Пытаюсь устновить туннель DI-808HV (клиент) - sHDSL - динамический IP - реальный IP - ZuXel Prestige 334 (NAT) - Fedora 4 с Openswan version U2.3.1/K2.6.14-1.1656_FC4smp (сервер)
Но туннель не подымается. Может кто поможет?
Вот настройки и логи:
Конфигурация
Сторона сервера
Fedora 4 с Openswan version U2.3.1/K2.6.14-1.1656_FC4smp - много всяческих интерфейсов - основной
192.168.aaa.aaa на сеть 192.168.xxx.xxx/xx
Выход на интернет через IP tibles - (я делал в файерволе открытым всё- и тот же результат - я думаю он не влияет)-
192.168.bbb.bbb на сеть 192.168.yyy.yyy/yy
Дальше - через NAT на ZyXEL
System Name : ZuXel
Model Name : Prestige 334
ZyNOS Firmware Version: V3.60(JJ.5) | 05/03/2005
Routing Protocols :IP
(Установлен SNAT default server 192.168.yyy.yyy/yy) - внешний -
ccc.ccc.ccc.ccc на сеть zzz.zzz.zzz.zzz/zz
Сторона DI-808HV
Локальная сеть
192.168.kkk.kkk на сеть 192.168.fff.fff/ff
Внешний
192.168.mmm.mmm на сеть 192.168.ggg.ggg/gg
Выход в инетернет через sHDSL
Далее - динамический IP у провайдера
Настройки Openswan
config setup
forwardcontrol=yes
interfaces="ipsec2=eth2 ipsec0=eth0 ipsec1=eth1"
nat_traversal=no
syslog=auth.debug
conn %default
keyingtries=0
disablearrivalcheck=no
#leftsasigkey=%dns
#rightsasigkey=%dns
conn shop
authby=secret
auto=add
esp=3des-md5
ikelifetime=10800s
keylife=3600s
left=192.168.bbb.bbb /*Интерфейс выходящий на ZyXEL*/
leftid=192.168.bbb.bbb /*Интерфейс выходящий на ZyXEL*/
leftnexthop=217.144.68.38 /*Внешний интерфейс ZyXEL*/
leftsubnet=192.168.xxx.xxx/xx /*Локальная сеть со стороны сервера*/
pfs=yes
right=%any
rightid=192.168.mmm.mmm /*Интерфейс выходящий на sHDSL*/
rightnexthop=%direct
rightsubnet=192.168.fff.fff/ff /*Локальная сеть со стороны клиента*/
NAT traversal - нет
IP forwarding - нет
Secret Keys:
Secret for Type Details
192.168.bbb.bbb 192.168.mmm.mmm Shared secret Password *********
192.168.bbb.bbb %any Shared secret Password *********
Any host RSA public key Modulus *********..
Any host Shared secret Password *********
Настройки DI-808HV (по
http://www.dlink.ru/technical/faq_vpn_5.php)
Страница VPN Settings
VPN - enable
Max namber of tunnel 10
ID Tunel Name Method
1 shop IKE
Страница VPN Settings - Tunnel 1
Local Subnet 192.168.fff.fff /*Локальная сеть со стороны клиента*/
Local Netmask 255.255.255.fff /*Локальная сеть со стороны клиента*/
Remote Subnet 192.168.xxx.xxx /*Локальная сеть со стороны сервера*/
Remote Netmask 255.255.255.xxx /*Локальная сеть со стороны сервера*/
Remote Gateway 217.144.68.38 /*Внешний интерфейс ZyXEL*/
Prshare key *******
NAT traversal - нет (пробовал и ДА - тоже самое)
Страница VPN Settings - Tunnel 1 - Set IKE Proposal
ID Name Group Escrypt Auth Life time Life time Units
1 shop Group2 3des MD5 3600 sec
Страница VPN Settings - Tunnel 1 - Set IPSEC Proposal
ID Name Group protocol Escrypt Auth Life time Life time Units
1 shop Group2 ESP 3des MD5 10800 sec
При попытке установить туннель:
Что пишет сервер:
bash-3.00# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.3.1/K2.6.14-1.1656_FC4smp (netkey)
Checking for IPsec support in kernel [OK]
Checking for RSA private key (/etc/ipsec.secrets) [OK]
Checking that pluto is running [OK]
Two or more interfaces found, checking IP forwarding [OK]
Checking NAT and MASQUERADEing
Checking for 'ip' command [OK]
Checking for 'iptables' command [OK]
Checking for 'setkey' command for NETKEY IPsec stack support [OK]
Opportunistic Encryption Support [DISABLED]
Запись в SYSLOG
Dec 22 14:57:56 server ipsec_setup: KLIPS ipsec2 on eth2 192.168.bbb.bbb/255.255.255.xxx broadcast 192.168.20.255
Dec 22 14:57:56 server ipsec_setup: KLIPS ipsec0 on eth0 192.168.aaa.111/255.255.255.yyy broadcast 192.168.2.255
Dec 22 14:57:56 server ipsec_setup: KLIPS ipsec1 on eth1 192.168.aaa.aaa/255.255.255.zzz broadcast 192.168.1.255
Dec 22 14:57:56 server ipsec__plutorun: Starting Pluto subsystem...
Dec 22 14:57:56 server pluto[1101]: Starting Pluto (Openswan Version 2.3.1 X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OEExalF{_o`m)
Dec 22 14:57:56 server pluto[1101]: Setting port floating to off
Dec 22 14:57:56 server pluto[1101]: port floating activate 0/1
Dec 22 14:57:56 server pluto[1101]: including NAT-Traversal patch (Version 0.6c) [disabled]
Dec 22 14:57:56 server ipsec_setup: ...Openswan IPsec started
Dec 22 14:57:56 server pluto[1101]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Dec 22 14:57:56 server pluto[1101]: starting up 1 cryptographic helpers
Dec 22 14:57:56 server pluto[1101]: started helper pid=1106 (fd:6)
Dec 22 14:57:56 server pluto[1101]: Using Linux 2.6 IPsec interface code
Dec 22 14:57:57 server pluto[1101]: Could not change to directory '/etc/ipsec.d/cacerts'
Dec 22 14:57:57 server pluto[1101]: Could not change to directory '/etc/ipsec.d/aacerts'
Dec 22 14:57:57 server pluto[1101]: Could not change to directory '/etc/ipsec.d/ocspcerts'
Dec 22 14:57:57 server pluto[1101]: Could not change to directory '/etc/ipsec.d/crls'
Dec 22 14:57:57 server pluto[1101]: added connection description "shop"
Dec 22 14:57:57 server pluto[1101]: listening for IKE messages
Dec 22 14:57:57 server pluto[1101]: adding interface eth2/eth2 192.168.bbb.bbb:500
Dec 22 14:57:57 server pluto[1101]: adding interface eth1/eth1 192.168.aaa.aaa:500
Dec 22 14:57:57 server pluto[1101]: adding interface eth0:6/eth0:6 ...:500
Dec 22 14:57:57 server pluto[1101]: adding interface eth0:3/eth0:3 ...:500
Dec 22 14:57:57 server pluto[1101]: adding interface eth0:2/eth0:2 ...:500
Dec 22 14:57:57 server pluto[1101]: adding interface eth0:5/eth0:5 ...:500
Dec 22 14:57:57 server pluto[1101]: adding interface eth0:4/eth0:4 ...:500
Dec 22 14:57:57 server pluto[1101]: adding interface eth0:1/eth0:1 ...:500
Dec 22 14:57:57 server pluto[1101]: adding interface eth0/eth0 192.168.aaa.111:500
Dec 22 14:57:57 server pluto[1101]: adding interface lo/lo 127.0.0.1:500
Dec 22 14:57:57 server pluto[1101]: adding interface lo/lo ::1:500
Dec 22 14:57:57 server pluto[1101]: loading secrets from "/etc/ipsec.secrets"
Dec 22 14:58:33 server pluto[1101]: packet from 192.168.mmm.mmm:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but port floating is off
Dec 22 14:58:33 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #1: responding to Main Mode from unknown peer 192.168.mmm.mmm
Dec 22 14:58:33 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #1: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Dec 22 14:58:33 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Dec 22 14:58:33 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #1: Main mode peer ID is ID_IPV4_ADDR: '192.168.mmm.mmm'
Dec 22 14:58:33 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #1: I did not send a certificate because I do not have one.
Dec 22 14:58:33 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Dec 22 14:58:33 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #1: sent MR3, ISAKMP SA established
Dec 22 14:58:33 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #2: responding to Quick Mode {msgid:1332f508}
Dec 22 14:58:33 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #2: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
Dec 22 14:58:34 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #2: route-client output: /usr/lib/ipsec/_updown: doroute `ip route add 192.168.fff.fff/ff via 192.168.mmm.mmm dev eth2 ' failed (RTNETLINK answers: Network is unreachable)
Dec 22 14:58:34 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
Dec 22 14:58:34 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #2: IPsec SA established {ESP=>0xc7010010 <0x32b8362c xfrm=3DES_0-HMAC_SHA1}
Dec 22 15:00:04 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #1: received Delete SA(0xc7010010) payload: deleting IPSEC State #2
Dec 22 15:00:04 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #1: received and ignored informational message
Dec 22 15:00:04 server pluto[1101]: "shop"[1] 192.168.mmm.mmm #1: received Delete SA payload: deleting ISAKMP State #1
Dec 22 15:00:04 server pluto[1101]: "shop"[1] 192.168.mmm.mmm: deleting connection "shop" instance with peer 192.168.mmm.mmm {isakmp=#0/ipsec=#0}
DI-808HV пишет что всё впорядке пытается пинговать - и пинг не проходит.
Вход
Регистрация
FAQ
Поиск
