<div dir="ltr">Thank you very much. <div>After I enable IP forwarding and add sourceip, things are working now. The send_redirects/accept_redirects seems does not matter. Regarding sourceip, you mentioned.</div><div><span style="font-size:12.8px">"Of course, if the IPsec </span><span style="font-size:12.8px">server is just routing the entire /24 elsewhere, this does not apply."</span><br></div><div><span style="font-size:12.8px">In my case, I do want route the entire /24 to remote. Can you confirm, sourceip is required even in this case?</span></div><div><span style="font-size:12.8px">Last time, when I set up VTI support, sourceip seems was not required.</span></div><div><span style="font-size:12.8px"><br></span></div><div><div><br></div><div>I did not do -up multiple times. I did ipsec start/stop.</div><div><br></div><div>Thanks,</div><div>Xinwei</div><div><br></div><div><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 19, 2017 at 2:50 PM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@nohats.ca" target="_blank">paul@nohats.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Thu, 19 Jan 2017, Xinwei Hong wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I'm trying to set up a VPN tunnel between two networks.<br>
"my_vpn": <a href="http://10.0.1.0/24===10.2.128.171" rel="noreferrer" target="_blank">10.0.1.0/24===10.2.128.171</a><10.<wbr>2.128.171>..10.2.128.170<10.2.<wbr>128.170>===<a href="http://10.0.2.0/24" rel="noreferrer" target="_blank">10.0.2.0/24</a>;<br>
</blockquote>
<br>
</span><span class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
conn my_vpn<br>
left=10.2.128.171<br>
right=10.2.128.170<br>
leftsubnet=<a href="http://10.0.1.0/24" rel="noreferrer" target="_blank">10.0.1.0/24</a><br>
rightsubnet=<a href="http://10.0.2.0/24" rel="noreferrer" target="_blank">10.0.2.0/24</a><br>
</blockquote>
<br></span>
You mighy want to add leftsourceip=10.0.1.1 and rightsourceip=10.0.2.1<br>
That is, leftsourceip is the IP from the <a href="http://10.0.1.0/24" rel="noreferrer" target="_blank">10.0.1.0/24</a> that is configured on<br>
the IPsec machine's internal ethernet interface. Of course, if the IPsec<br>
server is just routing the entire /24 elsewhere, this does not apply.<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
000 Total IPsec connections: loaded 1, active 1<br>
000 <br>
000 State Information: DDoS cookies not required, Accepting new IKE connections<br>
000 IKE SAs: total(2), half-open(0), open(0), authenticated(2), anonymous(0)<br>
000 IPsec SAs: total(2), authenticated(2), anonymous(0)<br>
000 <br>
000 #4: "my_vpn":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27060s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate<br>
000 #4: "my_vpn" <a href="mailto:esp.4b1111f5@10.2.128.170" target="_blank">esp.4b1111f5@10.2.128.170</a> <a href="mailto:esp.91c9eaa8@10.2.128.171" target="_blank">esp.91c9eaa8@10.2.128.171</a> <a href="mailto:tun.0@10.2.128.170" target="_blank">tun.0@10.2.128.170</a> <a href="mailto:tun.0@10.2.128.171" target="_blank">tun.0@10.2.128.171</a> ref=0 refhim=0 Traffic: ESPin=0B ESPout=0B! ESPmax=4194303B <br>
000 #1: "my_vpn":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 1619s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate<br>
000 #3: "my_vpn":500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 27538s; isakmp#2; idle; import:not set<br>
000 #3: "my_vpn" <a href="mailto:esp.d171d1be@10.2.128.170" target="_blank">esp.d171d1be@10.2.128.170</a> <a href="mailto:esp.b441013@10.2.128.171" target="_blank">esp.b441013@10.2.128.171</a> <a href="mailto:tun.0@10.2.128.170" target="_blank">tun.0@10.2.128.170</a> <a href="mailto:tun.0@10.2.128.171" target="_blank">tun.0@10.2.128.171</a> ref=0 refhim=0 Traffic: ESPin=0B ESPout=0B! ESPmax=4194303B <br>
000 #2: "my_vpn":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 2338s; lastdpd=-1s(seq in:0 out:0); idle; import:not set<br>
</blockquote>
<br></span>
Looks fine, there are a few "dying" old tunnels there. You probably ran<br>
--up a few times?<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
000 Bare Shunt list:<br>
000 <br>
<br>
“ipsec verify” shows some error:<br>
Verifying installed system and configuration files<br>
<br>
Version check and ipsec on-path [OK]<br>
Libreswan 3.18 (netkey) on 4.4.0-31-generic<br>
Checking for IPsec support in kernel [OK]<br>
NETKEY: Testing XFRM related proc values<br>
ICMP default/send_redirects [NOT DISABLED]<br>
</blockquote>
<br></span>
Really just disabled those in /etc/sysctl.*<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Disable /proc/sys/net/ipv4/conf/*/send<wbr>_redirects or NETKEY will act on or cause sending of bogus ICMP redirects!<br>
<br>
ICMP default/accept_redirects [NOT DISABLED]<br>
</blockquote>
<br></span>
Really just disabled those in /etc/sysctl.*<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Disable /proc/sys/net/ipv4/conf/*/acce<wbr>pt_redirects or NETKEY will act on or cause sending of bogus ICMP redirects!<br>
</blockquote>
<br></span>
Really just disabled those in /etc/sysctl.*<span class=""><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
XFRM larval drop [OK]<br>
Pluto ipsec.conf syntax [OK]<br>
Hardware random device [N/A]<br>
Two or more interfaces found, checking IP forwarding [FAILED]<br>
</blockquote>
<br></span>
Forwarding is disabled, you might want it enabled for traffic to move<br>
between eth0 and eth1, although it is possible you have done that<br>
using iptables rules instead?<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Checking rp_filter [ENABLED]<br>
/proc/sys/net/ipv4/conf/all/r<wbr>p_filter [ENABLED]<br>
/proc/sys/net/ipv4/conf/defau<wbr>lt/rp_filter [ENABLED]<br>
/proc/sys/net/ipv4/conf/eth0/<wbr>rp_filter [ENABLED]<br>
/proc/sys/net/ipv4/conf/eth1/<wbr>rp_filter [ENABLED]<br>
/proc/sys/net/ipv4/conf/eth2/<wbr>rp_filter [ENABLED]<br>
/proc/sys/net/ipv4/conf/ip_vt<wbr>i0/rp_filter [ENABLED]<br>
/proc/sys/net/ipv4/conf/lo/rp<wbr>_filter [ENABLED]<br>
rp_filter is not fully aware of IPsec and should be disabled<br>
</blockquote>
<br>
</span><span class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
the networks on each side is on eth3, for which I have changed rp_filter to 0.<br>
</blockquote>
<br></span>
I would really disable it on all interfaces. Or at the very least enable<br>
martian logging, so you know that rp_filter is being hit and you need to<br>
fix it.<span class=""><br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I have:<br>
local host 10.0.1.2 (added route to <a href="http://10.0.2.0/24" rel="noreferrer" target="_blank">10.0.2.0/24</a> via 10.0.1.1 on this eth3)<br>
local vpn router: has 10.0.1.1 on eth3.<br>
10.2.128.171 on eth1<br>
remote vpn router: 10.0.2.1 on eth3<br>
10.2.128.170 on eth1<br>
remote host: 10.0.2.2 (added route to <a href="http://10.0.1.0/24" rel="noreferrer" target="_blank">10.0.1.0/24</a> via 10.0.2.1 on eth3)<br>
<br>
when I try to ping from local host to 10.0.2.2, traffic only reach local vpn router on eth3.<br>
</blockquote>
<br></span>
Post likely because the ping packet it generated on the ipsec gw itself<br>
without the *sourceip= entries used the "nearest IP", so your ping<br>
would have source ip 10.2.128.171 and destination ip 10.0.2.2, which<br>
DOES NOT match any tunnel because your tunnel is for <a href="http://10.0.1.0/24" rel="noreferrer" target="_blank">10.0.1.0/24</a> <-><br>
<a href="http://10.0.2.0/24" rel="noreferrer" target="_blank">10.0.2.0/24</a>. See the above leftsourceip/rightsourceip options.<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
"ipsec whack --trafficstatus" got:<br>
<br>
006 #4: "my_vpn", type=ESP, add_time=1484863659, inBytes=0, outBytes=0, id='10.2.128.170'<br>
<br>
006 #3: "my_vpn", type=ESP, add_time=1484863655, inBytes=0, outBytes=0, id='10.2.128.170'<br>
</blockquote>
<br></span>
This shows the tunnel is up (but two of them?) but no traffic matched<br>
and 0 traffic was encrypted/decrypted.<span class="HOEnZb"><font color="#888888"><br>
<br>
Paul<br>
</font></span></blockquote></div><br></div>