2

I have set up IPSec VPN using OpenSwan on CentOS 6.5. But not able to get the tunnel up and running. When site B tries to ping my VPS (site A), they get following error:

Feb 26 11:33:59 [IKEv1 DEBUG]IP = ip1, IKE MM Initiator FSM error history (struct   &0x00007fff3b110df0)  <state>, <event>:  MM_DONE, EV_ERROR-->MM_WAIT_MSG2, EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2, EV_RETRY 
Feb 26 11:33:59 [IKEv1 DEBUG]IP = ip1, IKE SA MM:2bceea55 terminating:  flags 0x01000022, refcnt 0, tuncnt 0
Feb 26 11:33:59 [IKEv1 DEBUG]IP = ip1, sending delete/delete with reason message`

MM_WAIT_MSG2 indicates that there is an issue with return route back to peer.

I have done following:

shell>yum install openswan lsof

shell>vim /etc/sysctl.conf 

    net.ipv4.ip_forward = 1
    net.ipv4.conf.all.accept_redirects = 0
    net.ipv4.conf.all.send_redirects = 0

shell>sysctl -p

shell>iptables -A INPUT -p udp --dport 500 -j ACCEPT

shell>iptables -A INPUT -p tcp --dport 4500 -j ACCEPT

shell>iptables -A INPUT -p udp --dport 4500 -j ACCEPT

shell>iptables -t nat -A POSTROUTING -s ip1/32 -d ip3/32 -j SNAT --to ip1

shell>/sbin/service iptables save

shell>service iptables restart

My ipsec.conf looks like following:

config setup
    # Debug-logging controls:  "none" for (almost) none, "all" for lots.
    # klipsdebug=none
    # plutodebug="control parsing"
    # For Red Hat Enterprise Linux and Fedora, leave protostack=netkey
plutodebug=all
    plutostderrlog=/var/log/pluto.log   
protostack=netkey
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/16
oe=off
# Enable this if you see "failed to find any available worker"
# nhelpers=0
conn my_first_ipsec
    authby=secret
    auto=start
    ike=aes128-sha1;modp1024
    keyexchange=ike
    phase2=esp
    phase2alg=aes128-sha1;modp1024
    type=tunnel
    compress=no
    pfs=no
    left=ip1
    leftid=ip1
    leftsubnet=ip1/32
    leftnexthop=%defaultroute
    right=ip2
    rightsubnet=ip3/32

My ipsec.secrets looks like following:

ip1 ip2:    PSK "XXXXXXXXXXXXXX"

Restarting the ipsec service:

shell>/etc/init.d/ipsec restart

The service starts properly.

I checked IP route but there was no route for target ip. So, I added it manually.

shell>route add -host ip3 gw ip1

Now when I check ipsec service status, it shows as following:

shell>service ipsec status
IPsec running  - pluto pid: 23570
pluto pid 23570
No tunnels up

shell>ipsec auto --status

000 using kernel interface: netkey
000 interface lo/lo ::1
000 interface lo/lo 127.0.0.1
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 ip1
000 interface eth0/eth0 ip1
000 %myid = (none)
000 debug   raw+crypt+parsing+emitting+control+lifecycle+klips+dns+oppo+controlmore+pfkey+nattraversal+x509+dpd+oppoinfo
000
000 virtual_private (%priv):
000 - allowed 3 subnets: 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/16
000 - disallowed 0 subnets:
000 WARNING: Disallowed subnets in virtual_private= is empty. If you have
000          private address space in internal use, it should be excluded! 
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,1,64} trans={0,1,3072} attrs= {0,1,2048}
000
000 "my_first_ipsec": ip1/32===ip1<ip1>[+S=C]---69.28.92.1...ip2<ip2>[+S=C]===ip3/32; erouted HOLD; eroute owner: #0
000 "my_first_ipsec":     myip=unset; hisip=unset;
000 "my_first_ipsec":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; nat_keepalive: yes
000 "my_first_ipsec":   policy: PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,32; interface: eth0;
000 "my_first_ipsec":   dpd: action:clear; delay:0; timeout:0;
000 "my_first_ipsec":   newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "my_first_ipsec":   IKE algorithms wanted: AES_CBC(7)_128-SHA1(2)_000-MODP1024(2)
000 "my_first_ipsec":   IKE algorithms found:  AES_CBC(7)_128-SHA1(2)_160-MODP1024(2)
000 "my_first_ipsec":   ESP algorithms wanted: AES(12)_128-SHA1(2)_000; pfsgroup=MODP1024(2)
000 "my_first_ipsec":   ESP algorithms loaded: AES(12)_128-SHA1(2)_160
000
000 #77: "my_first_ipsec":500 STATE_MAIN_I3 (sent MI3, expecting MR3); EVENT_RETRANSMIT in 19s; nodpd; idle; import:admin initiate
000 #77: pending Phase 2 for "my_first_ipsec" replacing #0

I also checked if ports 500 and 4500 are open.

Nmap scan report for ip1

Host is up (0.00056s latency).
PORT     STATE  SERVICE
500/tcp  closed isakmp
4500/tcp closed sae-urn

Ports are open but STATE shows "closed" meaning no service is listening to these ports. Is this ok?

  1. Any idea why site B can not ping or telnet site A?

  2. ipsec auto --status shows that myip and hisip are not set. Is this causing problem?

Any help would be greatly appreciated.

  • 1
    Can anyone help? Its critical for me. – Suraj Feb 27 '15 at 3:55
  • Did you finally solve the problem? – Oladipo Olasemo Feb 4 '16 at 9:57
  • I solved the problem by taking help from a network consultant. – Suraj Feb 8 '16 at 7:05
  • It would be beneficial to others if you share how you fixed the problem. – Kibet Feb 10 '17 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.