Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have configured Hub and Spoke using openswan ipsec. Tunnel is immediately getting UP but the problem is:

Spoke1 can ping/access HUB's LAN and vice-versa (S1 -- HUB && HUB -- S1)
Spoke2 can ping/access HUB's LAN and vice-versa (S1 -- HUB && HUB -- S2)

But,

Spoke1 can **not** ping/access Spoke2 and vice-versa (**S1 -- S2 && S2 -- S1 NOT WORKING**)

Configurations:

Hub: 10.103.6.7/23          LAN: 10.1.0.0/16
Spoke1: 10.103.6.40/23      LAN: 10.1.2.0/24
Spoke2: 10.103.6.97/23      LAN: 10.1.1.0/24

Configuration on Spoke1: (/etc/ipsec.conf)

config setup
    nat_traversal=yes
    oe=off
    protostack=netkey

conn NGpassthrough
    left=10.1.2.1
    right=0.0.0.0
    leftsubnet=10.1.2.0/24
    rightsubnet=10.1.2.0/24
    authby=never
    type=passthrough
    auto=route

conn NG
    right=10.103.6.7
    rightsubnet=10.1.0.0/16
    left=10.103.6.40
    leftsubnet=10.1.2.0/24
    leftnexthop=10.103.6.1
    leftupdown="ipsec _updown --route yes"
    auto=start
    leftid=10.103.6.40
    rightid=10.103.6.7
    #x_rightdynamic=yes
    authby=secret
    compress=no
    failureshunt=drop
    dpddelay=15
    dpdtimeout=60
    dpdaction=restart
    pfs=yes
    ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048
    esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1

Configuration on HUB: (/etc/ipsec.conf)

config setup
    nat_traversal=yes
    oe=off
    protostack=netkey

conn NGpassthrough
    left=10.1.0.1
    right=0.0.0.0
    leftsubnet=10.1.0.0/16
    rightsubnet=10.1.0.0/16
    authby=never
    type=passthrough
    auto=route

conn NG
    right=10.103.6.40
    rightsubnet=10.1.2.0/24
    left=10.103.6.7
    leftsubnet=10.1.0.0/16
    leftnexthop=10.103.6.1
    leftupdown="ipsec _updown --route yes"
    auto=start
    leftid=10.103.6.7
    rightid=10.103.6.40
    #x_rightdynamic=yes
    authby=secret
    compress=no
    failureshunt=drop
    dpddelay=15
    dpdtimeout=60
    dpdaction=restart
    pfs=yes
    ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048
    esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1


conn NG1passthrough
    left=10.1.0.1
    right=0.0.0.0
    leftsubnet=10.1.0.0/16
    rightsubnet=10.1.0.0/16
    authby=never
    type=passthrough
    auto=route

conn NG1
    right=10.103.6.97
    rightsubnet=10.1.1.0/24
    left=10.103.6.7
    leftsubnet=10.1.0.0/16
    leftnexthop=10.103.6.1
    leftupdown="ipsec _updown --route yes"
    auto=start
    leftid=10.103.6.7
    rightid=10.103.6.97
    #x_rightdynamic=yes
    authby=secret
    compress=no
    failureshunt=drop
    dpddelay=15
    dpdtimeout=60
    dpdaction=restart
    pfs=yes
    ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048
    esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1

Configuration on Spoke2: (/etc/ipsec.conf)

config setup
    nat_traversal=yes
    oe=off
    protostack=netkey


conn NGpassthrough
    left=10.1.1.1
    right=0.0.0.0
    leftsubnet=10.1.1.0/255.255.255.0
    rightsubnet=10.1.1.0/255.255.255.0
    authby=never
    type=passthrough
    auto=route

conn NG
    right=10.103.6.7
    rightsubnet=10.1.0.0/16
    left=10.103.6.97
    leftsubnet=10.1.1.0/255.255.255.0
    leftnexthop=10.103.6.1
    auto=start
    leftid=10.103.6.97
    rightid=10.103.6.7
    #x_rightdynamic=yes
    authby=secret
    compress=no
    failureshunt=drop
    dpddelay=15
    dpdtimeout=60
    dpdaction=restart
    pfs=yes
    ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048
    esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1

Route added on Spoke1:

10.1.0.0/16 via 10.1.2.1 dev br0 (lan interface)

Route added on HUB:

10.1.1.0/24 via 10.1.0.1 dev br0 (lan interface)
10.1.2.0/24 via 10.1.0.1 dev br0 (lan interface)

Route added on Spoke2:

10.1.0.0/16 via 10.1.1.1 dev br-lan (lan interface)

Packets are coming in HUB's PREROUTING table but not getting in FORWARD table or INPUT table. I have removed routes and flushed iptable too. But still facing same issue.

share|improve this question
    
SOLVED. WAN to WAN Forward is dropping in kernel module. I removed drop and it get passed.. :) –  Brijesh Valera May 30 '13 at 10:35
    
You should add this as an answer (with detail) and then accept it, to help other people who find this issue. –  EightBitTony Aug 14 at 12:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.