<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p></p>
<div>Hi All:</div>
<div><br>
</div>
<div>I still cannot let 2 private clients behind NAT to communicate public server simultaneous. Can you please help me?<br>
Thanks in advance.</div>
<div><br>
Following is my today's (failed) test procedure <br>
===================================================<br>
I configured "reqid" in IPSecXYZ.conf on public server machine. After that, "ip xfrm state" shows that the value is really set successfully.</div>
<div><br>
</div>
<div>Since there are 2 private clients, so the total # of "ip xfrm state" is 2*2==4. But "ip xfrm pol" only shows 2 instead of 4.
</div>
<div><br>
</div>
<div>I remember http://swan.libreswan.narkive.com/Rxj6YbXK/cannot-install-eroute-when-second-client-connected-from-behind-the-same-nat reads "but you still need some iptables rules based on the reqid to ensure these two flows will work properly" . So I speculate
that "ip xfrm pol" cannot "recognize" 2 "duplicated" record ???? (Maybe I am wrong because I define "overlapip" in IPSecXYZ.conf ???)</div>
<div><br>
</div>
<div>So I added following "iptables" rules on public IP server like following:</div>
<div>iptables -t mangle -I PREROUTING -m policy --dir in --reqid 16344 -j MARK --set-mark 16344<br>
iptables -t mangle -I PREROUTING -m policy --dir in --reqid 16335 -j MARK --set-mark 16335<br>
iptables -t mangle -I POSTROUTING -m policy --dir out --reqid 16344 -j MARK --set-mark 16344<br>
iptables -t mangle -I POSTROUTING -m policy --dir out --reqid 16335 -j MARK --set-mark 16335</div>
<div><br>
But still no luck. So have to get help from you again. </div>
<div><br>
</div>
<div><br>
</div>
<div>My System information:<br>
===============================<br>
Libreswan: 3.20 (netkey) on 3.10.0-693.el7.x86_64<br>
Red Hat Enterprise Linux Server 7.4 (Maipo)<br>
iptables: 1.4.21</div>
<div><br>
</div>
<div>Network topology<br>
===============================<br>
2 private client (private ip: 192.168.161.x) connect to NAT-GW (private IP: 192.168.161.x, public IP: 10.0.161.34).<br>
Public server (public ip: 10.0.146.196)</div>
<div><br>
</div>
<div><br>
IPSec.conf on public server for 1st private client:<br>
===============================<br>
conn 196to44<br>
ike=aes256-md5;modp1536<br>
authby=secret<br>
aggrmode=no<br>
ikelifetime=14409s<br>
ikev2=yes<br>
phase2=esp<br>
type=transport <br>
pfs=yes<br>
rekey=yes<br>
rekeymargin=540s<br>
phase2alg=3des,aes256-md5;modp1536<br>
salifetime=3600s<br>
<br>
# local<br>
leftid=10.0.146.196<br>
left=10.0.146.196<br>
<br>
# remote <br>
rightid=192.168.161.44<br>
right=10.0.161.34<br>
rightsubnet=192.168.161.0/24<br>
<br>
overlapip=yes <br>
reqid=16344<br>
<br>
auto=start</div>
<div><br>
IPSec.conf on public server for 2nd private client:<br>
===============================<br>
conn 196to35<br>
ike=aes256-md5;modp1536<br>
authby=secret<br>
aggrmode=no<br>
ikelifetime=14409s<br>
ikev2=yes<br>
phase2=esp<br>
type=transport <br>
pfs=yes<br>
rekey=yes<br>
rekeymargin=540s<br>
phase2alg=3des,aes256-md5;modp1536<br>
salifetime=3600s</div>
<div> # local<br>
leftid=10.0.146.196<br>
left=10.0.146.196<br>
<br>
# remote <br>
rightid=192.168.161.35<br>
right=10.0.161.34<br>
rightsubnet=192.168.161.0/24<br>
<br>
<br>
overlapip=yes <br>
reqid=16335</div>
<div><br>
auto=start</div>
<div><br>
</div>
<div>IPSec configuration on 1st private client:<br>
===============================<br>
conn ipv4tran44<br>
ike=aes256-md5;modp1536<br>
authby=secret<br>
aggrmode=no<br>
ikelifetime=14409s<br>
ikev2=yes<br>
phase2=esp<br>
type=transport <br>
pfs=yes<br>
rekey=yes<br>
rekeymargin=540s<br>
phase2alg=3des,aes256-md5;modp1536<br>
salifetime=3600s</div>
<div> # local <br>
leftid=192.168.161.44<br>
left=192.168.161.44<br>
leftsubnet=192.168.161.0/24<br>
<br>
# Remote<br>
rightid=10.0.146.196<br>
right=10.0.146.196<br>
<br>
auto=start</div>
<div><br>
IPSec configuration on 2nd private client:<br>
===============================<br>
conn ipv4tran35<br>
ike=aes256-md5;modp1536<br>
authby=secret<br>
aggrmode=no<br>
ikelifetime=14409s<br>
ikev2=yes<br>
phase2=esp<br>
type=transport <br>
pfs=yes<br>
rekey=yes<br>
rekeymargin=540s<br>
phase2alg=3des,aes256-md5;modp1536<br>
salifetime=3600s<br>
<br>
# local <br>
leftid=192.168.161.35<br>
left=192.168.161.35<br>
leftsubnet=192.168.161.0/24<br>
<br>
# Remote<br>
rightid=10.0.146.196<br>
right=10.0.146.196 <br>
<br>
auto=start</div>
<div><br>
</div>
<div>configuration on NAT-GW machine<br>
===============================<br>
service ipsec stop<br>
echo 1 > /proc/sys/net/ipv4/ip_forward<br>
echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp<br>
echo 1 > /proc/sys/net/ipv4/conf/eth3/proxy_arp</div>
<div>iptables -t nat -A POSTROUTING -p TCP -o eth1 -j SNAT --to-source 10.0.161.34:20000-40000<br>
iptables -t nat -A POSTROUTING -p UDP -o eth1 -j SNAT --to-source 10.0.161.34:40000-60000</div>
<div><br>
</div>
<div><br>
</div>
<div>configuration on public server machine<br>
===============================<br>
iptables -t mangle -I PREROUTING -m policy --dir in --reqid 16344 -j MARK --set-mark 16344<br>
iptables -t mangle -I PREROUTING -m policy --dir in --reqid 16335 -j MARK --set-mark 16335<br>
iptables -t mangle -I POSTROUTING -m policy --dir out --reqid 16344 -j MARK --set-mark 16344<br>
iptables -t mangle -I POSTROUTING -m policy --dir out --reqid 16335 -j MARK --set-mark 16335</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks and regards</div>
<div>Hao Chen</div>
<br>
<p></p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font color="#000000" face="Calibri, sans-serif" style="font-size:11pt"><b>From:</b> Swan <swan-bounces@lists.libreswan.org> on behalf of Hao Chen <earthlovepython@outlook.com><br>
<b>Sent:</b> Monday, October 30, 2017 10:36<br>
<b>To:</b> Paul Wouters<br>
<b>Cc:</b> swan@lists.libreswan.org<br>
<b>Subject:</b> Re: [Swan] Does libreswan v3.20 support multiple clients behind NAT to communicate with public server simultaneously?</font>
<div> </div>
</div>
<div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p><br>
</p>
<div>Hi Paul / all:</div>
<div>Paul: Thanks for your response at first !</div>
<div><br>
1. <br>
(1).<br>
In previous email, you mentioned "mark=-1/0xffffffff" and "Instead of NAT". Are you saying, I shall run "iptables -t mangle" on private client???</div>
<div>But it does NOT take effect after I run "iptables -t mangle -A POSTROUTING -p esp -m policy --dir out -s 192.168.161.44 -d 10.0.146.196 -j MARK --set-mark 16344" on private client.
</div>
<div>After I run above command, "ip xfrm state" still shows reqid as "16397" on private client.
</div>
<div>Only after I configure "reqid" in ipsecXX.conf on private machine, "ip xfrm state" shows the value which I configured.
<br>
(By the way, on public server side, "reqid" (output of "ip xfrm state") is changed after I configure "reqid" in IPSecXXX.conf also.)</div>
<div>(2).<br>
Can you please tell me <b><u>where </u></b>to run "iptables -t mangle --set-mask"?
<b><u>On private client or public server</u></b>? </div>
<div><br>
2.<br>
http://swan.libreswan.narkive.com/Rxj6YbXK/cannot-install-eroute-when-second-client-connected-from-behind-the-same-nat writes "still need some iptables rules based on the reqid to ensure these two flows" .
</div>
<div><br>
https://libreswan.org/wiki/SAref_code writes "When a packet is sent out, it will pass through iptables. Libreswan maintains an IPSEC chain in the mangle table. This allows it to tag packets using xmark".
</div>
<div><br>
</div>
<div>From above links, looks like "iptables -t mangle" is used for some work. but https://linux.die.net/man/8/iptables writes "--set-mark mark " "It can for example be used in conjunction with iproute2"</div>
<div><br>
</div>
<div>Can you please <b><u>give some clue(links) about how does "--set-mark mark " work with IPsec(xfrm</u></b>)?
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks </div>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<br>
<br>
<div style="color:rgb(0,0,0)">
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font color="#000000" face="Calibri, sans-serif" style="font-size:11pt"><b>From:</b> Paul Wouters <paul@nohats.ca><br>
<b>Sent:</b> Thursday, October 26, 2017 18:53<br>
<b>To:</b> Hao Chen<br>
<b>Cc:</b> swan@lists.libreswan.org<br>
<b>Subject:</b> Re: [Swan] Does libreswan v3.20 support multiple clients behind NAT to communicate with public server simultaneously?</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt">
<div class="PlainText">On Thu, 26 Oct 2017, Hao Chen wrote:<br>
<br>
> at first, without configuring "overlapid=yes", pluto.log report "cannot install eroute, it is in use for XXXX" for the 2nd startup client. <br>
> <br>
> Only 1st client can communicate with public sever in all time.<br>
> No matter how many times I restart IPsec on 2nd machine, pluto.log on public server report "cannot install eroute, it is in use for XXXX".<br>
> <br>
> <br>
> 2.<br>
> Get some clue from <a id="LPlnk188331" href="http://swan.libreswan.narkive.com/Rxj6YbXK/cannot-install-eroute-when-second-client-connected-from-behind-the-same-nat" previewremoved="true">
http://swan.libreswan.narkive.com/Rxj6YbXK/cannot-install-eroute-when-second-client-connected-from-behind-the-same-nat</a>
<div id="LPBorder_GT_15093816478880.17943854259919378" style="width:100%; text-indent:0px; overflow:auto; margin-bottom:20px">
<table id="LPContainer_15093816478860.27687341315289804" style="width:90%; overflow:auto; padding-top:20px; padding-bottom:20px; margin-top:20px; border-top-color:rgb(200,200,200); border-bottom-color:rgb(200,200,200); border-top-width:1px; border-bottom-width:1px; border-top-style:dotted; border-bottom-style:dotted; background-color:rgb(255,255,255)" cellspacing="0">
<tbody>
<tr valign="top" style="border-spacing:0px">
<td id="TextCell_15093816478870.46574296071303345" style="padding: 0px; vertical-align: top; display: table-cell; position: relative;" colspan="2">
<div id="LPRemovePreviewContainer_15093816478870.7141413522890203"></div>
<div id="LPTitle_15093816478870.3728653677931708" style="top:0px; color:rgb(0,120,215); line-height:21px; font-family:"wf_segoe-ui_light","Segoe UI Light","Segoe WP Light","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size:21px; font-weight:400">
<a id="LPUrlAnchor_15093816478870.5235490824996054" style="text-decoration:none" href="http://swan.libreswan.narkive.com/Rxj6YbXK/cannot-install-eroute-when-second-client-connected-from-behind-the-same-nat" target="_blank">"cannot install eroute" when second
client connected from ...</a></div>
<div id="LPMetadata_15093816478880.5655738373388426" style="margin:10px 0px 16px; color:rgb(102,102,102); line-height:14px; font-family:"wf_segoe-ui_normal","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size:14px; font-weight:400">
swan.libreswan.narkive.com</div>
<div id="LPDescription_15093816478880.025574693488586097" style="color:rgb(102,102,102); line-height:20px; overflow:hidden; font-family:"wf_segoe-ui_normal","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size:14px; font-weight:400; display:block; max-height:100px">
"cannot install eroute" when second client connected from behind the same NAT</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
> I configured "overlapid=yes" on server side. And added 2 IPTables rule on NAT-GW:<br>
<br>
Instead of NAT, use:<br>
<br>
mark=-1/0xffffffff<br>
<br>
This should install the policies with a unique mark for each connection.<br>
When used with overlapip=yes, it should install multiple policies to<br>
the same IPs with the mark causing the rules to be different and not<br>
clash.<br>
<br>
The only limitation is that traffic must be initiated from the client,<br>
to get the initial MARK. If multiple clients clash, then you cannot<br>
from the server connect to the one IP and expect to reach one or the<br>
other. But in the typical use of IPsec Transport Mode with L2TP, it<br>
is always the client generating the traffic so this solution works.<br>
<br>
Paul<br>
</div>
</span></font></div>
</div>
</div>
</div>
</div>
</body>
</html>