<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 29, 2014 at 4:02 PM, Vukovics Mihaly <span dir="ltr"><<a href="mailto:vm@informatik.hu" target="_blank">vm@informatik.hu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Again,<br>
<br>
I did some more debugging with wireshark:<br>
<br>
- When I ping from the client to an internal server the src address is<br>
the IP assigned by racoon (192.168.7.2) the dst address is the internal<br>
server address (10.1.1.1) => the reply comes back from src 10.1.1.1 and<br>
goes to 192.168.7.2.<br>
- When I try to ping the client from the internal server the src address<br>
is the EXTERNAL/INTERNET address of the VPN server, the dst is<br>
192.168.7.2. Thus the echo reply tries to go to the EXTERNAL address not<br>
to the internal server IP.<br>
<br>
On the serverside the policies are(46... client external IP, 81... VPN<br>
server external IP):<br>
<br>
root@therex:~# setkey -D<br>
81.182.243.141[4500] 46.107.164.103[4500]<br>
esp-udp mode=tunnel spi=214892320(0x0cceff20) reqid=0(0x00000000)<br>
E: 3des-cbc 12dcc63a 782e5782 67ea1a47 5d248b19 e50503d5 44b1c4f9<br>
A: hmac-md5 e9bd2963 beabf3cc 0be13c10 a89ab638<br>
seq=0x00000000 replay=4 flags=0x00000000 state=mature<br>
created: Dec 29 14:53:35 2014 current: Dec 29 14:57:07 2014<br>
diff: 212(s) hard: 3600(s) soft: 2880(s)<br>
last: Dec 29 14:53:36 2014 hard: 0(s) soft: 0(s)<br>
current: 34059(bytes) hard: 0(bytes) soft: 0(bytes)<br>
allocated: 423 hard: 0 soft: 0<br>
sadb_seq=1 pid=60610 refcnt=0<br>
46.107.164.103[4500] 81.182.243.141[4500]<br>
esp-udp mode=tunnel spi=155541734(0x094560e6) reqid=0(0x00000000)<br>
E: 3des-cbc c6b731bf 68c993c3 47054ace 67a9e953 6439a475 08f9a356<br>
A: hmac-md5 110e04e0 600b5d5b edcf3de1 b5436c93<br>
seq=0x00000000 replay=4 flags=0x00000000 state=mature<br>
created: Dec 29 14:53:35 2014 current: Dec 29 14:57:07 2014<br>
diff: 212(s) hard: 3600(s) soft: 2880(s)<br>
last: hard: 0(s) soft: 0(s)<br>
current: 0(bytes) hard: 0(bytes) soft: 0(bytes)<br>
allocated: 0 hard: 0 soft: 0<br>
sadb_seq=2 pid=60610 refcnt=0<br>
<br>
In Shrew policy the tunnel is defined between the client internal(NAT)<br>
address 192.168.0.212 and the VPN server EXTERNAL 81... address.<br>
<br>
Can this mismatch cause my problem?<br></blockquote><div>Hi,<br><br></div><div>Yes, it is possible<br>but i not sure if "Shrew" always to have traffic from Gateway to Client...<br><br></div><div>Regards, <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Best Regards,<br>
Mihaly<br>
<br>
<br>
<br>
Koszi:<br>
Vuki<div class="HOEnZb"><div class="h5"><br>
<br>
On 2014.12.28. 18:26, Vukovics Mihaly wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Everyone,<br>
<br>
I am facing a strange problem, and have been debugging for days, but<br>
without success...<br>
<br>
I have set up a Racoon IPSEC VPN server. There are two different<br>
proposals, one for Android devices and one for Shrew client.<br>
The Android devices can connet, everything work fine, but when I<br>
connect from Windows clients (XP, Win7) using latest Shrew client, I<br>
can reach any IP addresses/services from the client, but can't reach<br>
the client(s) from the server side. Even PING does not work.<br>
<br>
I have checked the traffic with Wireshark, the echo request reaches<br>
the client, but look like the client does not respond to this. (no<br>
response found!)<br>
<br>
The is no error on both (Racoon/Shrew) side in the debug logs.<br>
<br>
Fragments from racoon.conf<br>
<br>
"remote anonymous<br>
{<br>
<br>
exchange_mode aggressive;<br>
verify_identifier on;<br>
my_identifier keyid tag "***";<br>
peers_identifier keyid tag "client";<br>
generate_policy unique;<br>
ike_frag on;<br>
nat_traversal on;<br>
dpd_delay 30;<br>
proposal_check obey;<br>
lifetime time 24 hours;<br>
proposal<br>
{<br>
encryption_algorithm aes 256;<br>
hash_algorithm sha1;<br>
authentication_method xauth_psk_server;<br>
dh_group 5;<br>
}<br>
}<br>
<br>
remote anonymous<br>
{<br>
exchange_mode aggressive;<br>
verify_identifier on;<br>
my_identifier keyid tag "***";<br>
peers_identifier keyid tag "android";<br>
generate_policy unique;<br>
ike_frag on;<br>
nat_traversal on;<br>
dpd_delay 30;<br>
proposal_check claim;<br>
lifetime time 24 hours;<br>
proposal<br>
{<br>
encryption_algorithm aes 128;<br>
hash_algorithm sha1;<br>
authentication_method xauth_psk_server;<br>
dh_group 2;<br>
}<br>
}<br>
<br>
mode_cfg<br>
{<br>
network4 192.168.7.2;<br>
pool_size 16;<br>
netmask4 255.255.255.0;<br>
split_network include <a href="http://10.1.0.0/16" target="_blank">10.1.0.0/16</a>;<br>
auth_source system;<br>
auth_groups "vpn-user";<br>
group_source system;<br>
conf_source local;<br>
wins4 10.1.1.1;<br>
dns4 10.1.1.254;<br>
default_domain "***";<br>
banner "/etc/racoon/motd";<br>
}<br>
<br>
sainfo anonymous<br>
{<br>
lifetime time 3600 seconds;<br>
encryption_algorithm aes;<br>
authentication_algorithm hmac_md5,hmac_sha1;<br>
compression_algorithm deflate;<br>
}<br>
"<br>
<br>
The Shrew profile(alreadt try all possibilities):<br>
<br>
"<br>
n:version:4<br>
n:network-ike-port:500<br>
n:network-mtu-size:1380<br>
n:client-addr-auto:1<br>
n:network-natt-port:4500<br>
n:network-natt-rate:15<br>
n:network-frag-size:540<br>
n:network-dpd-enable:1<br>
n:client-banner-enable:1<br>
n:network-notify-enable:1<br>
n:client-dns-used:1<br>
n:client-dns-auto:1<br>
n:client-dns-suffix-auto:1<br>
n:client-splitdns-used:1<br>
n:client-splitdns-auto:1<br>
n:client-wins-used:1<br>
n:client-wins-auto:1<br>
n:phase1-dhgroup:5<br>
n:phase1-life-secs:86400<br>
n:phase1-life-kbytes:0<br>
n:vendor-chkpt-enable:0<br>
n:phase2-life-secs:3600<br>
n:phase2-life-kbytes:0<br>
n:policy-nailed:0<br>
n:policy-list-auto:1<br>
s:network-host:***<br>
s:client-auto-mode:pull<br>
s:client-iface:virtual<br>
s:network-natt-mode:enable<br>
s:network-frag-mode:enable<br>
s:auth-method:mutual-psk-xauth<br>
s:ident-client-type:keyid<br>
s:ident-server-type:keyid<br>
s:ident-client-data:client<br>
s:ident-server-data:therapia<br>
b:auth-mutual-psk:***<br>
s:phase1-exchange:aggressive<br>
s:phase1-cipher:auto<br>
s:phase1-hash:auto<br>
s:phase2-transform:auto<br>
s:phase2-hmac:auto<br>
s:ipcomp-transform:disabled<br>
n:phase2-pfsgroup:-1<br>
s:policy-level:auto<br>
"<br>
<br>
This is the only suspicious msg in IPSEC log in Shrew:<br>
<br>
"14/12/28 18:12:25 !! : unable to connect to pfkey interface"<br>
<br>
Has Anybody any idea which directions to go?<br>
<br>
Best Regards,<br>
Mihaly<br>
<br>
</blockquote>
<br>
<br>
<br></div></div><div class="HOEnZb"><div class="h5">
______________________________<u></u>_________________<br>
vpn-help mailing list<br>
<a href="mailto:vpn-help@lists.shrew.net" target="_blank">vpn-help@lists.shrew.net</a><br>
<a href="https://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">https://lists.shrew.net/<u></u>mailman/listinfo/vpn-help</a><br>
</div></div></blockquote></div><br></div></div>