I reviewed and ultimately disabled the mangle tables, no help there.
(they were setting up QOS rules).
the ipsec verify did show some issues like rp_filter was active, but
forcing it off had no effect once I corrected them.
One more behavior I've noticed, when the tunnels are active, I cannot
access the remote host via the pubic ip address (ssh or ping). I can
only get to it through a third host not part of the tunnel. If I
totally tear down the tunnel and stop pluto, then I can communicate to
the remote host via the public IP address.
I've pretty carefully reviewed the rest of the firewall rules, so far,
nothing seems to help.
I even tried setting ESP=NULL-MD5, in hopes of sniffing the unencrypted
packets outbound to see if I can determine which host might be at fault,
so far I cannot even narrow it down to which host, though my gut tells
me the south host from the pings I can trace.
I'll may have to take a break for a couple days, but I'll be back and if
someone has more hints of how to debug this please forward them.
Brian
On 05/08/2018 10:59 AM, Paul Wouters wrote:
On Mon, 7 May 2018, Brian Foddy wrote:
Tunnels come up , ipsec status left shows;
000 Total IPsec connections: loaded 2, active 2
But nothing is actually working, no pings, no ssh anything between
the 2 sites.
I've done some tcpdumps (tcpdump -nni enp1s0f1 icmp)
Check forwarding and NAT rules? Run "ipsec verify" to see if there are
other issues, like rp_filter.
But at the same time the left tcpdump is showing:
tcpdump -nni ppp0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode
listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size
262144 bytes
22:10:05.698183 IP 8.0.1.10 > 10.20.0.66: ICMP echo request, id
11456, seq 902, length 64
22:10:06.348152 IP 8.0.1.10 > 10.20.0.66: ICMP echo reply, id 7793,
seq 107, length 64
Notice the IP address have changed from 10.20.1.10 to 8.0.1.10 when
packets are arriving back.
I would at the nat and mangle tables and see if anything is being done
there.
The firewalls are both running shorewall and I believe the
configurations are correct, but can include those files is needed.
Tuomo might be able to say more on that.
Paul
_______________________________________________
Swan mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan
