pluto (vpn) takes wrong if for route

makenoob

I'm trying to set up a vpn between two gentoo-boxes. I followed this HOWTO changed the configuration to fit my needs (pluto didn't found the %defaultroute on my box, so i had two put in the adresses for rghtnexthop and leftnexthop). when i fire "/etc/init.d/ipsec start" up it says in /var/log/messages:

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

I also tried this how to. And the outcome was similar. You will find this is a very dead topic on these forums. You also may want to consider what type of Operating Systems will be connecting to this because this is not very good for windows and mac.. I set up a Openswan / l2tp connect so our windows users and mac users can connect from the default built in client. However I am trying to run it behind a NAT so I am in a world of shit trying to get it to work.. Outside a nat works like a charm. The only thing I can say is I get the same error as you if my left is not defined correctly.

makenoob · Posted: Mon Mar 14, 2005 9:22 am Post subject:

I do not try to run this vpn behind a nat. the two boxes are directly connected to the internet, one with a static ip an the other with a dynamic adresse (and forced disconnection etc.)

i don't have to use different os's, all the boxes can be migrated to gentoo, but i need to set up vpn tunnels on them and get this thing running.

Prompty · Apprentice Joined: 08 Feb 2004 Posts: 292

i assume you opened the right ports ??

edit: port 500 AFAIR and check the key
_________________
<input stupid message here>

makenoob · Posted: Mon Mar 14, 2005 7:33 pm Post subject:

the port on both boxes is open and the keys are also right set.

box a:

Prompty · Apprentice Joined: 08 Feb 2004 Posts: 292

my notes based on my implementation

you don't have to specify all nexthops ( you need nexthop only on the current box )

try adding "rekey=yes" ( I don't know what it does exactly :] )

my case it looks like that

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

@ Prompty
are you using this in a production env ? If so what OSs are you using client side and what clients are they using?
_________________
write quit bang

Prompty · Apprentice Joined: 08 Feb 2004 Posts: 292

@init-zero

fedoras (redhats) and suses running pluto why ?

define prod env ... it's a nationwide company ... all sections connect to the headquaters thru ipsec
_________________
<input stupid message here>

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

I set up a openswan / l2tp vpn server. I am looking for a server that will work with windows mac and linux. The default windows client works with it linux I did not test but sure I could get it to work but with macs the default client does not support NAT-T implementation Openswan uses.. Which is a standared! Mac just decided to write there own implementation that sucks.. Anyways I am just looking for a server with good / easy to setup client side support. This has been a nightmare... My only issue with the one I was testing, again was the limitation of the mac.

_________________
write quit bang

Prompty · Apprentice Joined: 08 Feb 2004 Posts: 292

you might consider going cisco

))
pix-firewall is great for vpn ... and cisco vpn-client has implementations for mac ( I mightbe wrong tho )
_________________
<input stupid message here>

makenoob · Posted: Tue Mar 15, 2005 10:52 am Post subject:

okay, now the ipsec-tunnel is up, but the two boxes don't seem to route through the tunnel but over the internet.

i post my config, maybe anyone can give me the right hints for setting up an "ipsec0" device for routing (i dunno if its needed):

box a:

Prompty · Apprentice Joined: 08 Feb 2004 Posts: 292

sorry for the late reply ... a properly configured ipsec should lift up a route

but you can try shutting down and tunring on connections a few times and see what's in logs

to down and up connections ...mainetnence i.e.

makenoob · Posted: Tue Mar 15, 2005 9:14 pm Post subject:

i tried it with "interface="ipsec0=ppp0"" but an interface "ipsec0" won't come up and the route wasn't set right, so that a ping to a private adresse to the other subnet was blocked from the provider's router (as it should be).
the problem that i have, that's just my opinion, is that i don't have an interface called ipsec0 that comes up with "/etc/init.d/ipsec start" and so the routing can't be done right by the gateways.
i will give it another try tomorrow.

thx.

marc

ps: what about setting up a virtual interface ipsec0 (sorry, but i'm not knowing how to do this with gentoo's ifconfig) and then bridge it with bridge utils that it might look something like

makenoob · Posted: Thu Mar 17, 2005 9:40 am Post subject:

back again and still no ipsec-based vpn running. i don't know, what i'm doing wrong, but when i start my ipsec-connection with "/etc/init.d/ipsec start" no ipsec0-interface shows up to route the connection through the tunnel. both gateways try to route through the internetgateways, which block the requests.

anybody got a hint for me, how to get this interface up and running for routing the tunnel?