Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have got problems setting up a StrongSwan IpSec network. I use arno-iptables-firewall with the IpSec module and have added rules for NAT and to the routing table. When pinging a host in the remote network, I get the following charon log messages:

Jan 15 19:22:09 07[KNL] creating acquire job for policy 10.189.166.154/32[icmp/8] === 172.23.4.20/32[icmp] with reqid {1}
Jan 15 19:22:09 04[IKE] initiating IKE_SA tunnel[1] to <REMOTE_IP>
Jan 15 19:22:09 04[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
Jan 15 19:22:09 04[NET] sending packet: from <MY_EXT_IP>[500] to <REMOTE_IP>[500]
Jan 15 19:22:13 03[IKE] retransmit 1 of request with message ID 0
Jan 15 19:22:13 03[NET] sending packet: from <MY_EXT_IP>[500] to <REMOTE_IP>[500]

So it seems StrongSwan tries to establish the VPN connection and tries to start the IKE, but does not receive responses to the UPD packets it sends.

I added a log message to the OUTPUT chain and indeed I can see the packets on port 500, so I am sure the firewall tries to send the packet:

[6488507.353258] IpSec IN= OUT=ppp0 SRC=<MY_EXT_IP> DST=<REMOTE_IP> LEN=812 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=500 DPT=500 LEN=792

But, my connection partner (unfortunately, I do not have access to his logs) does not see these packets arrive. Have you got any idea where the packets might get lost?

The firewall is a Debian 7.3 (kernel 3.2) virtual linux machine, running on ESXi 5. The firewall is directly connected to the Internet via a PPP dialup line.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.