[Leaf-user] VPN / IPSEC Problem

[Phil Faris]

Hi,

I am trying to establish a VPN tunnel between a remote Internet attached PC (RoadWorrior) and the masqueraded private network (192.168.1.0) on my LRP (Charles Steinkuehler's Eigerstein modified for ipsec 1.5).

The RoadWarrior is using PGPnet configured according to the instructions given in "Ipsec practical configurations for Linux Freeswan 1.X." by Jean-Francois Nadeau (http://jixen.tripod.com).

PGPnet indicates a valid connection (SA) is established, however, I cannot transmit in either direction (i.e.  "pings" in either direction fail).

On the LRP side, Ipsec appears to create valid bi-directional forwarding rules after the connection is established as indicated by "ipchains -L forward -n":

Chain forward (policy DENY):
target  prot    opt     source  destination     ports
ACCEPT  all     ------  206.86.3.105    192.168.1.0/24  n/a
ACCEPT  all     ------  192.168.1.0/24 206.86.3.105     n/a
DENY    icmp    ----l-  0.0.0.0/0       0.0.0.0/0       5 -> *
MASQ    all     ------  192.168.1.0/24 0.0.0.0/0        n/a
DENY    all     ------  0.0.0.0/0       0.0.0.0/0       n/a
        (Where 206.86.3.105 is the IP of the RoadWarrior)

My /etc/ipsec.conf is:

config setup
        interfaces="ipsec0=eth0"
        klipsdebug=none
        plutodebug=none
        plutoload=%search
        plutostart=%search
conn %default
        keyingtries=1
conn vpntest
        type=tunnel
        leftfirewall=no
        left=0.0.0.0
        leftsubnet=
        leftnexthop=
        rightfirewall=yes
        right=209.233.16.123
        rightsubnet=192.168.1.0/24
        rightnexthop=209.233.16.254
        auto=add
        authby=secret


My modifications to /etc/ipfilter.conf (near the end of the script) are:

$IPCH -I input -j ACCEPT -p udp -s 0/0 500 -d $EXTERN_IP 500 -i $EXTERN_IF
$IPCH -I output -j ACCEPT -p udp -s $EXTERN_IP 500 -d 0/0 500 -i $EXTERN_IF
$IPCH -I input -j ACCEPT -p 50 -s 0/0 -d $EXTERN_IP -i $EXTERN_IF
$IPCH -I output -j ACCEPT -p 50 -s $EXTERN_IP -d 0/0 -i $EXTERN_IF
$IPCH -I input -j ACCEPT -p 51 -s 0/0 -d $EXTERN_IP -i $EXTERN_IF
$IPCH -I output -j ACCEPT -p 51 -s $EXTERN_IP -d 0/0 -i $EXTERN_IF


I would appreciate any ideas on how to solve my problem.

Phil Faris