Arch Linux

Shelltux

Member

Registered: 2012-12-15

Posts: 5

Website

Strongswan does not set offered virtual IP to my local interface

Hi everybody,

I have trouble getting a VPN connection into the intranet of the company I am working for. I have already searched this forum for getting hints for my problem. Because I was not able to find something I decided to make my first post here. So, hello everybody ;-).

We are using an NCP Secure Communications VPN Server that acts as a gateway into the companies intranet. Because NCP does not provide their client for Linux I have to use Strongswan (at least I decided to use Strongswan). The admin of the VPN server gateway has configured IPSec with XAuth and an PreShared Key. I was able to connect to our intranet using my HTC Android Smartphone with its pre installed VPN client, so i think that there is no unusal protocol behaviour of the VPN server gateway.

Here is my local setup:

Notebook with Archlinux [3.5.4-1-ARCH x86_64 GNU/Linux].
Connecting with an wireless device named wlan0 and IP 192.168.2.101.
I am behind a router with IP 192.168.2.1.
I have no special configuration regarding the VPN connection tries on the router or my local iptables.
I have installed ipsec-tools using pacman and Strongswan 5.0.1 from the AUR.

Remote setup:

Lets say the NCP Server gateway has a public IP of 1.2.3.4 and always offers an intranet IP of the pool 10.10.10.0/24.

So what I try to do is to connect from my laptop [192.168.2.101] through my router [192.168.2.1] to the VPN server gateway [1.2.3.4] which offers me an IP from the pool [10.10.10.0/24]. With that IP I want to connect through the VPN server gateway using IPSec into the companies intranet.

My strongswan.conf is:

# strongswan.conf - strongSwan configuration file

charon {

	# number of worker threads in charon
	threads = 16
	port_nat_t = 4500
	install_virtual_ip_on
	load = aes des sha1 sha2 md5 gmp random nonce hmac stroke kernel-netlink socket-default updown request_virtual_ip
}

pluto {

}

libstrongswan {

	#  set to no, the DH exponent size is optimized
	#  dh_exponent_ansi_x9_42 = no
}

My ipsec.conf is:

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
	charondebug="dmn 4, mgr 4, ike 4, chd 4, knl 4, net 4"

conn %default
	ikelifetime=60m
	keylife=20m
	rekeymargin=3m
	keyingtries=1
	keyexchange=ikev1
	aggressive=no
	compress=no
	esp=aes256-sha256--modp1024
	ike=aes256-sha256--modp1024
	installpolicy=yes
	type=tunnel

conn home
	left=%defaultroute
	leftsourceip=%config
	right=1.2.3.4
	leftauth=psk
	leftauth2=xauth
	rightauth=psk
	mobike=yes
	auto=add

For authentication I must use an defined PreShared-Key and for authorization I have to use username/password credentials. For that I have created an ipsec.secrets file:

: PSK "SomePSK"
MyUsername : XAUTH "MyPassword"

The keyexchange, esp and ike configuration values are the one given by the VPN server gateway admin.

So, that is my setup.

To start the connection I do:

root@hoare: ~$>ipsec start
Starting strongSwan 5.0.1 IPsec [starter]...
root@hoare: ~$>ipsec up home

And here is the output of that try:

initiating Main Mode IKE_SA home[1] to 1.2.3.4
generating ID_PROT request 0 [ SA V V V ]
sending packet: from 192.168.2.101[500] to 1.2.3.4[500]
received packet: from 1.2.3.4[500] to 192.168.2.101[500]
parsed ID_PROT response 0 [ SA V V V V V V ]
received XAuth vendor ID
received NAT-T (RFC 3947) vendor ID
received DPD vendor ID
received unknown vendor ID: 40:48:b7:d5:6e:bc:e8:85:25:e7:de:7f:00:d6:c2:d3:c0:00:00:00
received Cisco Unity vendor ID
received unknown vendor ID: c6:f5:7a:c3:98:f4:93:20:81:45:b7:58:1e:87:89:83
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from 192.168.2.101[500] to 1.2.3.4[500]
received packet: from 1.2.3.4[500] to 192.168.2.101[500]
parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
local host is behind NAT, sending keep alives
remote host is behind NAT
generating ID_PROT request 0 [ ID HASH ]
sending packet: from 192.168.2.101[4500] to 1.2.3.4[4500]
received packet: from 1.2.3.4[4500] to 192.168.2.101[4500]
parsed ID_PROT response 0 [ ID HASH N(INITIAL_CONTACT) ]
IDir '10.10.10.223' does not match to '1.2.3.4'
deleting IKE_SA home[1] between 192.168.2.101[192.168.2.101]...1.2.3.4[%any]
sending DELETE for IKE_SA home[1]
generating INFORMATIONAL_V1 request 2315846961 [ HASH D ]
sending packet: from 192.168.2.101[4500] to 1.2.3.4[4500]

I do not understand what the message

IDir '10.10.10.223' does not match to '1.2.3.4'

means to me. 10.10.10.223 is the IP that was offered by the VPN server gateway to me and 1.2.3.4 is the IP of the public VPN server gateway. I think my local machine must now use the offered IP as it's source IP but still have to route all traffic using the opened tunnel to the gateway 1.2.3.4.

I hope somebody has any hints for me. Am I on the complete wrong way?

Thanks for any help

Markus

ecdsa

Member

Registered: 2012-12-17

Posts: 2

Re: Strongswan does not set offered virtual IP to my local interface

10.10.10.223 is the IP that was offered by the VPN server gateway to me and 1.2.3.4 is the IP of the public VPN server gateway.

I guess 10.10.10.223 is actually the private IP address of the VPN gateway (according to the log it is behind a NAT), which it uses to identify itself. Since strongSwan also uses IP addresses as identities by default (at least in case of PSK) the identities will not match due to the NAT.

You can try setting

rightid=%any

in your config. That way strongSwan should accept the gateway's identity.

Shelltux

Member

Registered: 2012-12-15

Posts: 5

Website

Re: Strongswan does not set offered virtual IP to my local interface

Hi ecdsa,

Thanks for you reply. I will give it a try tomorrow.

Shelltux

Member

Registered: 2012-12-15

Posts: 5

Website

Re: Strongswan does not set offered virtual IP to my local interface

Hi,

rightid=%any

works perfectly. Thank you very much for that.

But now it goes on with, i guess, routing problems :-).

I can successfully establish the connection and I also get the required internal DNS names for resolving from the gateway:

installing DNS server A.B.C.D to /etc/resolv.conf
installing DNS server W.X.Y.Z to /etc/resolv.conf
installing new virtual IP 10.10.10.223
generating QUICK_MODE request 3913068965 [ HASH SA No KE ID ID ]
sending packet: from 192.168.2.101[4500] to 1.2.3.4[4500]
received packet: from 1.2.3.4[4500] to 192.168.2.101[4500]
parsed QUICK_MODE response 3913068965 [ HASH SA No KE ID ID ]
CHILD_SA home{1} established with SPIs caca4e53_i 984d1639_o and TS 10.10.10.223/32 === 1.2.3.4/32

But when I try to access some intranet website i can see (using wireshark), that my machine asks one of the offered DNS servers for resolving but an answer never reaches my interface.
I added

leftfirewall=yes

to my ipsec.conf because referring to the documentation this directive would lead Strongswan into adding the required rules to my local routing tables.

Any further hints for me?

Thanks and regards

Markus

Last edited by Shelltux (2012-12-19 08:23:02)