3

I'm creating an IPSec tunnel from a Linux box to a SonicWall firewall running standard firmware. The tunnel seems to be getting created just fine, but packets from the Linux box to the remote network are not being routed into the tunnel. Packets from the remote network seem to be fine. Attempts to ping from the Linux box to the secure remote network get routed via the normal routing table.

Looking at the routing table and cache, there are no entries for 192.168.1.0 (the remote network). My expectation from the docs is that the tunnel policy would insert the route.

Any ideas appriciated.

Thanks, Brad

Here's my conf script:

#!/sbin/setkey -f
# Configuration for 172.16.89.100

# Flush the SAD and SPD
flush;
spdflush;

add 172.16.89.100 172.20.241.2 ah 0x200 -m tunnel -A hmac-sha1
0xredacted00000000000000000000000000000000;
add 172.20.241.2 172.16.89.100 ah 0x300 -m tunnel -A hmac-sha1
0xredacted00000000000000000000000000000000;

add 172.16.89.100 172.20.241.2 esp 0x201 -m tunnel -E 3des-cbc
0xredacted0000000000000000000000000000000000000000;
add 172.20.241.2 172.16.89.100 esp 0x301 -m tunnel -E 3des-cbc
0xredacted0000000000000000000000000000000000000000;

# Security policies
spdadd 10.114.89.0/24 192.168.1.0/24 any -P out ipsec
           esp/tunnel/172.16.89.100-172.20.241.2/require
           ah/tunnel/172.16.89.100-172.20.241.2/require;

spdadd 192.168.1.0/24 10.114.89.0/24 any -P in ipsec
           esp/tunnel/172.20.241.2-172.16.89.100/require
           ah/tunnel/172.20.241.2-172.16.89.100/require;

#Forward Policy
#DOH!  iptools > 0.5 do this automatically.
#spdadd 192.168.1.0/24 10.114.89.0/24 any -P fwd ipsec
#           esp/tunnel/172.20.241.2-172.16.89.100/require
#           ah/tunnel/172.20.241.2-172.16.89.100/require;
Improve this question
0

3 Answers 3

Reset to default
1

  • If your running the vpn on a box that isn't the Linux boxes default gateway, you will need to add routes on the Linux boxes pointing to the proper gateway.

  • Check your firewall rules. You don't want to MASQUERADE the traffic going through the VPN.

You've probably already taken a look at it, but take a look at the Linux IPsec how to.

You may also want to look into useing racoon, it can take some of the pain out if ipsec configuration.

Improve this answer
1

1) You shouldn't need special routes. If you can communicate w/o IPSec, you should be in good shape.

2) Check your firewalls and IPtables. The protocols change from TCP to AH and ESP. This can be confusing (or was for me) because we're so used to thinking if TCP/IP only.

Improve this answer
0

i had the same problem and don't know why. i've read somewhere that you shouldn't need routing entries because of the kernel directly taking care of it through the ipsec security associations (sa).

nevertheless, it should work (and worked for me) if you set up a static route like:

ip route add 192.168.1.0/24 via 172.16.89.100
Improve this answer

You must log in to answer this question.