529_o and TS 0.0.0.0/0 === 0.0.0.0/0 
Nov 15 20:39:06 11[ENC] generating QUICK_MODE request 814387936 [ HASH ]
Nov 15 20:39:06 11[NET] sending packet: from 86.x.x.x[500] to 46.x.x.x[500] (60 bytes)
Nov 15 20:39:06 16[KNL] creating acquire job for policy 86.x.x.x/32 === 46.x.x.x/32 with reqid {2}
Nov 15 20:39:06 12[CFG] trap not found, unable to acquire reqid 2
Nov 15 20:39:36 16[KNL] creating acquire job for policy 86.x.x.x/32 === 46.x.x.x/32 with reqid {2}
Nov 15 20:39:36 11[CFG] trap not found, unable to acquire reqid 2

Is it routing problem or is it possible that strongswan is not properly compiled or something ?

ipsec statusall:

Status of IKE charon daemon (strongSwan 5.0.4, Linux 2.6.22.19, mips):
  uptime: 15 seconds, since Nov 16 11:57:57 2013
  malloc: sbrk 180224, mmap 0, used 176472, free 3752
  worker threads: 3 of 16 idle, 12/1/0/0 working, job queue: 0/0/0/0, scheduled: 0
  loaded plugins: charon test-vectors curl ldap mysql sqlite pkcs11 aes des blowfish sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs8 pgp dnskey pem openssl gcrypt fips-prf gmp agent xcbc cmac hmac ctr ccm gcm attr kernel-pfkey kernel-klips kernel-netlink resolve socket-default socket-dynamic farp stroke smp updown eap-identity eap-md5 eap-mschapv2 eap-radius xauth-generic xauth-eap dhcp whitelist led duplicheck addrblock unity
Virtual IP pools (size/online/offline):
  10.11.0.0/24: 254/0/0
Listening IP addresses:
  86.x.x.x
  192.168.2.1
  10.8.2.1
  10.8.0.6
Connections:
         ios:  %any...%any  IKEv1
         ios:   local:  [C=SI, O=HisaLupo, CN=86.x.x.x] uses public key authentication
         ios:    cert:  "C=SI, O=HisaLupo, CN=86.x.x.x"
         ios:   remote: [C=SI, O=HisaLupo, CN=clientLupo] uses public key authentication
         ios:    cert:  "C=SI, O=HisaLupo, CN=clientLupo"
         ios:   remote: uses XAuth authentication: any
         ios:   child:  0.0.0.0/0 === 10.11.0.0/24 TUNNEL
Security Associations (0 up, 0 connecting):
  none
share|improve this question
    
Why would you call 'ipsec up ios' on your gateway after the client established the connection? Also, you might find this page from the strongSwan wiki interesting (especially the part about exempting IPsec traffic from NAT rules). –  ecdsa Nov 16 '13 at 1:24
    
I've removed that "ipsec up" command. Already checked out that page. IP forward is enabled. I can't find sysctl command, but following command prints 1(=enabled): cat /proc/sys/net/ipv4/ip_forward And farp module is enabled (it's listed on ipsec statusall output). –  Lukapple Nov 16 '13 at 10:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.