I'm trying set up an IPsec gateway (strongSwan) on a Raspberry Pi 2.

The Pi was already providing a number of services on the LAN using a private IP address.

My initial attempt to turn it into an IPsec gateway involved just adding a public IP address to the same interface (eth0) and enable strongSwan SA on this new address. This works, and after enabling the pcrypt module I managed to get ~80Mbps decryption throughput, which really is pretty good all things considered.

I then decided to try and isolate the strongSwan stuff into a separate network namespace. I did ip netns add vpn, created a macvlan device on eth0, then add it to the vpn namespace. I then run ip netns exec vpn ipsec start and everything just works again.

However, pcrypt doesn't seem to be active anymore inside the namespace, and the throughput drops down to about ~25Mbps. I usually enable pcrypt using crconf, as per this instruction. When invoked inside the namespace, it keeps failing with a netlink error. Running strace crconf gives this gem:

setsockopt(3, SOL_SOCKET, SO_SNDBUF, [32768], 4) = 0
setsockopt(3, SOL_SOCKET, SO_RCVBUF, [1048576], 4) = 0
bind(3, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0
getsockname(3, {sa_family=AF_NETLINK, pid=997, groups=00000000}, [12]) = 0
send(3, "\24\0\0\0\23\0\1\3U\212\327V\0\0\0\0\0\0\0\0", 20, 0) = -1 ECONNREFUSED (Connection refused)

So the kernel is refusing a connection to the NETLINK_CRYPTO socket from inside the network namespace.

QUESTION: How do I allow a connection to NETLINK_CRYPTO from my network namespace?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.