ubuntu – 站点到站点IPsec vpn不通过隧道发送ping

Ubuntu 前端之家
前端之家收集整理的这篇文章主要介绍了ubuntu – 站点到站点IPsec vpn不通过隧道发送ping，前端之家小编觉得挺不错的，现在分享给大家，也给大家做个参考。
这是我第一次尝试使用站点到站点VPN.我选择使用IPec,因为它似乎是我需要完成的最佳解决方案.我在上周跟踪了几个不同的教程,但收效甚微.现在,当ping相反的子网时,我似乎无法获得成功.我知道我错过了什么,我只是不知道是什么.

我能说的最好,我应该在路线表中看到一些东西.现在,绑定到另一个子网的流量将在没有封装的情况下运行,并被第一个在不可路由的私有IP目标上获取的路由器丢弃.

我已经尝试过向MAStables添加MASQUERADE和RELATED,ESTABLISHED规则,思考可能有所帮助.我结束了这个想法.现在iptables的默认策略是在Ubuntu盒子上的所有链上接受.我会在IPsec工作时调整的东西.

“service ipsec status”的输出

  1. IPsec running  - pluto pid: 1059
  2. pluto pid 1059
  3. 1 tunnels up
  4. some eroutes exist@H_404_8@ 
  5.  
    /etc/ipsec.conf在两个站点
     
  6.   
  7.  
    version 2 
  9. config setup
  10.     dumpdir=/var/run/pluto/
  12.     nat_traversal=yes
  13.     virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v6:fd00::/8,%v6:fe80::/10
  14.     protostack=netkey
  15.     force_keepalive=yes
  16.     keep_alive=60
  19. conn site1-site2
  20.     leftsubnets=10.248.248.64/16
  21.     rightsubnet=10.131.250.194/16
  22.     auto=start
  23.     left=162.243.XXX.XXX
  24.     right=178.62.YYY.YYY
  26.     leftid=@site1
  27.     rightid=@site2
  28.     authby=secret
  29.     ike=aes128-sha1;modp1024
  30.     phase2=esp
  31.     phase2alg=aes128-sha1;modp1024
  32.     aggrmode=no
  33.     ikelifetime=8h
  34.     salifetime=1h
  35.     dpddelay=10
  36.     dpdtimeout=40
  37.     dpdaction=restart
  38.     type=tunnel
  39.     forceencaps=yes@H_404_8@ 
  40.  
    两个站点的“ipsec verify”输出(IP转发在/etc/sysctl.conf中打开)
     
  41.   
  42.  
    Checking your system to see if IPsec got installed and started correctly:
  43. Version check and ipsec on-path                 [OK]
  44. Linux Openswan U2.6.38/K3.13.0-24-generic (netkey)
  45. Checking for IPsec support in kernel                [OK]
  46.  SAref kernel support                       [N/A]
  47.  NETKEY:  Testing XFRM related proc values          [OK]
  48.                                 [OK]
  49.                                 [OK]
  50. Checking that pluto is running                                  [OK]
  51.  Pluto listening for IKE on udp 500                             [OK]
  52.  Pluto listening for NAT-T on udp 4500                          [OK]
  53. Two or more interfaces found,checking IP forwarding            [Failed]
  54. Checking NAT and MASQUERADEing                                  [OK]
  55. Checking for 'ip' command                                       [OK]
  56. Checking /bin/sh is not /bin/dash                               [OK]
  57. Checking for 'iptables' command                                 [OK]
  58. Opportunistic Encryption Support                                [DISABLED]@H_404_8@ 
  59.  
    站点1：/etc/ipsec.secrets
     
  60.   
  61.  
    # this file is managed with debconf and will contain the automatically created RSA keys
  62. include /var/lib/openswan/ipsec.secrets.inc
  64. 162.243.XXX.XXX 178.62.YYY.YYY : PSK “sameRandomString“@H_404_8@ 
  65.  
    Site1：“ip xfrm policy”的输出
     
  66.   
  67.  
    src 10.248.0.0/16 dst 10.131.0.0/16 
  68.     dir out priority 2608 
  69.     tmpl src 162.243.XXX.XXX dst 178.62.YYY.YYY
  70.         proto esp reqid 16385 mode tunnel
  71. src 10.131.0.0/16 dst 10.248.0.0/16 
  72.     dir fwd priority 2608 
  73.     tmpl src 178.62.YYY.YYY dst 162.243.XXX.XXX
  74.         proto esp reqid 16385 mode tunnel
  75. src 10.131.0.0/16 dst 10.248.0.0/16 
  76.     dir in priority 2608 
  77.     tmpl src 178.62.YYY.YYY dst 162.243.XXX.XXX
  78.         proto esp reqid 16385 mode tunnel
  79. src ::/0 dst ::/0 
  80.     socket out priority 0 
  81. src ::/0 dst ::/0 
  82.     socket in priority 0 
  83. src 0.0.0.0/0 dst 0.0.0.0/0 
  84.     socket out priority 0 
  85. src 0.0.0.0/0 dst 0.0.0.0/0 
  86.     socket in priority 0 
  87. src 0.0.0.0/0 dst 0.0.0.0/0 
  88.     socket out priority 0 
  89. src 0.0.0.0/0 dst 0.0.0.0/0 
  90.     socket in priority 0 
  91. src 0.0.0.0/0 dst 0.0.0.0/0 
  92.     socket out priority 0 
  93. src 0.0.0.0/0 dst 0.0.0.0/0 
  94.     socket in priority 0 
  95. src 0.0.0.0/0 dst 0.0.0.0/0 
  96.     socket out priority 0 
  97. src 0.0.0.0/0 dst 0.0.0.0/0 
  98.     socket in priority 0 
  99. src 0.0.0.0/0 dst 0.0.0.0/0 
  100.     socket out priority 0 
  101. src 0.0.0.0/0 dst 0.0.0.0/0 
  102.     socket in priority 0 
  103. src 0.0.0.0/0 dst 0.0.0.0/0 
  104.     socket out priority 0 
  105. src 0.0.0.0/0 dst 0.0.0.0/0 
  106.     socket in priority 0@H_404_8@ 
  107.  
    Site1：“ip route”的输出
     
  108.   
  109.  
    default via 162.243.XXX.1 dev eth0 
  110. 10.128.128.0/24 dev eth1  proto kernel  scope link  src 10.128.128.64 
  111. 162.243.XXX.0/24 dev eth0  proto kernel  scope link  src 162.243.XXX.XXX@H_404_8@ 
  112.  
    站点2：/etc/ipsec.secrets
     
  113.   
  114.  
    # this file is managed with debconf and will contain the automatically created RSA keys
  115. include /var/lib/openswan/ipsec.secrets.inc
  117. 178.62.YYY.YYY 162.243.XXX.XXX : PSK “sameRandomString“@H_404_8@ 
  118.  
    Site2：“ip xfrm policy”的输出
     
  119.   
  120.  
    src 10.131.0.0/16 dst 10.248.0.0/16 
  121.     dir out priority 2608 
  122.     tmpl src 178.62.YYY.YYY dst 162.243.XXX.XXX
  123.         proto esp reqid 16385 mode tunnel
  124. src 10.248.0.0/16 dst 10.131.0.0/16 
  125.     dir fwd priority 2608 
  126.     tmpl src 162.243.XXX.XXX dst 178.62.YYY.YYY
  127.         proto esp reqid 16385 mode tunnel
  128. src 10.248.0.0/16 dst 10.131.0.0/16 
  129.     dir in priority 2608 
  130.     tmpl src 162.243.XXX.XXX dst 178.62.YYY.YYY
  131.         proto esp reqid 16385 mode tunnel
  132. src ::/0 dst ::/0 
  133.     socket out priority 0 
  134. src ::/0 dst ::/0 
  135.     socket in priority 0 
  136. src ::/0 dst ::/0 
  137.     socket out priority 0 
  138. src ::/0 dst ::/0 
  139.     socket in priority 0 
  140. src 0.0.0.0/0 dst 0.0.0.0/0 
  141.     socket out priority 0 
  142. src 0.0.0.0/0 dst 0.0.0.0/0 
  143.     socket in priority 0 
  144. src 0.0.0.0/0 dst 0.0.0.0/0 
  145.     socket out priority 0 
  146. src 0.0.0.0/0 dst 0.0.0.0/0 
  147.     socket in priority 0 
  148. src 0.0.0.0/0 dst 0.0.0.0/0 
  149.     socket out priority 0 
  150. src 0.0.0.0/0 dst 0.0.0.0/0 
  151.     socket in priority 0 
  152. src 0.0.0.0/0 dst 0.0.0.0/0 
  153.     socket out priority 0 
  154. src 0.0.0.0/0 dst 0.0.0.0/0 
  155.     socket in priority 0 
  156. src 0.0.0.0/0 dst 0.0.0.0/0 
  157.     socket out priority 0 
  158. src 0.0.0.0/0 dst 0.0.0.0/0 
  159.     socket in priority 0 
  160. src 0.0.0.0/0 dst 0.0.0.0/0 
  161.     socket out priority 0 
  162. src 0.0.0.0/0 dst 0.0.0.0/0 
  163.     socket in priority 0@H_404_8@ 
  164.  
    Site2：“ip route”的输出
     
  165.   
  166.  
    default via 178.62.YYY.1 dev eth0 
  167. 10.131.0.0/16 dev eth1  proto kernel  scope link  src 10.131.250.194 
  168. 178.62.YYY.0/18 dev eth0  proto kernel  scope link  src 178.62.YYY.YYY@H_404_8@ 
  169.  
    site2上的/var/log/auth.log的一部分
     
  170.   
  171.  
    Jul 24 18:41:14 gb pluto[3365]: packet from 162.243.XXX.XXX:500: received Vendor ID payload [Openswan (this version) 2.6.38 ]
  172. Jul 24 18:41:14 gb pluto[3365]: packet from 162.243.XXX.XXX:500: received Vendor ID payload [Dead Peer Detection]
  173. Jul 24 18:41:14 gb pluto[3365]: packet from 162.243.XXX.XXX:500: received Vendor ID payload [RFC 3947] method set to=115 
  174. Jul 24 18:41:14 gb pluto[3365]: packet from 162.243.XXX.XXX:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108,but already using method 115
  175. Jul 24 18:41:14 gb pluto[3365]: packet from 162.243.XXX.XXX:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106,but already using method 115
  176. Jul 24 18:41:14 gb pluto[3365]: packet from 162.243.XXX.XXX:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107,but already using method 115
  177. Jul 24 18:41:14 gb pluto[3365]: packet from 162.243.XXX.XXX:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
  178. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: responding to Main Mode
  179. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
  180. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: STATE_MAIN_R1: sent MR1,expecting MI2
  181. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): both are NATed
  182. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
  183. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: STATE_MAIN_R2: sent MR2,expecting MI3
  184. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: Main mode peer ID is ID_IPV4_ADDR: '162.243.XXX.XXX'
  185. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
  186. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: new NAT mapping for #3,was 162.243.XXX.XXX:500,now 162.243.XXX.XXX:4500
  187. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: STATE_MAIN_R3: sent MR3,ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp1024}
  188. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: Dead Peer Detection (RFC 3706): enabled
  189. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #3: the peer proposed: 10.131.0.0/16:0/0 -> 10.248.0.0/16:0/0
  190. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #4: responding to Quick Mode proposal {msgid:9e504ac0}
  191. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #4:     us: 10.131.0.0/16===178.62.YYY.YYY<178.62.YYY.YYY>
  192. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #4:   them: 162.243.XXX.XXX<162.243.XXX.XXX>===10.248.0.0/16
  193. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #4: keeping refhim=4294901761 during rekey
  194. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #4: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
  195. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #4: STATE_QUICK_R1: sent QR1,inbound IPsec SA installed,expecting QI2
  196. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #4: Dead Peer Detection (RFC 3706): enabled
  197. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #4: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
  198. Jul 24 18:41:14 gb pluto[3365]: "site1-site2/1x0" #4: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP/NAT=>0x5b14c281 <0xd731b1b1 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=162.243.XXX.XXX:4500 DPD=enabled@H_404_8@ 
  199.  
    任何帮助是极大的赞赏.





 对我来说,听起来你正试图让站点到站点的隧道网关通过它们的内部IP地址而不是它们的公共IP地址进行通信.要使用单个隧道执行此操作,您需要配置左侧和右侧内部源地址.见下文… 
  
  
 
  1. leftsourceip=10.248.248.64
  2. rightsourceip=10.131.250.194@H_404_8@ 
  3.  
    添加这些行并重新启动ipsec,然后您可以使用内部网关ping.

      

      
                 
              

            

          

          
          
          

            

              




            

          


          

            

              

                  
    
猜你在找的Ubuntu相关文章



                                    
学linux,从Ubuntu开始

                                
1.安装过程出现0x00000000指令引用的0x00000000内存该内存不能为written 如果你安装的是in...

                                
                                
                            



                                    
ubuntu16.04获取root权限并用root用户登录

                                
写在全面：如果根据以下教程涉及到只读文件需要更改文件权限才能需修改文件内容，参考我的...

                                
                                
                            



                                    
ubuntu18.04获取root权限并用root用户登录

                                
写在前面：以下步骤中需要在终端输入命令，电脑端查看博客的朋友可以直接复制粘贴到终端，...

                                
                                
                            



                                    
ubuntu16.04和18.04更换国内源

                                
ubuntu16.04和18.04更换国内源 写在前面：安装好ubuntu双系统后，默认的软件更新源是国外的...

                                
                                
                            



                                    
ubuntu双系统启动时卡死解决办法

                                
ubuntu双系统启动时卡死解决办法（在ubuntu16.04和18.04测试无误） 问题描述： 在安装完ub...

                                
                                
                            







                                    
Ubuntu安装ssh

                                

                                
                                
                            



                                    
Ubuntu报“xxx is not in the sudoers file.This incident will be reported” 错误解决方法

                                

                                
                                
                            



                                    
ubuntu-make | Ubuntu Linux一键安装开发环境

                                
-- 作者 谢恩铭 转载请注明出处 内容简介 什么是ubuntu-make 安装最新版ubuntu-make 用ubu...

                                
                                
                            



                                    
Ubuntu 17.04（Zesty Zapus）正式发布，可以下载使用了

                                
今天，2017 年 4 月 13 日，Canonical 官方发布了 Ubuntu 17.04（Zesty Zapus）的最终版。...

                                
                                
                            



                                    
Ubuntu 为钱而放弃 Unity ？ Linux 社区的反应

                                
（点击上方公众号，可快速关注） 编译：伯乐在线/黄小非 如有好文章投稿，请点击 → 这里...

                                
                                
                            







            

          

        

        
        
        
        

          
          

            

              

                
                
LinuxWindowsCentOSUbuntuNginxWebServiceScalaMemcacheApacheRedisDockerBashAzureTomcatLNMPShell数据结构服务器运维网络安全

                

              

            

          

          
         
          

            

              
 



              

            

          

          
          
          
          

            

              

                
                
              

            

          

          


          
          

            

              

                
                
xebugnodemondocker-copydcoselasticsearcwindows-contdocker-windodocker-awsamazon-cloudenvoyproxyhashicorp-vaswisscomdevkafka-pythonzscalerphoton-osdocker-swarmkamongoogle-cloudconcoursewso2-ampersistent-vapi-managerprocess-manamanjarojenkins-workhypriotremoteapikeystonejsbitcoindbitcoin-test