From: Manfred Dohmen (manfred.dohmen_at_hahm.biz)
Date: Thu Oct 31 2002 - 14:47:35 CET
Hello.
I´ve got a little problem :) I´m working with Freeswan 1.95 + X.509 patch.
With this setup I try to set up a connection between two dialup-hosts that
connect to the internet via dsl.
When the connection is established, obviously no data goes through the
tunnel.
The first one (my server-side) connects via ppp and has the following setup:
dummy0 Link encap:Ethernet HWaddr 00:00:00:00:00:00
inet addr:194.122.120.252 Bcast:194.122.120.255
Mask:255.255.255.255
inet6 addr: fe80::200:ff:fe00:0/10 Scope:Link
UP BROADCAST RUNNING NOARP MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:210 (210.0 b)
eth0 Link encap:Ethernet HWaddr 00:02:B3:23:FD:37
inet addr:194.122.120.252 Bcast:194.122.120.255
Mask:255.255.255.128
inet6 addr: fe80::202:b3ff:fe23:fd37/10 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3992943 errors:0 dropped:0 overruns:0 frame:0
TX packets:4541508 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1073622659 (1023.8 Mb) TX bytes:126305224 (120.4 Mb)
Interrupt:11 Base address:0x4000
eth0:1 Link encap:Ethernet HWaddr 00:02:B3:23:FD:37
inet addr:10.42.236.252 Bcast:10.255.255.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:11 Base address:0x4000
eth1 Link encap:Ethernet HWaddr 00:20:AF:BE:87:94
inet addr:10.10.10.10 Bcast:10.255.255.255 Mask:255.255.255.0
inet6 addr: fe80::220:afff:febe:8794/10 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4086021 errors:264 dropped:0 overruns:4 frame:264
TX packets:3805048 errors:0 dropped:0 overruns:0 carrier:0
collisions:598 txqueuelen:100
RX bytes:3005007793 (2865.7 Mb) TX bytes:550871776 (525.3 Mb)
Interrupt:10 Base address:0x300
ipsec0 Link encap:IPIP Tunnel HWaddr
inet addr:80.141.151.70 Mask:255.255.255.255
UP RUNNING NOARP MTU:16260 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:7 overruns:0 carrier:0
collisions:0 txqueuelen:10
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:6231254 errors:0 dropped:0 overruns:0 frame:0
TX packets:6231254 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2868416784 (2735.5 Mb) TX bytes:2868416784 (2735.5 Mb)
ppp0 Link encap:Point-to-Point Protocol
inet addr:80.141.151.70 P-t-P:217.5.98.145 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:88599 errors:0 dropped:0 overruns:0 frame:0
TX packets:89717 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:64131009 (61.1 Mb) TX bytes:9775587 (9.3 Mb)
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use
Iface
194.122.120.252 0.0.0.0 255.255.255.255 UH 1 0 0
dummy0
217.5.98.145 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0
217.5.98.145 0.0.0.0 255.255.255.255 UH 0 0 0
ipsec0
194.122.120.128 0.0.0.0 255.255.255.128 U 0 0 0 eth0
194.122.120.0 194.122.120.131 255.255.255.128 UG 0 0 0 eth0
172.17.30.0 217.5.98.145 255.255.255.0 UG 0 0 0
ipsec0
10.42.236.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.10.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
10.42.0.0 10.42.236.1 255.255.0.0 UG 0 0 0 eth0
0.0.0.0 217.5.98.145 0.0.0.0 UG 0 0 0 ppp0
/etc/ipsec.conf:
config setup
# THIS SETTING MUST BE CORRECT or almost nothing will work;
# %defaultroute is okay for most simple cases.
interfaces="ipsec0=ppp0"
# Debug-logging controls: "none" for (almost) none, "all" for lots.
klipsdebug=none
plutodebug=none
# Use auto= parameters in conn descriptions to control startup
actions.
plutoload=%search
plutostart=%search
# Close down old connection when new one using same ID shows up.
uniqueids=yes
# defaults for subsequent connection descriptions
# (mostly to fix internal defaults which, in retrospect, were badly chosen)
conn %default
keyingtries=0
disablearrivalcheck=no
authby=rsasig
leftrsasigkey=%dns
rightrsasigkey=%dns
conn office
leftrsasigkey=%cert
rightrsasigkey=%cert
left=vpn.mydomain
leftid="[...]"
leftsubnet=10.42.236.0/24
leftnexthop=217.5.98.145
right=%any
rightsubnet=172.17.30.0/24
auto=add
When I do a tcpdump -i ipsec0 on this side and try to ping 172.17.30.128 I
see the following:
14:17:46.152840 80.141.151.70 > 172.17.30.128: icmp: echo request (DF)
14:17:47.167312 80.141.151.70 > 172.17.30.128: icmp: echo request (DF)
14:17:48.167348 80.141.151.70 > 172.17.30.128: icmp: echo request (DF)
The second host which is connected to a SMC-Barricade router has the
following setup:
eth0 Link encap:Ethernet HWaddr 00:E0:7D:A2:AA:48
inet addr:192.168.123.128 Bcast:192.168.123.255
Mask:255.255.255.0
inet6 addr: fe80::2e0:7dff:fea2:aa48/10 Scope:Link
UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1
RX packets:11776631 errors:0 dropped:0 overruns:0 frame:0
TX packets:12951310 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1973823416 (1882.3 Mb) TX bytes:3330681888 (3176.3 Mb)
Interrupt:11 Base address:0xa000
eth0:0 Link encap:Ethernet HWaddr 00:E0:7D:A2:AA:48
inet addr:172.17.30.128 Bcast:172.17.255.255 Mask:255.255.255.0
UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:11 Base address:0xa000
ipsec0 Link encap:IPIP Tunnel HWaddr
inet addr:192.168.123.128 Mask:255.255.255.0
UP RUNNING NOARP MTU:16260 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:63 overruns:0 carrier:0
collisions:0 txqueuelen:10
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:371650 errors:0 dropped:0 overruns:0 frame:0
TX packets:371650 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:79646540 (75.9 Mb) TX bytes:79646540 (75.9 Mb)
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use
Iface
172.17.30.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.42.236.0 192.168.123.254 255.255.255.0 UG 0 0 0
ipsec0
192.168.123.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.123.0 0.0.0.0 255.255.255.0 U 0 0 0
ipsec0
0.0.0.0 192.168.123.254 0.0.0.0 UG 0 0 0 eth0
192.168.123.254 is the ip of my SMC-Barricade.
/etc/ipsec.conf
config setup
# THIS SETTING MUST BE CORRECT or almost nothing will work;
# %defaultroute is okay for most simple cases.
interfaces=%defaultroute
# Debug-logging controls: "none" for (almost) none, "all" for lots.
klipsdebug=none
plutodebug=none
# Use auto= parameters in conn descriptions to control startup
actions.
plutoload=%search
plutostart=%search
# Close down old connection when new one using same ID shows up.
uniqueids=yes
# defaults for subsequent connection descriptions
# (mostly to fix internal defaults which, in retrospect, were badly chosen)
conn %default
keyingtries=0
disablearrivalcheck=no
authby=rsasig
leftrsasigkey=%dns
rightrsasigkey=%dns
conn office
leftrsasigkey=%cert
rightrsasigkey=%cert
left=%defaultroute
leftsubnet=172.17.30.0/24
leftid="[...]"
right=vpn.mydomain
rightid="[...]"
rightsubnet=10.42.236.0/24
auto=start
When I do a tcpdump -i ipsec0 on this and ping 10.42.236.252 I get the
following:
14:24:29.053960 unknown ip 0
14:24:30.070069 unknown ip 0
14:24:34.270908 unknown ip 0
This is the log from the "server-side":
OOct 31 14:10:37 host1 Pluto[18217]: "office" 80.133.134.177 #1: responding
to Main Mode from unknown peer 80.133.134.177
Oct 31 14:10:37 host1 Pluto[18217]: "office" 80.133.134.177 #1: Peer ID is
ID_DER_ASN1_DN: '[...]'
Oct 31 14:10:37 host1 Pluto[18217]: "office" 80.133.134.177 #1: Next CRL
update was expected on Oct 24 12:14:17 UTC 2002
Oct 31 14:10:37 host1 Pluto[18217]: "office" 80.133.134.177 #1: Next CRL
update was expected on Oct 24 12:14:17 UTC 2002
Oct 31 14:10:37 host1 Pluto[18217]: "office" 80.133.134.177 #1: deleting
connection "office" instance with peer 80.133.134.177
Oct 31 14:10:37 host1 Pluto[18217]: "office" 80.133.134.177 #1: sent MR3,
ISAKMP SA established
Oct 31 14:10:37 host1 Pluto[18217]: "office" 80.133.134.177 #2: responding
to Quick Mode
Oct 31 14:10:38 host1 Pluto[18217]: "office" 80.133.134.177 #2: IPsec SA
established
I spent a couple of hours in this today but don´t see any light :/
Thanks in advance
Manfred
_______________________________________________
Users mailing list
Users_at_lists.freeswan.org
http://lists.freeswan.org/mailman/listinfo/users
This archive was generated by hypermail 2.1.5 : Fri Nov 01 2002 - 05:20:36 CET