I've successfully established an IPsec connection, but it works only partially. One side does not send out packets through the tunnel. It seems as if the network topology is unclear to this side.
Any help is highly appreciated! Thanks!!
This is the network scheme:
"office"(192.168.73.0/24) == "vpn"(192.168.73.1) == "router"(184.108.40.206) <====> "server"(220.127.116.11) == "VM_LAN"(192.168.133.0/24)
18.104.22.168 and 22.214.171.124 are symbolic public IPs, i.e. "router" and "server" both are directly connected to the internet.
"vpn" and "server" both run CentOS 6. "router" is a cable modem, doing the NAT and port forwarding.
The connection is established.
On "vpn" I can ping "server"'s internal IP:
[root@vpn]# ping 192.168.133.1 PING 192.168.133.1 (192.168.133.1) 56(84) bytes of data. 64 bytes from 192.168.133.1: icmp_seq=1 ttl=64 time=74.8 ms
On "server" I can't ping "vpn", there's not even a packet sent out.
The following is a dump from "server" showing above ping packet coming in. I use the same command to test if packets are sent from "server" to "vpn", when pinging from "server", but no packets show up.
[root@server]# tcpdump port 500 or port 4500 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 14:40:21.793577 IP 126.96.36.199.ipsec-nat-t > 188.8.131.52.ipsec-nat-t: UDP-encap: ESP(spi=0x712a1d37,seq=0x2), length 132 14:40:21.793650 IP 184.108.40.206.ipsec-nat-t > 220.127.116.11.ipsec-nat-t: UDP-encap: ESP(spi=0x840e6b76,seq=0x2), length 132
ipsec verify seems ok:
[root@server]# ipsec verify Checking your system to see if IPsec got installed and started correctly: Version check and ipsec on-path [OK] Linux Openswan U2.6.32/K2.6.32-358.2.1.el6.x86_64 (netkey) Checking for IPsec support in kernel [OK] SAref kernel support [N/A] NETKEY: Testing for disabled ICMP send_redirects [OK] NETKEY detected, testing for disabled ICMP accept_redirects [OK] Checking that pluto is running [OK] Pluto listening for IKE on udp 500 [OK] Pluto listening for NAT-T on udp 4500 [OK] Checking for 'ip' command [OK] Checking /bin/sh is not /bin/dash [OK] Checking for 'iptables' command [OK] Opportunistic Encryption Support [DISABLED]
iptables is disabled:
[root@server]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@server]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 18.104.22.168 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0 0.0.0.0 22.214.171.124 0.0.0.0 UG 0 0 0 eth0
config setup # Debug-logging controls: "none" for (almost) none, "all" for lots. # klipsdebug=none # plutodebug="control parsing" plutodebug="all" # For Red Hat Enterprise Linux and Fedora, leave protostack=netkey protostack=netkey nat_traversal=yes virtual_private="%v4:192.168.73.0/24" oe=off # Enable this if you see "failed to find any available worker" # nhelpers=0 conn aaa-office authby=secret left=126.96.36.199 leftsubnet=192.168.133.0/24 right=188.8.131.52 rightsubnet=192.168.73.0/24 rightid=192.168.73.8 auto=add