ipsec not routing packets
I have a linux router set up like 10.x.x.A/32 | 203.x.x.B (linux router) | {Internet} | 203.x.x.C (other IPSEC gateway, not sure of brand) | 10.x.x.D/29 And an ipsec tunnel set up with endpoints 203.x.x.B and 203.x.x.C, and the tunnel 10.x.x.A/32 - 10.x.x.D/29 If I ping from D->A, I see the ping reach A, the response reach B on the way back, but is never sent from B->C, either encrypted or not. If I ping from A->D, same thing, the packet is never sent from B->C. I have a route for 10.x.x.D/29 on B pointing towards B's default gateway. I have excluded 10.x.x.D/29 from any nat or mangle transformations in iptables, but still nothing. tcpdump definitely shows no corresponding send from B->C when a packet is sent from A->D. There is no other traffic that would occur from B->C so it's fairly easy to determine that no traffic is being sent. The linux router is debian wheezy, running Debian 3.2.0-4 kernel (3.2.54-2). IKE is being done by racoon, and all appears correct. Setkey appears to show the correct SA's, it's just that nothing gets forwarded towards the other end. Any and all suggestions for fixes appreciated! Thanks James
I'm no expert, but have a look at the output of ip xfrm policy show, which will indicate which addresses are to be forwarded over the IPSec tunnel.
I'm no expert, but have a look at the output of ip xfrm policy show, which will indicate which addresses are to be forwarded over the IPSec tunnel.
That all looks fine, same as setkey -DP, except setkey -DP gives extra info that is 'lastused' on the 'send' policy which is updated every time I do a ping. It's just that the packets aren't going anywhere. James
Found the problem. tcpdump -i any show the packet going out on one interface, and after trying each interface one by one (tcpdump doesn't tell you which) I found it is going out the interface connected to the ADSL instead of the interface connected to the fibre. I don't know why yet, but that's the problem. James
On 28/03/14 11:25, James Harper wrote:
tcpdump -i any show the packet going out on one interface, and after trying each interface one by one (tcpdump doesn't tell you which) I found it is going out the interface connected to the ADSL instead of the interface connected to the fibre. I don't know why yet, but that's the problem.
Sounds like you need to add a `ip route add 10.x.x.x/24 dev pppX` line.
On 28/03/14 11:25, James Harper wrote:
tcpdump -i any show the packet going out on one interface, and after trying each interface one by one (tcpdump doesn't tell you which) I found it is going out the interface connected to the ADSL instead of the interface connected to the fibre. I don't know why yet, but that's the problem.
Sounds like you need to add a `ip route add 10.x.x.x/24 dev pppX` line.
Sort of. The outgoing packets were being marked for routing out the DSL interface when they should have been left unmarked to route out the fibre. I'm using a setup with bird and multiple routing tables. James
participants (3)
-
James Harper -
Jason White -
Jeremy Visser