This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSec maybe blocked by Packet Filter?

Hello,

I have a Astaro 4 box connecting to a Zyxel zywall-10.

This was all working a week ago but now I am unable to create a tunnel to the Zywall. If the Zywall starts the tunnel the IPsec connection works fine, but if the Astaro box starts the tunnel it does not even make it to the router connected to eth1. [:S]

This is in my packet filter log..
Apr 17 07:55:59 (none) kernel: UDP Drop: IN= OUT=eth1 SRC=192.168.111.1 DST=210.86.x.x LEN=108 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=500 DPT=500 LEN=88

And this is in my IPSec log...
Apr 17 07:55:59 (none) pluto[967]: added connection description "datasouth_1"
Apr 17 07:55:59 (none) pluto[967]: "datasouth_1" #1: initiating Main Mode
Apr 17 07:55:59 (none) pluto[967]: ERROR: "data_1" #1: sendto on eth1 to 210.86.1.52:500 failed in main_outI1. Errno 1: Operation not permitted
Apr 17 07:55:59 (none) pluto[967]: ADNS process exited with status 1

I guess it is being blocked by the packet filter but I am not sure why?

I have allowed all traffic out from the Internal network & from eth1 to the Internet and I can ping the remote router and firewall

These are my iptables rules...

Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination
3638  262K LOCAL      all  --  *      *       0.0.0.0/0            0.0.0.0/0
2135  167K HA         all  --  *      *       0.0.0.0/0            0.0.0.0/0
2135  167K HARDENING  all  --  *      *       0.0.0.0/0            0.0.0.0/0
2135  167K PSD_MATCHER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
2135  167K FIX_CONNTRACK  all  --  *      *       0.0.0.0/0            0.0.0.0/0
2135  167K AUTO_INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   85 11287 USR_INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   85 11287 LOGDROP    all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination
  117 39627 LOCAL      all  --  *      *       0.0.0.0/0            0.0.0.0/0
  117 39627 HARDENING  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  117 39627 PSD_MATCHER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  117 39627 FIX_CONNTRACK  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  117 39627 AUTO_FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   12   690 USR_FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 LOGDROP    all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination
4603 1765K LOCAL      all  --  *      *       0.0.0.0/0            0.0.0.0/0
3100 1670K HA         all  --  *      *       0.0.0.0/0            0.0.0.0/0
3100 1670K HARDENING  all  --  *      *       0.0.0.0/0            0.0.0.0/0
3100 1670K FIX_CONNTRACK  all  --  *      *       0.0.0.0/0            0.0.0.0/0
3100 1670K AUTO_OUTPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    2   216 USR_OUTPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    1   108 LOGDROP    all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain AUTO_FORWARD (1 references)
pkts bytes target     prot opt in     out     source               destination
  105 38937 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED

Chain AUTO_INPUT (1 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            255.255.255.255    tcp spt:68 dpt:67
    0     0 ACCEPT     udp  --  eth0   *       0.0.0.0/0            255.255.255.255    udp spt:68 dpt:67
    0     0 ACCEPT     tcp  --  eth0   *       192.168.200.0/24     192.168.200.254    tcp spt:68 dpt:67
    0     0 ACCEPT     udp  --  eth0   *       192.168.200.0/24     192.168.200.254    udp spt:68 dpt:67
    0     0 ACCEPT     esp  --  *      *       210.86.x.x          192.168.111.1      esp spis:256:4294967295
    0     0 ACCEPT     udp  --  *      *       210.86.x.x          192.168.111.1      udp spts:1:65535 dpt:500
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp dpt:22
    0     0 LOGDROP    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp dpt:22
  175 13851 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp spts:1024:65535 dpt:443
    0     0 LOGDROP    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp spts:1024:65535 dpt:443
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp spts:1:65535 dpt:25
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED

Chain AUTO_OUTPUT (1 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp spts:1:65535 dpt:222
    0     0 ACCEPT     tcp  --  *      eth0    192.168.200.254      255.255.255.255    tcp spt:67 dpt:68
    0     0 ACCEPT     udp  --  *      eth0    192.168.200.254      255.255.255.255    udp spt:67 dpt:68
    0     0 ACCEPT     tcp  --  *      eth0    192.168.200.254      192.168.200.0/24   tcp spt:67 dpt:68
    0     0 ACCEPT     udp  --  *      eth0    192.168.200.254      192.168.200.0/24   udp spt:67 dpt:68
    0     0 ACCEPT     esp  --  *      *       192.168.111.1        210.86.x.x        esp spis:256:4294967295
    2   216 ACCEPT     udp  --  *      *       192.168.111.1        210.86.x.x        udp spt:500 dpts:1:65535
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp spts:53:65535 dpt:53
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0          udp spts:53:65535 dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp spts:1:65535 dpt:25
  233  227K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED

Chain FIX_CONNTRACK (3 references)
pkts bytes target     prot opt in     out     source               destination

Chain HA (2 references)
pkts bytes target     prot opt in     out     source               destination

Chain HARDENING (3 references)
pkts bytes target     prot opt in     out     source               destination

Chain LOCAL (3 references)
pkts bytes target     prot opt in     out     source               destination
1503 95235 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
1503 95235 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0

Chain LOGDROP (5 references)
pkts bytes target     prot opt in     out     source               destination
   86 11395 LOG_CHAIN  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   86 11395 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain LOGREJECT (0 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 LOG_CHAIN  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          reject-with icmp-port-unreachable

Chain LOG_CHAIN (2 references)
pkts bytes target     prot opt in     out     source               destination
    3   144 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0
   83 11251 LOG        udp  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 LOG        esp  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 LOG        ah   --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 LOG        2    --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 LOG        47   --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 LOG        all  -f  *      *       0.0.0.0/0            0.0.0.0/0

Chain PSD_ACTION (0 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain PSD_MATCHER (2 references)
pkts bytes target     prot opt in     out     source               destination

Chain USR_FORWARD (1 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       192.168.150.0/24     192.168.200.0/24
    0     0 ACCEPT     all  --  *      *       192.168.200.0/24     192.168.150.0/24
   12   690 ACCEPT     all  --  *      *       192.168.200.0/24     0.0.0.0/0
    0     0 ACCEPT     all  --  *      *       192.168.111.0/24     210.86.x.x

Chain USR_INPUT (1 references)
pkts bytes target     prot opt in     out     source               destination

Chain USR_OUTPUT (1 references)
pkts bytes target     prot opt in     out     source               destination
    1   108 ACCEPT     all  --  *      *       192.168.111.1        210.86.x.x
    0     0 ACCEPT     all  --  *      *       192.168.111.1        0.0.0.0/0
    0     0 ACCEPT     udp  --  *      *       192.168.111.1        0.0.0.0/0          udp spt:500 dpt:500

As I said before if the Zywall creates the tunnel all is OK but if the Astaro box starts the tunnel no traffic goes out. [:S]

Many thanks for any help in advance.
jp

This thread was automatically locked due to age.

Parents

0 Marcel_01 over 22 years ago

can you please post more lines of the ipseclog?
'operation not permitted' usually comes from a connection attempt with a non-ready iptables chain and should work after a second connect...
(ADNS is not used, so this can be ignored as well)

/marcel
Cancel
Vote Up 0 Vote Down

Cancel
0 jpdl over 22 years ago in reply to Marcel_01

My full IPSec log follows....

Apr 27 02:28:14 (none) pluto[966]: Starting Pluto (FreeS/WAN Version super-freeswan-1.99_kb1)
Apr 27 02:28:14 (none) pluto[966]:   including X.509 patch (Version 0.9.15)
Apr 27 02:28:14 (none) pluto[966]:   including NAT-Traversal patch (Version 0.5a) [disabled]
Apr 27 02:28:14 (none) pluto[966]: ike_alg_register_enc: Activating OAKLEY_AES_CBC: Ok (ret=0)
Apr 27 02:28:14 (none) pluto[966]: ike_alg_register_enc: Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)
Apr 27 02:28:14 (none) pluto[966]: ike_alg_register_enc: Activating OAKLEY_CAST_CBC: Ok (ret=0)
Apr 27 02:28:14 (none) pluto[966]: ike_alg_register_enc: Activating OAKLEY_SERPENT_CBC: Ok (ret=0)
Apr 27 02:28:14 (none) pluto[966]: ike_alg_register_hash: Activating OAKLEY_SHA2_256: Ok (ret=0)
Apr 27 02:28:14 (none) pluto[966]: ike_alg_register_hash: Activating OAKLEY_SHA2_512: Ok (ret=0)
Apr 27 02:28:14 (none) pluto[966]: ike_alg_register_enc: Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)
Apr 27 02:28:14 (none) pluto[966]: ike_alg_register_enc: Activating OAKLEY_SSH_PRIVATE_65289: Ok (ret=0)
Apr 27 02:28:14 (none) pluto[966]: Changing to directory '/etc/ipsec.d/cacerts'
Apr 27 02:28:14 (none) pluto[966]:   Warning: empty directory
Apr 27 02:28:14 (none) pluto[966]: Changing to directory '/etc/ipsec.d/crls'
Apr 27 02:28:14 (none) pluto[966]:   Warning: empty directory
Apr 27 02:28:14 (none) pluto[966]:   could not open my default X.509 cert file '/etc/x509cert.der'
Apr 27 02:28:14 (none) pluto[966]: OpenPGP certificate file '/etc/pgpcert.pgp' not found
Apr 27 02:28:14 (none) pluto[966]: listening for IKE messages
Apr 27 02:28:15 (none) pluto[966]: adding interface ipsec0/eth1 192.168.111.1
Apr 27 02:28:15 (none) pluto[966]: loading secrets from "/etc/ipsec.secrets"
Apr 27 02:28:15 (none) pluto[966]: | from whack: got --esp=3des-sha1
Apr 27 02:28:15 (none) pluto[966]: | from whack: got --ike=3des-md5-modp1024
Apr 27 02:28:15 (none) pluto[966]: added connection description "datasouth_1"
Apr 27 02:28:15 (none) pluto[966]: "datasouth_1" #1: initiating Main Mode
Apr 27 02:28:15 (none) pluto[966]: ERROR: "datasouth_1" #1: sendto on eth1 to 210.86.x.x:500 failed in main_outI1. Errno 1: Operation not permitted
Apr 27 02:28:15 (none) pluto[966]: ADNS process exited with status 1
Apr 27 02:41:25 (none) pluto[966]: "datasouth_1" #1: max number of retransmissions (20) reached STATE_MAIN_I1.  No acceptable response to our first IKE message
Apr 27 02:41:25 (none) pluto[966]: "datasouth_1" #1: starting keying attempt 2 of an unlimited number
Apr 27 02:41:25 (none) pluto[966]: "datasouth_1" #2: initiating Main Mode to replace #1
Apr 27 02:54:35 (none) pluto[966]: "datasouth_1" #2: max number of retransmissions (20) reached STATE_MAIN_I1.  No acceptable response to our first IKE message
Apr 27 02:54:35 (none) pluto[966]: "datasouth_1" #2: starting keying attempt 3 of an unlimited number
Apr 27 02:54:35 (none) pluto[966]: "datasouth_1" #3: initiating Main Mode to replace #2
Apr 27 03:07:45 (none) pluto[966]: "datasouth_1" #3: max number of retransmissions (20) reached STATE_MAIN_I1.  No acceptable response to our first IKE message
Apr 27 03:07:45 (none) pluto[966]: "datasouth_1" #3: starting keying attempt 4 of an unlimited number
Apr 27 03:07:45 (none) pluto[966]: "datasouth_1" #4: initiating Main Mode to replace #3
Apr 27 03:20:55 (none) pluto[966]: "datasouth_1" #4: max number of retransmissions (20) reached STATE_MAIN_I1.  No acceptable response to our first IKE message
Apr 27 03:20:55 (none) pluto[966]: "datasouth_1" #4: starting keying attempt 5 of an unlimited number
Apr 27 03:20:55 (none) pluto[966]: "datasouth_1" #5: initiating Main Mode to replace #4
Apr 27 03:34:05 (none) pluto[966]: "datasouth_1" #5: max number of retransmissions (20) reached STATE_MAIN_I1.  No acceptable response to our first IKE message
Apr 27 03:34:05 (none) pluto[966]: "datasouth_1" #5: starting keying attempt 6 of an unlimited number
Apr 27 03:34:05 (none) pluto[966]: "datasouth_1" #6: initiating Main Mode to replace #5

this just repeats after this...

As you can see at the same time this is in the packet filter log..

Apr 27 02:28:15 (none) kernel: UDP Drop: IN= OUT=eth1 SRC=192.168.111.1 DST=210.86.x.x LEN=108 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=500 DPT=500 LEN=88

And the same thing in the live packet filter log...

14:15:39 192.168.111.1 500  ->  210.86.x.x 500 UDP

cheers
jp
Cancel
Vote Up 0 Vote Down

Cancel
0 Andreas Steffen over 22 years ago in reply to jpdl

You must open your firewall for UDP/500. Otherwise the IKE
negotiation will not succeed.

Andreas
Cancel
Vote Up 0 Vote Down

Cancel
0 aj_03 over 22 years ago in reply to Andreas Steffen

I have the same situation ...
And from Remote-FW to my external interface ANY is allowed ...

any new ideas?
Cancel
Vote Up 0 Vote Down

Cancel
0 Ari Maniatis over 22 years ago in reply to Andreas Steffen

It appears that you'll get a couple of dropped port 500 packets while the middleware opens port 500. But this should not cause the underlying problem.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Ari Maniatis over 22 years ago in reply to Andreas Steffen

It appears that you'll get a couple of dropped port 500 packets while the middleware opens port 500. But this should not cause the underlying problem.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data