0

A customer recently changed their VPN server and now recommends ShrewSoft as the appropriate client.

On Windows, the provided config works. On Linux, it also appears to connect and sets up a tap0 network adapter with a device in the correct network. However, I cannot seem to pass any traffic at all.

The client says:

Oct 16 11:24:42 vpn-lbe ikec[10887]: >> : esp proposal configured
Oct 16 11:24:42 vpn-lbe ikec[10887]: >> : client configured
Oct 16 11:24:42 vpn-lbe ikec[10887]: >> : local id configured
Oct 16 11:24:42 vpn-lbe ikec[10887]: >> : remote id configured
Oct 16 11:24:42 vpn-lbe ikec[10887]: >> : pre-shared key configured
Oct 16 11:24:42 vpn-lbe ikec[10887]: ii : bringing up tunnel ...
Oct 16 11:24:42 vpn-lbe ikec[10887]: >> : network device configured
Oct 16 11:24:42 vpn-lbe ikec[10887]: ii : tunnel enabled

It also sets up a tap0 interface, with an IP address and broadcast in the correct network:

tap0: flags=67<UP,BROADCAST,RUNNING>  mtu 1380                             
        inet 192.168.5.213  netmask 255.255.255.0  broadcast 192.168.5.255 
        inet6 fe80::f09b:eaff:feb1:8548  prefixlen 64  scopeid 0x20<link>  
        ether f2:9b:ea:b1:85:48  txqueuelen 1000  (Ethernet)               
        RX packets 0  bytes 0 (0.0 B)                                      
        RX errors 0  dropped 0  overruns 0  frame 0                        
        TX packets 0  bytes 0 (0.0 B)                                      
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

(Notice that this shows no packets whatsoever.)

This seems to be a widespread problem with no clear solution. For example, this ServerFault question mentions disabling rp_filter, so I did:

$ sysctl -a | grep -i rp_filter
net.ipv4.conf.all.rp_filter = 0          
net.ipv4.conf.default.arp_filter = 0     
net.ipv4.conf.default.rp_filter = 0      
net.ipv4.conf.eth0.arp_filter = 0        
net.ipv4.conf.eth0.rp_filter = 0         
net.ipv4.conf.lo.arp_filter = 0          
net.ipv4.conf.lo.rp_filter = 0

This seems to suggest that something needs to be changed in the ShrewSoft codebase to make it compatible with newer Linux versions. Is that correct? Has someone attempted to fork it and/or is there an alternative IPSec client?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.