[must die]

System admin

Удалите вообще строчку

conn antey-network
# left side of network
left=реал ip шлюза 1
leftid=@grandgw.grand.loc
leftsubnet=192.168.1.0/24
leftrsasigkey=....ключи сгенерились нормально
leftnexthop=чfaultroute

если я не ошибаюсь openswan ругается на строчку ниже, чем там где ошибка

[System admin]

must die Спасибо огромное, всё заработало...но появилась другая проблема...не ходят пакеты
Роутинг настроен, защищенное соединение между хостами устанавливается успешно..но пакеты не ходят :-(
Полдня просидел...так и не нашел причину....
Где можно посмотреть логи по этому поводу ?
Может поможешь ? Какие тебе файлы прислать для осмотра ?

Спасиб :-)

[must die]

System admin

Ты главное пингуй не со шлюзов, т.к. с них ничего пинговаться не будет. Попробуй просто из машины в сети.

[System admin]

must die Да вот пробую щас..ничего не получается :-(
Странная фигня....уже и остальные цепочки в Файрволе отключил оставил только те что в описании и всё равно... :-(

[must die]

Two or more interfaces found, checking IP forwarding [FAILED]

А форвардинг пакетов включен?

[System admin]

must die
root@anteygw:~# ipsec setup --start
ipsec_setup: Starting Openswan IPsec cvs2002Mar12_02:19:03...
root@anteygw:~# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan cvs2002Mar12_02:19:03 (klips)
Checking for IPsec support in kernel [OK]
Checking for RSA private key (/etc/ipsec.secrets) [OK]
Checking that pluto is running [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing
Checking for 'ip' command [OK]
Checking for 'iptables' command [OK]

Opportunistic Encryption DNS checks:
Looking for TXT in forward dns zone: anteygw [MISSING]
Does the machine have at least one non-private address? [OK]
Looking for TXT in reverse dns zone: 254.3.130.213.in-addr.arpa. [MISSING]
Looking for TXT in reverse dns zone: 10.82.209.89.in-addr.arpa. [MISSING]

Правда у меня на одной из шлюзов 2 внешних интерфейса, один из них соединяется с нетом через pppoe, второй через SDSL, ну основной через pppop, на него defaultroute, вроде бы правильно определяется раз устанавливается защещенное соединение...пробовал тушить SDSL интерфейс..всё равно тож самое..может в pppoe какая то ошибка ?
И при старте соединения пишется такая фигня :
104 "antey" #1: STATE_MAIN_I1: initiate
003 "antey" #1: ignoring unknown Vendor ID payload [4f45536c4663417d606a4950]
003 "antey" #1: received Vendor ID payload [Dead Peer Detection]
003 "antey" #1: received Vendor ID payload [RFC 3947] method set to=110
106 "antey" #1: STATE_MAIN_I2: sent MI2, expecting MR2

003 "antey" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected (Вот это меня смущает)

108 "antey" #1: STATE_MAIN_I3: sent MI3, expecting MR3
004 "antey" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1536}
117 "antey" #2: STATE_QUICK_I1: initiate
004 "antey" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x06a6da6a <0xc8f947a3 xfrm=AES_0-HMAC_SHA1 NATD=none DPD=none}

А на другом шлюзе при запуске команды ipsec setup --start, подвисает внешний интерфейс секунд от 30..до минуты...
Но при запуске соединения после раздупления устанавливается защищенное соединение пишет:
117 "antey" #3: STATE_QUICK_I1: initiate
004 "antey" #3: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0xc8f947a4 <0x06a6da6b xfrm=AES_0-HMAC_SHA1 NATD=none DPD=none}

т.е. как бы всё ок...

[must die]

System admin


Сделай с обоих сторон плиз /etc/init.d/ipsec restart
ipsec auto --up имя соединения

и кинь результаты сюда

[System admin]

must die
С обеих сторон одновременно запустил рестарт....Правда везде в инструкции описано что ipsec в init.d находится...у меня slackware, я там не нашел такой папки при установке.
Меня еще смутило что в папке /etc/ понаделывалось куча папок с мёртвыми ссылками rc.0.......rc.6 в них ссылки K7ipsec на файл /etc/init.d/ipsec....
root@grandgw:/# ipsec setup --restart
ipsec_setup: Stopping Openswan IPsec...
ipsec_setup: Starting Openswan IPsec cvs2002Mar11_15:19:03...
root@grandgw:/# ipsec auto --up antey
104 "antey" #3: STATE_MAIN_I1: initiate
010 "antey" #3: STATE_MAIN_I1: retransmission; will wait 20s for response
010 "antey" #3: STATE_MAIN_I1: retransmission; will wait 40s for response
003 "antey" #3: ignoring unknown Vendor ID payload [4f457140555b76786d617a54]
003 "antey" #3: received Vendor ID payload [Dead Peer Detection]
003 "antey" #3: received Vendor ID payload [RFC 3947] method set to=110
106 "antey" #3: STATE_MAIN_I2: sent MI2, expecting MR2
010 "antey" #3: STATE_MAIN_I2: retransmission; will wait 20s for response
003 "antey" #3: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected
108 "antey" #3: STATE_MAIN_I3: sent MI3, expecting MR3
004 "antey" #3: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1536}
117 "antey" #4: STATE_QUICK_I1: initiate
004 "antey" #4: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x01d98348 <0x9f7f5bf9 xfrm=AES_0-HMAC_SHA1 NATD=none DPD=none}

с другой стороны

root@anteygw:~# ipsec auto --up antey
117 "antey" #4: STATE_QUICK_I1: initiate
004 "antey" #4: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x9f7f5bfa <0x01d98349 xfrm=AES_0-HMAC_SHA1 NATD=none DPD=none}

По интерфейсам :

root@grandgw:~# ifconfig

eth0 Link encap:Ethernet HWaddr 00:80:48:15:FF:6B
inet addr:192.168.1.100 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:5085747 errors:0 dropped:0 overruns:0 frame:0
TX packets:4578474 errors:0 dropped:0 overruns:2 carrier:0
collisions:0 txqueuelen:1000
RX bytes:382151673 (364.4 Mb) TX bytes:3192787355 (3044.8 Mb)
Interrupt:12 Base address:0xd000

eth1 Link encap:Ethernet HWaddr 00:80:48:16:0C:27
inet addr:195.138.94.182 Bcast:195.138.94.183 Mask:255.255.255.252
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4662397 errors:0 dropped:0 overruns:0 frame:0
TX packets:5063854 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3198166282 (3050.0 Mb) TX bytes:380934600 (363.2 Mb)
Interrupt:10 Base address:0xb800

ipsec0 Link encap:Ethernet HWaddr 00:80:48:16:0C:27
inet addr:195.138.94.182 Mask:255.255.255.252
UP RUNNING NOARP MTU:16260 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:1652382 errors:0 dropped:21538 overruns:0 carrier:0
collisions:0 txqueuelen:10
RX bytes:0 (0.0 b) TX bytes:120290800 (114.7 Mb)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:171547 errors:0 dropped:0 overruns:0 frame:0
TX packets:171547 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:16301260 (15.5 Mb) TX bytes:16301260 (15.5 Mb)

С этого узла все пакеты которые идут на внешку заворичивают на ipsec0

А с этого никакие не заворачивают на ipsec0, все идут в дроп..

root@anteygw:~# ifconfig

eth0 Link encap:Ethernet HWaddr 00:00:1C:D3:C2:E8
inet addr:192.168.0.100 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:332031 errors:0 dropped:0 overruns:0 frame:0
TX packets:300119 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:71984635 (68.6 MiB) TX bytes:152263668 (145.2 MiB)
Interrupt:16 Base address:0xec00

eth1 Link encap:Ethernet HWaddr 00:00:1C:D3:BD:3B
inet addr:213.130.3.254 Bcast:213.130.3.255 Mask:255.255.255.192
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:117986 errors:0 dropped:0 overruns:0 frame:0
TX packets:56209 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:12151996 (11.5 MiB) TX bytes:15806042 (15.0 MiB)
Interrupt:17 Base address:0xe800

eth2 Link encap:Ethernet HWaddr 00:80:48:15:FE:D7
inet addr:192.168.2.100 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2343056 errors:2 dropped:14 overruns:2 frame:0
TX packets:223333 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:296427569 (282.6 MiB) TX bytes:52542254 (50.1 MiB)
Interrupt:18 Base address:0xe400

ipsec0 Link encap:Point-to-Point Protocol
inet addr:89.209.82.10 Mask:255.255.255.255
UP RUNNING NOARP MTU:16260 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:4 overruns:0 carrier:0
collisions:0 txqueuelen:10
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:401 errors:0 dropped:0 overruns:0 frame:0
TX packets:401 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:32998 (32.2 KiB) TX bytes:32998 (32.2 KiB)

ppp0 Link encap:Point-to-Point Protocol
inet addr:89.209.82.10 P-t-P:87.236.224.163 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:229246 errors:0 dropped:0 overruns:0 frame:0
TX packets:215644 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:140138334 (133.6 MiB) TX bytes:47335185 (45.1 MiB)

По роутингу:

root@grandgw:/# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
m.root-servers. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
b.root-servers. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
a.root-servers. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
k.root-servers. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
f.root-servers. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
d.root-servers. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
G.ROOT-SERVERS. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
E.ROOT-SERVERS. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
j.root-servers. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
h.root-servers. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
i.root-servers. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
AS-20144-has-no Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
c.root-servers. Grand-club-gw.T 255.255.255.255 UGH 0 0 0 ipsec0
195.138.94.180 * 255.255.255.252 U 0 0 0 eth1
195.138.94.180 * 255.255.255.252 U 0 0 0 ipsec0
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0
192.168.0.0 Grand-club-gw.T 255.255.255.0 UG 0 0 0 ipsec0
loopback * 255.0.0.0 U 0 0 0 lo
default Grand-club-gw.T 128.0.0.0 UG 0 0 0 ipsec0
128.0.0.0 Grand-club-gw.T 128.0.0.0 UG 0 0 0 ipsec0
default Grand-club-gw.T 0.0.0.0 UG 0 0 0 eth1


root@anteygw:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
62-125-207-82.i bb-0-GE1-vlan15 255.255.255.255 UGH 0 0 0 eth1
bras-lo.comstar * 255.255.255.255 UH 0 0 0 ipsec0
bras-lo.comstar * 255.255.255.255 UH 0 0 0 ppp0
antey.farlep.ne bb-0-GE1-vlan15 255.255.255.255 UGH 0 0 0 eth1
antey-2.farlep. bb-0-GE1-vlan15 255.255.255.255 UGH 0 0 0 eth1
213.130.3.192 * 255.255.255.192 U 0 0 0 eth1
192.168.2.0 * 255.255.255.0 U 0 0 0 eth2
192.168.1.0 * 255.255.255.0 U 0 0 0 ipsec0
192.168.0.0 * 255.255.255.0 U 0 0 0 eth0
loopback * 255.0.0.0 U 0 0 0 lo
default * 0.0.0.0 U 0 0 0 ppp0


и первый раз такая вот ошибка по
root@anteygw:~# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan cvs2002Mar12_02:19:03 (klips)
Checking for IPsec support in kernel [OK]
Checking for RSA private key (/etc/ipsec.secrets) [OK]
Checking that pluto is running [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing
Checking tun0x1004@195.138.94.182 from 192.168.0.0/24 to 192.168.1.0/24 [FAILED]
MASQUERADE from 192.168.0.70 to 0.0.0.0/0 kills tunnel 192.168.0.70 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.71 to 0.0.0.0/0 kills tunnel 192.168.0.71 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.72 to 0.0.0.0/0 kills tunnel 192.168.0.72 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.73 to 0.0.0.0/0 kills tunnel 192.168.0.73 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.74 to 0.0.0.0/0 kills tunnel 192.168.0.74 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.162 to 0.0.0.0/0 kills tunnel 192.168.0.162 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.161 to 0.0.0.0/0 kills tunnel 192.168.0.161 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.62 to 0.0.0.0/0 kills tunnel 192.168.0.62 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.99 to 0.0.0.0/0 kills tunnel 192.168.0.99 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.102 to 0.0.0.0/0 kills tunnel 192.168.0.102 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.24 to 0.0.0.0/0 kills tunnel 192.168.0.24 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.26 to 0.0.0.0/0 kills tunnel 192.168.0.26 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.29 to 0.0.0.0/0 kills tunnel 192.168.0.29 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.221 to 0.0.0.0/0 kills tunnel 192.168.0.221 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.222 to 0.0.0.0/0 kills tunnel 192.168.0.222 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.2 to 0.0.0.0/0 kills tunnel 192.168.0.2 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.19 to 0.0.0.0/0 kills tunnel 192.168.0.19 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.211 to 0.0.0.0/0 kills tunnel 192.168.0.211 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.5 to 0.0.0.0/0 kills tunnel 192.168.0.5 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.31 to 0.0.0.0/0 kills tunnel 192.168.0.31 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.41 to 0.0.0.0/0 kills tunnel 192.168.0.41 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.42 to 0.0.0.0/0 kills tunnel 192.168.0.42 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.43 to 0.0.0.0/0 kills tunnel 192.168.0.43 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.45 to 0.0.0.0/0 kills tunnel 192.168.0.45 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.115 to 0.0.0.0/0 kills tunnel 192.168.0.115 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.105 to 0.0.0.0/0 kills tunnel 192.168.0.105 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.199 to 0.0.0.0/0 kills tunnel 192.168.0.199 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.200 to 0.0.0.0/0 kills tunnel 192.168.0.200 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.201 to 0.0.0.0/0 kills tunnel 192.168.0.201 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.202 to 0.0.0.0/0 kills tunnel 192.168.0.202 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.51 to 0.0.0.0/0 kills tunnel 192.168.0.51 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.213 to 0.0.0.0/0 kills tunnel 192.168.0.213 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.52 to 0.0.0.0/0 kills tunnel 192.168.0.52 -> 192.168.1.0/24
[FAILED]
MASQUERADE from 192.168.0.173 to 0.0.0.0/0 kills tunnel 192.168.0.173 -> 192.168.1.0/24
[FAILED]
SNAT from 192.168.0.0/24 to 0.0.0.0/0 kills tunnel 192.168.0.0/24 -> 192.168.1.0/24
[FAILED]
SNAT from 195.138.94.182 to !192.168.1.0/24 kills tunnel 195.138.94.182 -> 192.168.1.0/24
Checking for 'ip' command [OK]
Checking for 'iptables' command [OK]

Opportunistic Encryption DNS checks:
Looking for TXT in forward dns zone: anteygw [MISSING]
Does the machine have at least one non-private address? [OK]
Looking for TXT in reverse dns zone: 254.3.130.213.in-addr.arpa. [MISSING]
Looking for TXT in reverse dns zone: 10.82.209.89.in-addr.arpa. [MISSING]


root@grandgw:/# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan cvs2002Mar11_15:19:03 (klips)
Checking for IPsec support in kernel [OK]
Checking for RSA private key (/etc/ipsec.secrets) [OK]
Checking that pluto is running [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing
Checking tun0x1006@89.209.82.10 from 192.168.1.0/24 to 192.168.0.0/24 [FAILED]
MASQUERADE from 192.168.1.0/24 to 0.0.0.0/0 kills tunnel 192.168.1.0/24 -> 192.168.0.0/24
[FAILED]
SNAT from 192.168.1.0/24 to 0.0.0.0/0 kills tunnel 192.168.1.0/24 -> 192.168.0.0/24
[FAILED]
SNAT from 89.209.82.10 to !192.168.0.0/24 kills tunnel 89.209.82.10 -> 192.168.0.0/24
Checking for 'ip' command [OK]
Checking for 'iptables' command [OK]

Opportunistic Encryption DNS checks:
Looking for TXT in forward dns zone: grandgw [MISSING]
Does the machine have at least one non-private address? [OK]
Looking for TXT in reverse dns zone: 182.94.138.195.in-addr.arpa. [MISSING]

Этих ошибок раньше небыло....
Вот первый раз появились :-(

[must die]

System admin

Сдается мне ты не отключил максардинг для пакетов идущих в туннель.
Ссылка на wiki openswan.org