[IPsec(Openswan) & L2TP] VPN niet door router heen

[trinite_t]

Ik ben bezig met het opzetten van een VPN verbinding naar een LAN achter een speedtouch 510. Het probleem is dat ik vanaf internet geen vpn verbinding kan maken met de server, maar dat dit wel werkt vanaf het LAN.
Om een vpn server achter een router te kunnen aanspreken heb je de NAT-Traversel path nodig. Deze lijkt ook goed te laden:

code:

May  3 00:42:23 localhost pluto[6817]: Starting Pluto (Openswan Version 2.4.4 X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OEz}FFFfgr_e)
May  3 00:42:23 localhost pluto[6817]: Setting NAT-Traversal port-4500 floating to on
May  3 00:42:23 localhost pluto[6817]:    port floating activation criteria nat_t=1/port_fload=1
May  3 00:42:23 localhost pluto[6817]:   including NAT-Traversal patch (Version 0.6c)

verder moet je in de l2tpd.conf file nat traversal op yes zetten en het virtual_private goed instellen.

code:

# basic configuration
config setup
  nat_traversal=yes
   # virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.2.0/24,%v4:!10.0.0.0/24
   virtual_private=%v4:!10.0.0.0/24

Nu las ik ergens op internet dat als je het virtual path goed ingesteld hebt dat je dan niet meer vanaf het LAN naar de server kon connecten. Dit lukt bij mij dus nog wel. Ik heb ook de andere virtual private settings geprobeerd die er boven staat, maar die geeft fouten bij het laden.


Ik heb op de speedtouch udp poort 500 en 4500 geforward naar mijn server

code:

8    Temp    10.0.0.6:500    unspecified:500    udp    NONE
9    Temp    10.0.0.6:4500  unspecified:4500  udp     NONE

Ik zal ook nog ff een log posten van het opstarten en het openen van een verbinding van een pc buiten het LAN.

code:

# opstarten van de server

May  3 00:42:23 localhost ipsec_setup: Starting Openswan IPsec U2.4.4/K2.6.14-hardened-r8...
May  3 00:42:23 localhost ipsec_setup: KLIPS ipsec0 on eth0 10.0.0.6/255.255.255.0 broadcast 10.0.0.255
May  3 00:42:23 localhost ipsec__plutorun: Starting Pluto subsystem...
May  3 00:42:23 localhost ipsec_setup: ...Openswan IPsec started
May  3 00:42:23 localhost pluto[6817]: Starting Pluto (Openswan Version 2.4.4 X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OEz}FFFfgr_e)
May  3 00:42:23 localhost pluto[6817]: Setting NAT-Traversal port-4500 floating to on
May  3 00:42:23 localhost pluto[6817]:    port floating activation criteria nat_t=1/port_fload=1
May  3 00:42:23 localhost pluto[6817]:   including NAT-Traversal patch (Version 0.6c)
May  3 00:42:24 localhost pluto[6817]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
May  3 00:42:24 localhost pluto[6817]: starting up 1 cryptographic helpers
May  3 00:42:24 localhost pluto[6817]: started helper pid=6841 (fd:6)
May  3 00:42:24 localhost pluto[6817]: Using Linux 2.6 IPsec interface code on 2.6.14-hardened-r8
May  3 00:42:24 localhost pluto[6817]: Changing to directory '/etc/ipsec/ipsec.d/cacerts'
May  3 00:42:24 localhost pluto[6817]: Changing to directory '/etc/ipsec/ipsec.d/aacerts'
May  3 00:42:24 localhost pluto[6817]: Changing to directory '/etc/ipsec/ipsec.d/ocspcerts'
May  3 00:42:24 localhost pluto[6817]: Changing to directory '/etc/ipsec/ipsec.d/crls'
May  3 00:42:24 localhost pluto[6817]:   Warning: empty directory
May  3 00:42:24 localhost l2tpd[6933]: This binary does not support kernel L2TP.
May  3 00:42:24 localhost l2tpd[6946]: l2tpd version 0.69 started on triniteserv PID:6946
May  3 00:42:24 localhost l2tpd[6946]: Linux version 2.6.14-hardened-r8 on a i686, listening on IP address 0.0.0.0, port 1701
May  3 00:42:24 localhost pluto[6817]: added connection description "triniteVpn"
May  3 00:42:24 localhost pluto[6817]: listening for IKE messages
May  3 00:42:24 localhost pluto[6817]: adding interface lo/lo 127.0.0.1:500
May  3 00:42:24 localhost pluto[6817]: adding interface lo/lo 127.0.0.1:4500
May  3 00:42:24 localhost pluto[6817]: adding interface eth0/eth0 10.0.0.6:500
May  3 00:42:24 localhost pluto[6817]: adding interface eth0/eth0 10.0.0.6:4500
May  3 00:42:24 localhost pluto[6817]: adding interface lo/lo ::1:500
May  3 00:42:24 localhost pluto[6817]: loading secrets from "/etc/ipsec/ipsec.secrets"

# hier maak ik een verbinding: 

May  3 00:45:15 localhost pluto[6817]: packet from 123.123.123.123:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
May  3 00:45:15 localhost pluto[6817]: packet from 123.123.123.123:500: ignoring Vendor ID payload [FRAGMENTATION]
May  3 00:45:15 localhost pluto[6817]: packet from 123.123.123.123:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
May  3 00:45:15 localhost pluto[6817]: packet from 123.123.123.123:500: ignoring Vendor ID payload [Vid-Initial-Contact]
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: responding to Main Mode from unknown peer 123.123.123.123
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: STATE_MAIN_R1: sent MR1, expecting MI2
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: i am NATed
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: STATE_MAIN_R2: sent MR2, expecting MI3
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: Main mode peer ID is ID_IPV4_ADDR: '123.123.123.123'
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: I did not send a certificate because I do not have one.
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
May  3 00:45:15 localhost pluto[6817]: | NAT-T: new mapping 123.123.123.123:500/4500)
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: cannot respond to IPsec SA request because no connection is known for 234.234.234.234/32===10.0.0.6:17/1701...123.123.123.123:17/%any
May  3 00:45:15 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: sending encrypted notification INVALID_ID_INFORMATION to 123.123.123.123:4500
May  3 00:45:17 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xf5ee2520 (perhaps this is a duplicated packet)
May  3 00:45:17 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: sending encrypted notification INVALID_MESSAGE_ID to 123.123.123.123:4500
May  3 00:45:19 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xf5ee2520 (perhaps this is a duplicated packet)
May  3 00:45:19 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: sending encrypted notification INVALID_MESSAGE_ID to 123.123.123.123:4500
May  3 00:45:23 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xf5ee2520 (perhaps this is a duplicated packet)
May  3 00:45:23 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: sending encrypted notification INVALID_MESSAGE_ID to 123.123.123.123:4500
May  3 00:45:31 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xf5ee2520 (perhaps this is a duplicated packet)
May  3 00:45:31 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: sending encrypted notification INVALID_MESSAGE_ID to 123.123.123.123:4500
May  3 00:45:47 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xf5ee2520 (perhaps this is a duplicated packet)
May  3 00:45:47 localhost pluto[6817]: "triniteVpn"[1] 123.123.123.123 #1: sending encrypted notification INVALID_MESSAGE_ID to 123.123.123.123:4500

Ziet iemand wat ik nog mis of verkeerd gedaan heb?

Btw, ik doe dit op een gentoo bak met de 2.6.14-hardened-r8 kernel.
Btw2, 123.123.123.123 is het ip van de pc waarmee ik de verbinding opzet en 234.234.234.234 is het externe ip van de speedtouch router.

[ Voor 4% gewijzigd door trinite_t op 03-05-2006 09:17 ]

[trinite_t]

Ik zit er nu alweer mee te klooien, en kom nu vanalles tegen over kernel patches, maar op de openswan website staat dit:

To enable it, you need NAT-T (technically, ESPinUDP) support in your kernel. Kernels 2.6.6 and higher include this. For 2.4 kernels, you need to patch your kernel - see the README included in Openswan on how to do this.

Dus dan zou mijn kernel het moeten ondersteunen.. dan zou ik het toch ook in menuconfig moeten kunnen vinden?? ik kan namelijk nergens iets met NAT-T of ESPinUDP oid vinden...

edit:
Of is er hier iemand die goed weet hoe je je speedtouch router moet instellen, zodat ik weet dat het daar niet meer aan ligt...

[ Voor 13% gewijzigd door trinite_t op 03-05-2006 18:03 ]

[DPLuS]

TS, ben je inmiddels al verder gekomen? Ik heb ook een speedtouch en krijg het ook niet aan de praat...

[trinite_t]

Ik ga er over een weekje weer mee aan de gang... zit nu met tentamens ed.. dus we zullen dan wel zien.. mocht jij wel iets vinden waardoor het werkt, laat het ff weten!

[valentino]

Vergeet je poort 1701 niet?

L2TP poorten:

500 UDP
4500 UDP
1701 UDP

allemaal forwarden naar je VPN server

[trinite_t]

Dat heb ik nu geprobeerd. maar het werkt nog niet... Het blijft vreemd, maar het zou toch op een of andere manier wel moeten kunnen werken....