Hi,
i tried to use astaro for secure accessing our LAN from our wireless lan.
So i setup a box with 2 NICS, eth0 for internal LAN, getting IP via DHCP (mostly 192.168.0.91) and eth1 for wireless lan (static IP 192.18.1.1, running dhcpd), connected via crossed cable to an accesspoint.
i setup the ipsec configuration like mentioned in the X509 Host to Net Dynamic HOWTO.
This seem to work - both client and astaro are showing a established vpn connection, but accessing the internal network (ping, traceroute, ftp, etc) does not work.
It seems, that routing does not work - has anybody a guess.
i appreciate any help, thanks.
[Here's a cut'n paste out of the IPSEC Log ...]
Dec 11 03:22:17 (none) ipsec_setup: ...FreeS/WAN IPsec started
Dec 11 03:22:17 (none) Pluto[27869]: Starting Pluto (FreeS/WAN Version 1.96)
Dec 11 03:22:17 (none) Pluto[27869]: including X.509 patch (Version 0.9.9)
Dec 11 03:22:17 (none) Pluto[27869]: Changing to directory '/etc/ipsec.d/cacerts'
Dec 11 03:22:17 (none) Pluto[27869]: loaded cacert file 'philippsen.pem' (1176 bytes)
Dec 11 03:22:17 (none) Pluto[27869]: Changing to directory '/etc/ipsec.d/crls'
Dec 11 03:22:17 (none) Pluto[27869]: Warning: empty directory
Dec 11 03:22:17 (none) Pluto[27869]: loaded my X.509 cert file '/etc/x509cert.der' (1059 bytes)
Dec 11 03:22:19 (none) Pluto[27869]: | from whack: got --esp=3des
Dec 11 03:22:19 (none) Pluto[27869]: added connection description "Administrator_1"
Dec 11 03:22:19 (none) Pluto[27869]: listening for IKE messages
Dec 11 03:22:19 (none) Pluto[27869]: adding interface ipsec0/eth1 192.168.1.1
Dec 11 03:22:19 (none) Pluto[27869]: loading secrets from "/etc/ipsec.secrets"
Dec 11 03:22:19 (none) Pluto[27869]: loaded private key file '/etc/ipsec.d/private/firewall.pem' (963 bytes)
Dec 11 03:23:30 (none) Pluto[27869]: packet from 192.168.1.252:500: ignoring Vendor ID payload
Dec 11 03:23:30 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #1: responding to Main Mode from unknown peer 192.168.1.252
Dec 11 03:23:31 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #1: ignoring informational payload, type IPSEC_INITIAL_CONTACT
Dec 11 03:23:31 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #1: Peer ID is ID_USER_FQDN: 'xxxx@xxxxx.de'
Dec 11 03:23:31 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #1: Issuer CRL not found
Dec 11 03:23:31 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #1: Issuer CRL not found
Dec 11 03:23:31 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #1: sent MR3, ISAKMP SA established
Dec 11 03:23:31 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #2: responding to Quick Mode
Dec 11 03:23:31 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #2: route-client output: SIOCADDRT: Network is unreachable
Dec 11 03:23:31 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #2: route-client output: /usr/local/lib/ipsec/_updown: `route add -net 192.168.1.252 netmask 255.255.255.255 dev ipsec0 gw 192.168.0.91' failed
Dec 11 03:23:31 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #2: route-client output: /usr/local/lib/ipsec/_updown: (incorrect or missing nexthop setting??)
Dec 11 03:23:31 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #2: route-client command exited with status 7
Dec 11 03:23:41 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #2: route-client output: SIOCADDRT: Network is unreachable
Dec 11 03:23:41 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #2: route-client output: /usr/local/lib/ipsec/_updown: `route add -net 192.168.1.252 netmask 255.255.255.255 dev ipsec0 gw 192.168.0.91' failed
Dec 11 03:23:41 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #2: route-client output: /usr/local/lib/ipsec/_updown: (incorrect or missing nexthop setting??)
Dec 11 03:23:41 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #2: route-client command exited with status 7
Dec 11 03:23:41 (none) Pluto[27869]: ERROR: "Administrator_1" 192.168.1.252 #2: pfkey write() of SADB_DELETE message 21 for Delete SA esp.9592e0f4@192.168.1.1 failed. Errno 3: No such process
Dec 11 03:23:41 (none) Pluto[27869]: | 02 04 00 03 0a 00 00 00 15 00 00 00 dd 6c 00 00
Dec 11 03:23:41 (none) Pluto[27869]: | 02 00 01 00 95 92 e0 f4 00 01 00 00 00 00 00 00
Dec 11 03:23:41 (none) Pluto[27869]: | 03 00 05 00 00 00 00 00 02 00 01 f4 c0 a8 01 fc
Dec 11 03:23:41 (none) Pluto[27869]: | 00 00 00 00 00 00 00 00 03 00 06 00 00 00 00 00
Dec 11 03:23:41 (none) Pluto[27869]: | 02 00 00 00 c0 a8 01 01 00 00 00 00 00 00 00 00
Dec 11 03:24:01 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #1: ignoring informational payload, type INVALID_PAYLOAD_TYPE
Dec 11 03:24:01 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #1: received and ignored informational message
Dec 11 03:24:41 (none) Pluto[27869]: "Administrator_1" 192.168.1.252 #2: max number of retransmissions (2) reached STATE_QUICK_R1
Dec 11 03:24:41 (none) Pluto[27869]: ERROR: "Administrator_1" 192.168.1.252 #2: pfkey write() of SADB_DELETE message 22 for Delete SA esp.9592e0f4@192.168.1.1 failed. Errno 3: No such process
Dec 11 03:24:41 (none) Pluto[27869]: | 02 04 00 03 0a 00 00 00 16 00 00 00 dd 6c 00 00
Dec 11 03:24:41 (none) Pluto[27869]: | 02 00 01 00 95 92 e0 f4 00 01 00 00 00 00 00 00
Dec 11 03:24:41 (none) Pluto[27869]: | 03 00 05 00 00 00 00 00 02 00 01 f4 c0 a8 01 fc
Dec 11 03:24:41 (none) Pluto[27869]: | 00 00 00 00 00 00 00 00 03 00 06 00 00 00 00 00
This thread was automatically locked due to age.
