1

I am trying to establish an ipsec VPN from a Draytek router on the edge of our corporate network to a VPS on Digital Ocean. I've set up the VPN on the VPS using this script on an Ubuntu 14.04 machine. I believe the script downloads and installs libreswan and prompts for a few basic configuration questions etc. I've made a few changes to the ipsec.conf the script creates. My problem is, I can ping from the router to the VPS and I can see the packets arriving on the VPS showing as coming from the private IP address of the router, but nothing I've tried has allowed me to route packets back down the tunnel to the router. Therefore, from the router's pov it appears the pings are timing out.

The router is connected directly to the internet on one of its interfaces and it is configured with a local IP address of 10.111.1.1. The VPS has a single interface connected directly to the internet.

When the VPN is established this is the routing table on the VPS:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         178.62.64.1     0.0.0.0         UG        0 0          0 eth0
10.111.1.1      *               255.255.255.255 UH        0 0          0 eth0
178.62.64.0     *               255.255.192.0   U         0 0          0 eth0

Note the second entry is created when the VPN is established.

If I try to ping 10.111.1.1 I get:

PING 10.111.1.1 (10.111.1.1) 56(84) bytes of data.
From <public IP address - eth0> icmp_seq=1 Destination Host Unreachable

Here is the output from ipsec verify:

Verifying installed system and configuration files

Version check and ipsec on-path                         [OK]
Libreswan 3.10 (netkey) on 3.13.0-37-generic
Checking for IPsec support in kernel                    [OK]
 NETKEY: Testing XFRM related proc values
         ICMP default/send_redirects                    [OK]
         ICMP default/accept_redirects                  [OK]
         XFRM larval drop                               [OK]
Pluto ipsec.conf syntax                                 [OK]
Hardware random device                                  [N/A]
Two or more interfaces found, checking IP forwarding    [OK]
Checking rp_filter                                      [OK]
Checking that pluto is running                          [OK]
 Pluto listening for IKE on udp 500                     [OK]
 Pluto listening for IKE/NAT-T on udp 4500              [OK]
 Pluto ipsec.secret syntax                              [OK]
Checking 'ip' command                                   [OK]
Checking 'iptables' command                             [OK]
Checking 'prelink' command does not interfere with FIPSChecking for obsolete ipsec.conf options             [OK]
Opportunistic Encryption                                [DISABLED]

and here is the content of /etc/ipsec.conf (the commented out lines are results of previous experimentation with the same results):

version 2.0

config setup
  dumpdir=/var/run/pluto/
  nat_traversal=yes
  virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.42.0/24
  oe=off
  protostack=netkey
  nhelpers=0
  interfaces=%defaultroute

conn vpnpsk
  connaddrfamily=ipv4
  auto=add
  left=178.62.73.215
#  leftid=178.62.73.215
#  leftsubnet=178.62.73.215/32
  leftsubnet=10.10.10.0/24
#  leftnexthop=%defaultroute
  leftnexthop=%direct
  leftprotoport=17/1701
  rightprotoport=17/%any
#  right=%any
  right=10.111.1.0/24
  rightsourceip=10.111.1.1
  leftsourceip=10.10.10.1
#  rightsubnetwithin=0.0.0.0/0
  forceencaps=yes
  authby=secret
  pfs=no
  type=transport
  auth=esp
  ike=3des-sha1,aes-sha1
  phase2alg=3des-sha1,aes-sha1
  rekey=no
  keyingtries=5
  dpddelay=30
  dpdtimeout=120
  dpdaction=clear

This is the relevant part of the routing table from the router:

Key: C - connected, S - static, R - RIP, * - default, ~ - private
*            0.0.0.0/ 0.0.0.0          via <public IP address>   WAN2
S~        10.10.10.0/ 255.255.255.0    via 178.62.73.215   VPN-10
C~        10.111.1.0/ 255.255.255.0    directly connected    LAN 
C    <public IP address>/ 255.255.255.224  directly connected    WAN2

Would appreciate someone pointing out what I'm doing wrong.

Thanks.

  • What does the system log say about ipsec status? Why is right= not set to the WAN IP of your router? Is this a point-to-point connection or do you intend to route other traffic over it because you're in transport mode and you might need to be in tunnel if you intend to use internal IPs. – Andrew Domaszek Dec 2 '14 at 14:56
  • right is what it is as a result of me experimenting. It was set to %any but didn't make a difference. There's quite a lot in syslog and auth.log but no obvious errors except it complaining about the leftnexthop=%direct (which I got from the man page) so changed it back to %default. – user102469 Dec 2 '14 at 15:35
  • Your routing table is pretty funky. It's indicating that 10.111.1.1/32 is available link-local on eth0. This should probably be a route to the tunnel interface, not eth0 – devicenull Dec 3 '14 at 1:35
  • That's what's causing me grief - there is no tunnel interface. I think I've found a few other posts querying that and it seems to be normal for ipsec VPNs. The pings from the router over the VPN are hitting eth0 if tcpdump is to be believed. – user102469 Dec 3 '14 at 8:57
2

OK, I've stumbled across the solution by removing the lines leftprotoport=17/1701 and rightprotoport=17/%any. Not sure why this worked buy hey ho! I can now ping from the server to the router and can ping devices hanging off the router. I've got another problem now but I'll post another question for that. Thanks all.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.