Hello guys, so, having trouble with this.
To sum it up, i'm trying to connect a fritzbox (connected through a sim card, so, he's natted) to the Sophos XG.
I get the tunnel up, so phase 1 is ok, phase 2 seems ok also, but no pings or anything goes through the tunnel.
Tracerouting from the inside of the fritzbox network seems to go to the internet and not through the tunnel at all.
Anyone care to help? Here is the log of the ipsec.
2018-06-20 12:56:53 29[NET] <45> received packet: from INITIATOR-PUBLIC-IP[17231] to SOPHOS-PUBLIC-IP[500] (496 bytes)
2018-06-20 12:56:53 29[ENC] <45> parsed ID_PROT request 0 [ SA V V V V V V ]
2018-06-20 12:56:53 29[IKE] <45> received XAuth vendor ID
2018-06-20 12:56:53 29[IKE] <45> received DPD vendor ID
2018-06-20 12:56:53 29[IKE] <45> received NAT-T (RFC 3947) vendor ID
2018-06-20 12:56:53 29[IKE] <45> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
2018-06-20 12:56:53 29[IKE] <45> received draft-ietf-ipsec-nat-t-ike-03 vendor ID
2018-06-20 12:56:53 29[ENC] <45> received unknown vendor ID: a2:22:6f:c3:64:50:0f:56:34:ff:77:db:3b:74:f4:1b
2018-06-20 12:56:53 29[IKE] <45> INITIATOR-PUBLIC-IP is initiating a Main Mode IKE_SA
2018-06-20 12:56:53 29[ENC] <45> generating ID_PROT response 0 [ SA V V V V ]
2018-06-20 12:56:53 29[NET] <45> sending packet: from SOPHOS-PUBLIC-IP[500] to INITIATOR-PUBLIC-IP[17231] (152 bytes)
2018-06-20 12:56:53 21[NET] <45> received packet: from INITIATOR-PUBLIC-IP[17231] to SOPHOS-PUBLIC-IP[500] (228 bytes)
2018-06-20 12:56:53 21[ENC] <45> parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
2018-06-20 12:56:54 21[IKE] <45> remote host is behind NAT
2018-06-20 12:56:54 21[ENC] <45> generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
2018-06-20 12:56:54 21[NET] <45> sending packet: from SOPHOS-PUBLIC-IP[500] to INITIATOR-PUBLIC-IP[17231] (244 bytes)
2018-06-20 12:56:54 09[NET] <45> received packet: from INITIATOR-PUBLIC-IP[17568] to SOPHOS-PUBLIC-IP[4500] (108 bytes)
2018-06-20 12:56:54 09[ENC] <45> parsed ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
2018-06-20 12:56:54 09[CFG] <45> looking for pre-shared key peer configs matching SOPHOS-PUBLIC-IP...INITIATOR-PUBLIC-IP[INITIATOR-FQDN]
2018-06-20 12:56:54 09[CFG] <45> selected peer config "VPN-NAME-1"
2018-06-20 12:56:54 09[IKE] <VPN-NAME-1|45> IKE_SA VPN-NAME-1[45] established between SOPHOS-PUBLIC-IP[FQDN-SOPHOS-XG]...INITIATOR-PUBLIC-IP[INITIATOR-FQDN]
2018-06-20 12:56:54 09[IKE] <VPN-NAME-1|45> scheduling rekeying in 4986s
2018-06-20 12:56:54 09[IKE] <VPN-NAME-1|45> maximum IKE_SA lifetime 5346s
2018-06-20 12:56:54 09[ENC] <VPN-NAME-1|45> generating ID_PROT response 0 [ ID HASH ]
2018-06-20 12:56:54 09[NET] <VPN-NAME-1|45> sending packet: from SOPHOS-PUBLIC-IP[4500] to INITIATOR-PUBLIC-IP[17568] (84 bytes)
2018-06-20 12:56:54 16[NET] <VPN-NAME-1|45> received packet: from INITIATOR-PUBLIC-IP[17568] to SOPHOS-PUBLIC-IP[4500] (332 bytes)
2018-06-20 12:56:54 16[ENC] <VPN-NAME-1|45> parsed QUICK_MODE request 1148215621 [ HASH SA No KE ID ID ]
2018-06-20 12:56:54 16[ENC] <VPN-NAME-1|45> generating QUICK_MODE response 1148215621 [ HASH SA No KE ID ID ]
2018-06-20 12:56:54 16[NET] <VPN-NAME-1|45> sending packet: from SOPHOS-PUBLIC-IP[4500] to INITIATOR-PUBLIC-IP[17568] (308 bytes)
2018-06-20 12:56:54 25[NET] <VPN-NAME-1|45> received packet: from INITIATOR-PUBLIC-IP[17568] to SOPHOS-PUBLIC-IP[4500] (52 bytes)
2018-06-20 12:56:54 25[ENC] <VPN-NAME-1|45> parsed QUICK_MODE request 1148215621 [ HASH ]
2018-06-20 12:56:54 25[IKE] <VPN-NAME-1|45> CHILD_SA VPN-NAME-1{17} established with SPIs ca809606_i feeabbe2_o and TS 192.168.1.0/24 === 192.168.178.0/24
2018-06-20 12:56:54 25[APP] <VPN-NAME-1|45> [SSO] (sso_invoke_once) SSO is disabled.
2018-06-20 12:56:54 25[APP] <VPN-NAME-1|45> [COP-UPDOWN] (ref_counting) ref_count: 0 to 1 ++ up ++ (192.168.1.0/24#192.168.178.0/24)
2018-06-20 12:56:54 25[APP] <VPN-NAME-1|45> [COP-UPDOWN] (cop_updown_invoke_once) UID: 45 Net: Local SOPHOS-PUBLIC-IP Remote INITIATOR-PUBLIC-IP Connection: INITIATOR-CONN-NAME Fullname: VPN-NAME-1
2018-06-20 12:56:54 25[APP] <VPN-NAME-1|45> [COP-UPDOWN] (cop_updown_invoke_once) Tunnel: User '' Peer-IP '' my-IP '' up-client
2018-06-20 12:56:54 18[APP] [COP-UPDOWN][DB] (db_conn_info) hostname: 'INITIATOR-CONN-NAME' result --> id: '3', mode: 'ntn', tunnel_type: '0', subnet_family:'0'
2018-06-20 12:56:54 18[APP] [COP-UPDOWN] (do_cop_updown_invoke_once) ---- exec updown ++ up ++
2018-06-20 12:56:54 18[APP] [COP-UPDOWN] (do_cop_updown_invoke_once) [NTN] NTN get actual...
2018-06-20 12:56:54 18[APP] [COP-UPDOWN][DB] (db_query) No data retrieved from query: 'SELECT ( nath.netid || '/' || nath.netmask ) AS natedlan FROM tblvpnconnhostrel AS rel JOIN tblhost AS h ON h.hostid = rel.hostid JOIN tblhost AS nath ON rel .natedhost = nath.hostid WHERE rel.connectionid = $1 AND rel.hostlocation = 'L' AND h.netid = $2 AND h.netmask = $3 LIMIT 1;' status: 2 rows: 0
2018-06-20 12:56:54 18[APP]
2018-06-20 12:56:54 18[APP] [COP-UPDOWN] (do_cop_updown_invoke_once) [IPSEC0] using ipsec dummy interface 'ipsec0'
2018-06-20 12:56:54 18[APP] [COP-UPDOWN][NET] (get_src_ip) source address for 192.168.1.0 is IP: 192.168.1.254
2018-06-20 12:56:54 18[APP]
2018-06-20 12:56:54 18[APP] [COP-UPDOWN][SHELL] (run_shell) 'ip route add 192.168.178.0/24 dev ipsec0 src 192.168.1.254 table 220': success 0
2018-06-20 12:56:54 18[APP] [COP-UPDOWN] (add_routes) no routes to add for INITIATOR-CONN-NAME on interface ipsec0
2018-06-20 12:56:54 18[APP] [COP-UPDOWN][SHELL] (run_shell) 'ip route flush cache': success 0
2018-06-20 12:56:54 18[APP] [COP-UPDOWN][SHELL] (run_shell) 'ip route flush cache': success 0
2018-06-20 12:56:54 18[APP] [COP-UPDOWN][SHELL] (run_shell) '/bin/service fwm:vpn_connection_chains -t json -s nosync -b '{"me":"SOPHOS-PUBLIC-IP","peer":"INITIATOR-PUBLIC-IP","mynet":"192.168.1.0/24","peernet":"192.168.178.0/24","connop":"1","iface":"ppp1","myproto":"0","myport":"0","peerproto":"0","peerport":"0","conntype":"ntn","actnet":"","compress":"0","conn_id":"3"}'': success 0
2018-06-20 12:56:54 18[APP] [COP-UPDOWN][SHELL] (run_shell) 'conntrack -D --not-protonum=6 --inzone-outzone=2': success 0
2018-06-20 12:56:54 18[APP] [COP-UPDOWN][SHELL] (run_shell) 'conntrack -D --not-protonum=6 --inzone-outzone=5': success 0
2018-06-20 12:56:54 18[APP] [COP-UPDOWN][SHELL] (run_shell) 'conntrack -D --protonum=50': error returned 1
2018-06-20 12:57:25 14[IKE] <VPN-NAME-1|45> sending DPD request
2018-06-20 12:57:25 14[ENC] <VPN-NAME-1|45> generating INFORMATIONAL_V1 request 1858849905 [ HASH N(DPD) ]
2018-06-20 12:57:25 14[NET] <VPN-NAME-1|45> sending packet: from SOPHOS-PUBLIC-IP[4500] to INITIATOR-PUBLIC-IP[17568] (92 bytes)
2018-06-20 12:57:25 20[NET] <VPN-NAME-1|45> received packet: from INITIATOR-PUBLIC-IP[17568] to SOPHOS-PUBLIC-IP[4500] (84 bytes)
2018-06-20 12:57:25 20[ENC] <VPN-NAME-1|45> parsed INFORMATIONAL_V1 response 1858849905 [ HASH N(DPD_ACK) ]
2018-06-20 12:57:55 24[IKE] <VPN-NAME-1|45> sending DPD request
2018-06-20 12:57:55 24[ENC] <VPN-NAME-1|45> generating INFORMATIONAL_V1 request 2011212783 [ HASH N(DPD) ]
2018-06-20 12:57:55 24[NET] <VPN-NAME-1|45> sending packet: from SOPHOS-PUBLIC-IP[4500] to INITIATOR-PUBLIC-IP[17568] (92 bytes)
2018-06-20 12:57:55 13[NET] <VPN-NAME-1|45> received packet: from INITIATOR-PUBLIC-IP[17568] to SOPHOS-PUBLIC-IP[4500] (84 bytes)
2018-06-20 12:57:55 13[ENC] <VPN-NAME-1|45> parsed INFORMATIONAL_V1 response 2011212783 [ HASH N(DPD_ACK) ]
This thread was automatically locked due to age.
