Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 27 subscribers
  • Views 1339 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Ipsec question (have I found a bug in strongwan?)

Nitin Mirchandani

Hello

I will explain my network first -

Site A= 192.168.89.0 (XG site)

Site B= 192.168.82.0 (TMG)

Site B is TMG (I know - its old - I set up at my parents years ago). 

Site A - newly setup XG. 

IPSEC site to site. All set, good to go. Both pingable.

 

Site a (XG)<-----------------> Site b(TMG)

192.168.89.0                        192.168.82.0

 

Now, If I start a redirection from site B to Site A (This redirection is from game server), The game server at Site A (XG side) is dropped by XG to route via the tunnel. This XG site server(192.168.89.97) can never ping ANY site at TMG side now. On packet capture, I see that XG is now trying to route the packet (source is XG Site LAN) via WAN IP, instead of the LAN IP. 

In the below packet capture, I have set two pings. One is from 192.168.89.10 to 192.168.82.97( This is routed properly)

Other is 192.168.89.97 to 192.168.89.97. This works well, but the moment i start the redirection server, it stops pinging. Uninstalling the redicrection doesnot help. Rebooting doesnot help. ONLY change in IP helps.

Both the 192.168.89.x have gateway set as 192.168.89.1

 Magically, If i change the IP from 192.168.89.97 to any other ip, it starts working!!

192.168.89.97 is lost to me now as I can never use it again.

I have restarted both TMG and XG to see if there is any reminiscent of route left. It doesnot route 192.168.89.97 EVER.

 

(Sorry if the above is complex - Its too complex for me to understand too - I have wasted 5 days trying to troubleshoot. Why XG is putting WAN ip to route a pacjet on IPSEC tunnel?)



This thread was automatically locked due to age.
Parents
  • 0

    Can you show us the IPsec Policy? 

    And please explain the Local / Remote Network.

    If XG uses the WAN interface, it does not have the route set by the policy.

    Likely the Policy is not proper configured or you missed something in the process. 

     

    PS: i am not quite sure what you mean by Redirect Server? 

  • 0 in reply to LuCar Toni

    Hello

    IPSEC policy was set out correct (Because I could ping from another server behind XG as you can see above - 192.168.89.10 is pinging 192.168.82.97. In my original problem 192.168.89.97 was unable to ping 192.168.82.97)

    I can post it if you want - (Which page screenshot?)

     

    Here is what i did -

    I deleted ALL references of this host (host which was behind XG and not able to ping).

    Then recreated everything. This time I chose name which was exchange.local.

    I have a small hint (after reading the XML export files) that the host name chosen by me - EXCHANGE might be referenced by other variables inside XG.

    Still testing - I am able to ping after I deleted the problematic host - EXCHANGE. Will try to recreate what made the routing stop.

  • 0 in reply to Nitin Mirchandani

    Hello

    I think I need to change the heading of this - I have now identified a clear bug in XG routing, (and not Strongwan)

    Scenario-

    Tow Sites connected by IPSEC.

    I want to publish a server (Dnat) (From Site A or B).

    The moment publish rules are alive, Lan to Lan routing from XG is stopped. (Means This published server cannot send packets to other site LAN any more)

    Non XG site can ping the XG site, but XG will stop all routing from Lan to Lan for that published IP.

    Lan to Lan rule is on top - So should not effect.

     

    Please check.

  • 0 in reply to LuCar Toni

    I cannot test it now - I was able to crash the firewall (crash mean it was not accessible)

    What i did was to create another listener(Dnat rule) on the LAN Ip. Bad move - It brought down the firewall box. (Sophos engg - Why did it happen?). I went in the shell and was able to bring the Lan ip up by doing shell command of disable and enable admin on that LAN (Read it here on forum).

    After deleting the Dnat rule (of LAN), the routing was messed up. It wouldnt route anything (or publish anything). 

    I had no choice but to factory reset.

     

    After this I redid everything, published and everything is working fine. I am afraid to do port forward 443 as it was the cause of all problems.

    And for question - after I make some messup in routing (which XG allows), is there a command to reset all the routes to factory?

     

    Thank You

  • 0 in reply to Nitin Mirchandani

    Hi  

    There is no specific command to reset the routes changes in the XG firewall, Is there any service request you have raised for this issue?

    Is there any packet capture on Proto 50 or for DNAT traffic?

  • 0 in reply to Keyur

    I would have loved to debug... But internet went down too.

    School zoom sessions were on, so I reset everything to be on feet.

     

    Before the reset, I could replicate the routing error reliably.

    If I had exchange server published (exchange general rules), and then switched to port 443 publish the exchange server, the IPSEC route will go down one side (ie, other side could ping, I couldnot). Changing the IP address of host (in XG firewall) would make it ping again. But then again after 2 minutes, It will stop routing one way.

     

    Also, why routing got messed up when I tried to publish dnat on lan ip.

     

    Thank You

     

    PS - home user - So no support case...

Reply
  • 0 in reply to Keyur

    I would have loved to debug... But internet went down too.

    School zoom sessions were on, so I reset everything to be on feet.

     

    Before the reset, I could replicate the routing error reliably.

    If I had exchange server published (exchange general rules), and then switched to port 443 publish the exchange server, the IPSEC route will go down one side (ie, other side could ping, I couldnot). Changing the IP address of host (in XG firewall) would make it ping again. But then again after 2 minutes, It will stop routing one way.

     

    Also, why routing got messed up when I tried to publish dnat on lan ip.

     

    Thank You

     

    PS - home user - So no support case...

Children
No Data