☰

Openswan 的 ipsec 验证失败，提示“发现两个或更多接口，正在检查 IP 转发”

tag-icon • tag-icon networking vpn ipsec openswan
Openswan 的 ipsec 验证失败，提示“发现两个或更多接口，正在检查 IP 转发”

我正在尝试设置 L2TP/IPsec VPN。我已从 Ubuntu 13.04 上的存储库安装了 openswan

Section: universe/net
Architecture: amd64
Version: 1:2.6.38-1

并按照以下方式配置社区文档。

# cat /etc/ipsec.conf 
config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.23.0/24
    oe=off
    protostack=netkey

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    # Apple iOS doesn't send delete notify so we need dead peer detection
    # to detect vanishing clients
    dpddelay=30
    dpdtimeout=120
    dpdaction=clear
    # Set ikelifetime and keylife to same defaults windows has
    ikelifetime=8h
    keylife=1h
    type=transport
    # Replace IP address with your local IP (private, behind NAT IP is okay as well)
    left=my.ip
    # For updated Windows 2000/XP clients,
    # to support old clients as well, use leftprotoport=17/%any
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any
    #force all to be nat'ed. because of iOS
    forceencaps=yes

启动正常但验证失败

# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.38/K3.8.0-29-generic (netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                           [N/A]
 NETKEY:  Testing XFRM related proc values                      [OK]
[OK]
[OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [OK]
Two or more interfaces found, checking IP forwarding            [FAILED]
Checking NAT and MASQUERADEing                                  [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [OK]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]

尽管转发似乎已启用

# cat /proc/sys/net/ipv4/ip_forward
1

出了什么问题？如何解决？

答案1

查找错误时偶然发现了这一点：

我认为这是答案：

https://lists.openswan.org/pipermail/users/2009-September/017423.html

我刚刚升级到 2.6.23 并运行 ipsec verify，但出现意外错误：发现两个或更多接口，正在检查 IP 转发 [失败]

cat /proc/sys/net/ipv4/ip_forward 给出 1，所以我很困惑。

如果它有帮助，eth0 是我的 WAN，eth1 是我的普通 LAN，eth1:0 是 eth1 上的虚拟 IP，以解决我在组合网关/文件服务器上运行 Openswan 时遇到的问题，eth2 是第二个未使用的 LAN 适配器。

那么你可以忽略它。这是在子网端运行子网-子网或子网-主机隧道时出现的警告，需要从公共端（互联网）转发到局域网。

相关内容