0

I have an existing Openswan VPN, all working fairly well with Windows, Mac and Phones.

[Office 192.168.0.0/24]---[VPN A.B.C.D]----[Internet]---[Home Routers (NAT), Dynamic IPs]----[Workstations]

Now I want to run an offsite backup server and connect it to the same VPN, still with a dynamic IP

[Office 192.168.0.0/24]---[VPN A.B.C.D]----[Internet]---[Home Router (NAT), Dynamic IP]----[zfsbackup]

IPSec seems to negotiate OK, this is the output on the backup side:

104 "net2net" #1: STATE_MAIN_I1: initiate
003 "net2net" #1: received Vendor ID payload [Openswan (this version) 2.6.38 ]
003 "net2net" #1: received Vendor ID payload [Dead Peer Detection]
003 "net2net" #1: received Vendor ID payload [RFC 3947] method set to=115
106 "net2net" #1: STATE_MAIN_I2: sent MI2, expecting MR2
003 "net2net" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): i am NATed
108 "net2net" #1: STATE_MAIN_I3: sent MI3, expecting MR3
003 "net2net" #1: received Vendor ID payload [CAN-IKEv2]
004 "net2net" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}
117 "net2net" #2: STATE_QUICK_I1: initiate
004 "net2net" #2: STATE_QUICK_I2: sent QI2, IPsec SA established transport mode {ESP=>0x9fecb28d <0x11f39e30 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=enabled}

However when I try to start the connection in xl2tpd this happens:

xl2tpd[14438]: Listening on IP address 0.0.0.0, port 1701
xl2tpd[14438]: get_call: allocating new tunnel for host A.B.C.D, port 1701.
xl2tpd[14438]: Connecting to host A.B.C.D, port 1701
xl2tpd[14438]: control_finish: message type is (null)(0).  Tunnel is 0, call is 0.
xl2tpd[14438]: control_finish: sending SCCRQ
xl2tpd[14438]: network_thread: select timeout
...

Running packet capture on the machine at this stage shows that nothing is sent over the wire.

Something that concerns me is the log output when connecting. This is the Office side log for a windows connection:

"L2TP"[6] W.X.Y.Z #115: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x917a3b5e 
<0xbc445896 xfrm=AES_128-HMAC_SHA1 NATOA=192.168.1.106 NATD=W.X.Y.Z:4500 DPD=none}

This is for the backup server (Same network as windows pc above), note the port 1024

"L2TP"[11] W.X.Y.Z #23: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x11f39e30 
<0x9fecb28d xfrm=AES_128-HMAC_SHA1 NATOA=192.168.1.2 NATD=W.X.Y.Z:1024 DPD=enabled}

ipsec verify shows that pluto is listening on 500 and 4500. I can't find a way to get IPSec to pass through the correct port number. My programmer's guess is that the port isn't being read in from anywhere and it's defaulting to the first assignable userland port.

Note that I can reserve 1024 in advance using nc. Office VPN still gets told to use 1024 rather than say 1025. Pluto doesn't complain that 1024 is already in use.

nc -u -p 1024 localhost 22

I really hope someone can help - Have spent a few hours on this both searching and tweaking.

Office config is as follows:

  config setup
              nat_traversal=yes
              virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
              oe=off
              protostack=netkey
              plutostderrlog=/var/log/pluto.log
              nhelpers=0
  conn L2TP
              authby=secret
              auto=add
              pfs=no
              type=transport
              rekey=yes
              compress=no
              left=203.39.25.66
              leftnexthop=%defaultroute
              leftprotoport=17/1701
              right=%any
              rightsubnet=vhost:%no,%priv
              rightprotoport=17/%any
              forceencaps=no
              dpddelay=40
              dpdtimeout=130
              dpdaction=clear

Backup server config is:

    version 2.0

    config setup
            dumpdir=/var/run/pluto/
            nat_traversal=yes
            virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
            oe=off
            protostack=netkey
            plutostderrlog=/var/log/pluto.log

    conn net2net
            authby=secret
            pfs=no
            auto=add
            ike=aes256-sha1;modp1024
            compress=no
            keyingtries=3
            dpddelay=40
            dpdtimeout=130
            dpdaction=clear
            rekey=yes
            type=transport
            left=%defaultroute
            leftsubnet=192.168.1.0/24
            leftnexthop=%defaultroute
            leftprotoport=17/1701
            right=A.B.C.D
            rightprotoport=17/1701
0

Not sure if this counts as an answer.

I finally got a chance to try strongSwan and it did what I need in a matter of minutes.

Basically I'm using a site-site configuration as per here: http://www.strongswan.org/uml/testresults/ikev2/net2net-psk/

So on server we have:

# /etc/ipsec.conf - strongSwan IPsec configuration file

config setup

conn %default
    ikelifetime=60m
    keylife=20m
    rekeymargin=3m
    keyingtries=1
    authby=secret
    keyexchange=ikev2
    mobike=no

conn net-net
    left=192.168.0.1
    leftsubnet=10.1.0.0/16
    leftid=@moon.strongswan.org
    leftfirewall=yes
    right=192.168.0.2
    rightsubnet=10.2.0.0/16
    rightid=@sun.strongswan.org
    auto=add

On client:

# /etc/ipsec.conf - strongSwan IPsec configuration file

config setup

conn %default
    ikelifetime=60m
    keylife=20m
    rekeymargin=3m
    keyingtries=1
    authby=secret
    keyexchange=ikev2
    mobike=no

conn net-net
    left=192.168.0.2
    leftsubnet=10.2.0.0/16
    leftid=@sun.strongswan.org
    leftfirewall=yes
    right=192.168.0.1
    rightsubnet=10.1.0.0/16
    rightid=@moon.strongswan.org
    auto=add

Then on server:

# echo 1 > /proc/sys/net/ipv4/ip_forward
# ipsec start

On client

# ipsec start
# ipsec up net-net

I still haven't got my full roadwarrior setup worked out, this is just using preshared key with no authentication, but I'm sure it can be done with strongSwan. Let's just say it's much saner than OpenSwan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.