From owner-freebsd-net@FreeBSD.ORG Tue Jun 22 17:19:49 2010 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BD35B1065672 for ; Tue, 22 Jun 2010 17:19:49 +0000 (UTC) (envelope-from ddesimone@verio.net) Received: from relay1-bcrtfl2.verio.net (relay1-bcrtfl2.verio.net [131.103.218.142]) by mx1.freebsd.org (Postfix) with ESMTP id 76D128FC12 for ; Tue, 22 Jun 2010 17:19:49 +0000 (UTC) Received: from iad-wprd-xchw02.corp.verio.net (iad-wprd-xchw02.corp.verio.net [198.87.7.165]) by relay1-bcrtfl2.verio.net (Postfix) with ESMTP id 295E6B0380CF for ; Tue, 22 Jun 2010 13:19:48 -0400 (EDT) Thread-Index: AcsSLx2KYW1ajgbpRpGmyIIBFZ+a7Q== Received: from dllstx1-8sst9f1.corp.verio.net ([10.144.2.52]) by iad-wprd-xchw02.corp.verio.net over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Tue, 22 Jun 2010 13:19:46 -0400 Received: by dllstx1-8sst9f1.corp.verio.net (sSMTP sendmail emulation); Tue, 22 Jun 2010 12:19:45 -0500 Date: Tue, 22 Jun 2010 12:19:45 -0500 From: "David DeSimone" Content-Transfer-Encoding: 7bit To: Message-ID: <20100622171944.GQ2620@verio.net> Mail-Followup-To: freebsd-net@freebsd.org Content-class: urn:content-classes:message Importance: normal Priority: normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4657 References: <87260c422232fa7409a4b374341dd106@ewipo.pl> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: <87260c422232fa7409a4b374341dd106@ewipo.pl> Precedence: bulk User-Agent: Mutt/1.5.20 (2009-06-14) X-OriginalArrivalTime: 22 Jun 2010 17:19:46.0797 (UTC) FILETIME=[1CE8C1D0:01CB122F] Subject: Re: vpn trouble X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jun 2010 17:19:49 -0000 ralf@dzie-ciuch.pl wrote: > > I try to configure VPN over my server and my client > > Sheme is like this > 78.x.x.x <--> 95.x.x.x <--> 10.10.1.90 Are you trying to set up IPSEC tunneling of networks behind these gateways, or are you only trying to secure traffic between the peers themselves? The fact that you don't receive any reply to your IKE packets would indicate something basic, like something is blocking traffic. > # setkey -DP > 10.10.1.90[any] 78.x.x.x[any] any > in ipsec > esp/tunnel/95.x.x.x-78.x.x.x/require > created: Jun 22 15:39:25 2010 lastused: Jun 22 15:39:25 2010 > lifetime: 0(s) validtime: 0(s) > spid=16461 seq=1 pid=83142 > refcnt=1 > 78.x.x.x[any] 10.10.1.90[any] any > out ipsec > esp/tunnel/78.x.x.x-95.x.x.x/require > created: Jun 22 15:39:25 2010 lastused: Jun 22 15:40:50 2010 > lifetime: 0(s) validtime: 0(s) > spid=16460 seq=0 pid=83142 > refcnt=1 Your IPSEC policy specifies "esp/tunnel" mode, but if you are not actually encapsulating traffic originating from somewhere else, you might do better to just use "transport" mode to encrypt without encapsulation. > And tcpdump > #tcpdump -i bce1 host 95.x.x.x > > > 15:53:47.355130 IP 78.x.x.x.isakmp > 95.x.x.x.isakmp: isakmp: phase 1 I > ident > 15:54:07.003371 IP 78.x.x.x.isakmp > 95.x.x.x.isakmp: isakmp: phase 1 I > ident > 15:57:39.067765 IP 78.x.x.x.isakmp > 95.x.x.x.isakmp: isakmp: phase 1 I > ident My first thought was that your IPSEC policy attempts to encrypt all traffic between you and your peers, but the IKE traffic is also traffic between you and your peers, so doesn't it lead to a policy loop of some sort? Will the IPSEC layer attempt to capture and encrypt the IKE packets? -- David DeSimone == Network Admin == fox@verio.net "I don't like spinach, and I'm glad I don't, because if I liked it I'd eat it, and I just hate it." -- Clarence Darrow This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free. Thank you.