From: Bjarke Bruun (bbj_at_b-nss.com)
Date: Fri Jan 10 2003 - 16:41:58 CET
Hi there
I've been trying to setup ipsec on a rh7.3 box as a ipsec gateway with version
1.99 and iptables and a rh7.3 as as roadwarrior with the same version and
kernel version (2.4.18-3custom).
"Ipsec verify" checksout after changing the "ipchains" checks in
/usr/local/lib/ipsec/* to iptables etc. on both computers and can from the
client initiate a connection with
[root_at_client root]# ipsec auto --up road
104 "road" #6: STATE_MAIN_I1: initiate
010 "road" #6: STATE_MAIN_I1: retransmission; will wait 20s for response
but as you can see, it does not connect - in /var/log/secure is says
---- start ----
[root_at_client root]# tail /var/log/secure
Jan 10 16:30:55 linux pluto[4180]: "road" #8: initiating Main Mode
Jan 10 16:30:56 linux pluto[4180]: "road" #8: ERROR: asynchronous network
error report on eth1 for message to 80.160.253.153 port 500, complainant
80.160.253.153: Connection refused [errno 111, origin ICMP type 3 code 3 (not
authenticated)]
Jan 10 16:31:06 linux pluto[4180]: "road" #8: ERROR: asynchronous network
error report on eth1 for message to 80.160.253.153 port 500, complainant
80.160.253.153: Connection refused [errno 111, origin ICMP type 3 code 3 (not
authenticated)]
Jan 10 16:31:14 linux pluto[4180]: "road": terminating SAs using this
connection
Jan 10 16:31:14 linux pluto[4180]: "road" #8: deleting state (STATE_MAIN_I1)
[root_at_client root]#
---- end ----
The gateway does not put any information in either /var/log/secure or
/var/log/messages besides "/etc/init.d/ipsec start/stop/..." information that
checks out fine, for all I know.
It's the "Connection refused [err....." that annoys me since the iptables
setup is as follows on the gateway and client
[root_at_client root]# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:500
dpt:500
ACCEPT esp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT ah -- 0.0.0.0/0 0.0.0.0/0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 3
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 3
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:500
dpt:500
ACCEPT esp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT ah -- 0.0.0.0/0 0.0.0.0/0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 3
[root_at_client root]#
Does anyone have any idea what I'm doing wrong, or what I need to do to get is
started?
The ipsec.conf on the client is as follows:
---- start
# basic configuration
config setup
# THIS SETTING MUST BE CORRECT or almost nothing will work;
# %defaultroute is okay for most simple cases.
interfaces=%defaultroute
# Debug-logging controls: "none" for (almost) none, "all" for lots.
klipsdebug=all
plutodebug=all
# Use auto= parameters in conn descriptions to control startup
actions.
plutoload=%search
plutostart=%search
# Close down old connection when new one using same ID shows up.
uniqueids=yes
# defaults for subsequent connection descriptions
conn %default
# How persistent to be in (re)keying negotiations (0 means very).
keyingtries=0
# Parameters for manual-keying testing (DON'T USE OPERATIONALLY).
# Note: only one test connection at a time can use these parameters!
spi=0x200
esp=3des-md5-96
espenckey=0x01234567_89abcdef_02468ace_13579bdf_12345678_9abcdef0
espauthkey=0x12345678_9abcdef0_2468ace0_13579bdf
# RSA authentication with keys from DNS.
authby=secret
#leftrsasigkey=%dns
#rightrsasigkey=%dns
auto=add
# sample connection
conn road
left=a.b.c.d # Gateway's information
leftid=@gw.example.com #
leftsubnet=192.168.11.0/24 #
leftrsasigkey=0sAQOGv8N0dYfWM+u... #
rightnexthop=%defaultroute # correct in many situations
right=%any # Wildcard: we don't know the laptop's IP
rightid=client.example.com #
rightrsasigkey=0sAQOH/DNIUAEfLJuOzn... #
auto=add # authorizes but doesn't start this
# connection at startup
---- end
The ipsec.conf on the client is as follows:
---- start
# basic configuration
config setup
# THIS SETTING MUST BE CORRECT or almost nothing will work;
# %defaultroute is okay for most simple cases.
interfaces=%defaultroute
# Debug-logging controls: "none" for (almost) none, "all" for lots.
klipsdebug=none
plutodebug=none
# Use auto= parameters in conn descriptions to control startup
actions.
plutoload=%search
plutostart=%search
# Close down old connection when new one using same ID shows up.
uniqueids=yes
# defaults for subsequent connection descriptions
# (these defaults will soon go away)
conn %default
keyingtries=0
disablearrivalcheck=no
authby=rsasig
leftrsasigkey=%dnsondemand
rightrsasigkey=%dnsondemand
conn road
left=%defaultroute # Picks up our dynamic IP
leftid=@client.example.com
leftrsasigkey=0sAQOH/DNIUAEfLJuOznj...
right=a.b.c.d # Remote information
rightsubnet=192.168.11.0/24 #
rightid=@gw.example.com #
rightrsasigkey=0sAQOGv8N0dYfWM+uUKg...
auto=add # authorizes but doesn't start this
# connection at startup
---- end
-- Bjarke Bruun - E-mail: bbj_at_b-nss.com __ _ / / (_)__ __ ____ __ / /__/ / _ \/ // /\ \/ / . . . t h e c h o i c e o f a /____/_/_//_/\_,_/ /_/\_\ G N U g e n e r a t i o n . . . _______________________________________________ Users mailing list Users_at_lists.freeswan.org http://lists.freeswan.org/mailman/listinfo/users
This archive was generated by hypermail 2.1.5 : Wed Jan 15 2003 - 20:11:38 CET