0

I'm trying to configure a road warrior VPN client on a Linux distribution.

Here my configuraiton :

Client VPN LINUX - 1.1.1.1 - INTERNET - 2.2.2.2 - FireWall - 10.0.0.0/8

I wish to create a tunnel between the remote network 10.0.0.0/8 and the VPN client which will have the address 172.16.0.3

I already configured this with TheGreenBow and It worked well so the problem I'm having is from my client configuration and not my firewall.

To make this configuration on Linux I will use racoon.

I changed the file /etc/racoon/racoon.conf :

log notify;
path certificate "/etc/racoon/certs";

remote 2.2.2.2 {
    exchange_mode main;

    ca_type x509 "cacert.pem";
    certificate_type x509 "cert.pem" "priv.key";

    my_identifier asn1dn;
    peers_identifier asn1dn;

    doi ipsec_doi;

    verify_cert on;
    ike_frag on;

    proposal_check obey;

    mode_cfg off;
    nat_traversal on;
    lifetime time 21600 sec;

    proposal {
        encryption_algorithm aes256;
        hash_algorithm sha2_256;
        authentication_method rsasig;
        dh_group 5;
    }
    generate_policy off;
}

sainfo anonymous {
    lifetime time 3600 sec;
    pfs_group 2;
    encryption_algorithm aes256;
    authentication_algorithm hmac_sha256;
    compression_algorithm deflate;
}

`

I changed /etc/ipsec-tools.conf

spdadd 172.16.0.3/32[any] 10.0.0.0/8[any] any -P out ipsec
    esp/tunnel/1.1.1.1-2.2.2.2/require;

spdadd 10.0.0.0/8[any] 172.16.0.3/32[any] any -P in ipsec
    esp/tunnel/2.2.2.2-1.1.1.1/require;

Next, I configured a virtual interface to redirect the whole flow going to the remote network :

ip link add link eth1 name vlan0 type vlan id 1
ip addr add 172.16.0.3/24 brd 172.16.0.255 dev vlan0
route add -net 10.0.0.0/8 gw 172.16.0.3 dev vlan0

Here what I got when I do "ifconfig"

eth1      Link encap:Ethernet  HWaddr 0c:54:a5:3a:4a:30  
      inet adr:1.1.1.1  Bcast:1.1.1.255  Masque:255.255.255.0
      adr inet6: fe80::e54:a5ff:fe3a:4a30/64 Scope:Lien
      UP BROADCAST RUNNING MULTICAST  MTU:1300  Metric:1
      Packets reçus:20775 erreurs:0 :0 overruns:0 frame:0
      TX packets:17957 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 lg file transmission:1000 
      Octets reçus:15271974 (15.2 MB) Octets transmis:2688417 (2.6 MB)
      Interruption:17 Mémoire:f7d00000-f7d20000 

lo        Link encap:Boucle locale  
      inet adr:127.0.0.1  Masque:255.0.0.0
      adr inet6: ::1/128 Scope:Hôte
      UP LOOPBACK RUNNING  MTU:65536  Metric:1
      Packets reçus:611 erreurs:0 :0 overruns:0 frame:0
      TX packets:611 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 lg file transmission:0 
      Octets reçus:71525 (71.5 KB) Octets transmis:71525 (71.5 KB)

vlan0     Link encap:Ethernet  HWaddr 0c:54:a5:3a:4a:30  
      inet adr:172.16.0.3  Bcast:172.16.0.255  Masque:255.255.255.0
      adr inet6: fe80::e54:a5ff:fe3a:4a30/64 Scope:Lien
      UP BROADCAST RUNNING MULTICAST  MTU:1300  Metric:1
      Packets reçus:0 erreurs:0 :0 overruns:0 frame:0
      TX packets:142 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 lg file transmission:0 
      Octets reçus:0 (0.0 B) Octets transmis:24137 (24.1 KB)

What I got white "route"

Table de routage IP du noyau
Destination     Passerelle      Genmask         Indic Metric Ref    Use Iface
default         1.1.1.1         0.0.0.0         UG    0      0        0 eth1
10.0.0.0        172.16.0.3      255.0.0.0       UG    0      0        0 vlan0
172.16.0.0      *               255.255.255.0   U     0      0        0 vlan0
1.1.1.1         *               255.255.255.0   U     1      0        0 eth1

The firewall tells me that the tunnel is well open (Phase 2 established).

However I can't ping the remote network (but it worked on windows).

When I watch what's happening on the firewall, I see that the ESP packets arrive to the external interface but they are not forwarded to the internal interface (what is done with the windows VPN).

Do you have any idea why Y have this problem ?

0

Instead:

route add -net 10.0.0.0/8 gw 172.16.0.3 dev vlan0


try:

ip route add to 10.0.0.0/8 via 172.16.0.3 dev vlan0 src 172.16.0.3
  • Please explain how/why this would fix the problem. – Sven Sep 16 '15 at 9:00
  • It works in my case. I think there is a need to send proper source address (in this case 172.16.0.3). Outgoing packets on the other side of the tunnel will have source IP 172.16.0.3. – Mattie Sep 16 '15 at 10:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.