![Openswan 的 ipsec 验证失败,提示“发现两个或更多接口,正在检查 IP 转发”](https://linux22.com/image/1116229/Openswan%20%E7%9A%84%20ipsec%20%E9%AA%8C%E8%AF%81%E5%A4%B1%E8%B4%A5%EF%BC%8C%E6%8F%90%E7%A4%BA%E2%80%9C%E5%8F%91%E7%8E%B0%E4%B8%A4%E4%B8%AA%E6%88%96%E6%9B%B4%E5%A4%9A%E6%8E%A5%E5%8F%A3%EF%BC%8C%E6%AD%A3%E5%9C%A8%E6%A3%80%E6%9F%A5%20IP%20%E8%BD%AC%E5%8F%91%E2%80%9D.png)
我正在尝试设置 L2TP/IPsec VPN。我已从 Ubuntu 13.04 上的存储库安装了 openswan
Section: universe/net
Architecture: amd64
Version: 1:2.6.38-1
并按照以下方式配置社区文档。
# cat /etc/ipsec.conf
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.23.0/24
oe=off
protostack=netkey
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
# Apple iOS doesn't send delete notify so we need dead peer detection
# to detect vanishing clients
dpddelay=30
dpdtimeout=120
dpdaction=clear
# Set ikelifetime and keylife to same defaults windows has
ikelifetime=8h
keylife=1h
type=transport
# Replace IP address with your local IP (private, behind NAT IP is okay as well)
left=my.ip
# For updated Windows 2000/XP clients,
# to support old clients as well, use leftprotoport=17/%any
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
#force all to be nat'ed. because of iOS
forceencaps=yes
启动正常但验证失败
# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.38/K3.8.0-29-generic (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing XFRM related proc values [OK]
[OK]
[OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding [FAILED]
Checking NAT and MASQUERADEing [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
尽管转发似乎已启用
# cat /proc/sys/net/ipv4/ip_forward
1
出了什么问题?如何解决?
答案1
查找错误时偶然发现了这一点:
我认为这是答案:
https://lists.openswan.org/pipermail/users/2009-September/017423.html
我刚刚升级到 2.6.23 并运行 ipsec verify,但出现意外错误:发现两个或更多接口,正在检查 IP 转发 [失败]
cat /proc/sys/net/ipv4/ip_forward 给出 1,所以我很困惑。
如果它有帮助,eth0 是我的 WAN,eth1 是我的普通 LAN,eth1:0 是 eth1 上的虚拟 IP,以解决我在组合网关/文件服务器上运行 Openswan 时遇到的问题,eth2 是第二个未使用的 LAN 适配器。
那么你可以忽略它。这是在子网端运行子网-子网或子网-主机隧道时出现的警告,需要从公共端(互联网)转发到局域网。