我已经在 CentOS 6.5 上使用 OpenSwan 设置了 IPSec VPN。但无法启动并运行隧道。当站点 B 尝试 ping 我的 VPS（站点 A）时，他们收到以下错误：
Feb 26 11:33:59 [IKEv1 DEBUG]IP = ip1, IKE MM Initiator FSM error history (struct &0x00007fff3b110df0) <state>, <event>: MM_DONE, EV_ERROR-->MM_WAIT_MSG2, EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2, EV_RETRY
Feb 26 11:33:59 [IKEv1 DEBUG]IP = ip1, IKE SA MM:2bceea55 terminating: flags 0x01000022, refcnt 0, tuncnt 0
Feb 26 11:33:59 [IKEv1 DEBUG]IP = ip1, sending delete/delete with reason message`
MM_WAIT_MSG2表示返回对等点的路由存在问题。
我已经完成以下工作：
shell>yum install openswan lsof
shell>vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
shell>sysctl -p
shell>iptables -A INPUT -p udp --dport 500 -j ACCEPT
shell>iptables -A INPUT -p tcp --dport 4500 -j ACCEPT
shell>iptables -A INPUT -p udp --dport 4500 -j ACCEPT
shell>iptables -t nat -A POSTROUTING -s ip1/32 -d ip3/32 -j SNAT --to ip1
shell>/sbin/service iptables save
shell>service iptables restart
我的ipsec.conf样子如下：
config setup
# Debug-logging controls: "none" for (almost) none, "all" for lots.
# klipsdebug=none
# plutodebug="control parsing"
# For Red Hat Enterprise Linux and Fedora, leave protostack=netkey
plutodebug=all
plutostderrlog=/var/log/pluto.log
protostack=netkey
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/16
oe=off
# Enable this if you see "failed to find any available worker"
# nhelpers=0
conn my_first_ipsec
authby=secret
auto=start
ike=aes128-sha1;modp1024
keyexchange=ike
phase2=esp
phase2alg=aes128-sha1;modp1024
type=tunnel
compress=no
pfs=no
left=ip1
leftid=ip1
leftsubnet=ip1/32
leftnexthop=%defaultroute
right=ip2
rightsubnet=ip3/32
我的ipsec.secrets样子如下：
ip1 ip2: PSK "XXXXXXXXXXXXXX"
重新启动 ipsec 服务：
shell>/etc/init.d/ipsec restart
服务正常启动。
我检查了 IP 路由，但没有目标 IP 的路由。因此，我手动添加了它。
shell>route add -host ip3 gw ip1
现在当我检查 ipsec 服务状态时，显示如下：
shell>service ipsec status
IPsec running - pluto pid: 23570
pluto pid 23570
No tunnels up
shell>ipsec auto--status
000 using kernel interface: netkey
000 interface lo/lo ::1
000 interface lo/lo 127.0.0.1
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 ip1
000 interface eth0/eth0 ip1
000 %myid = (none)
000 debug raw+crypt+parsing+emitting+control+lifecycle+klips+dns+oppo+controlmore+pfkey+nattraversal+x509+dpd+oppoinfo
000
000 virtual_private (%priv):
000 - allowed 3 subnets: 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/16
000 - disallowed 0 subnets:
000 WARNING: Disallowed subnets in virtual_private= is empty. If you have
000 private address space in internal use, it should be excluded!
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,1,64} trans={0,1,3072} attrs= {0,1,2048}
000
000 "my_first_ipsec": ip1/32===ip1<ip1>[+S=C]---69.28.92.1...ip2<ip2>[+S=C]===ip3/32; erouted HOLD; eroute owner: #0
000 "my_first_ipsec": myip=unset; hisip=unset;
000 "my_first_ipsec": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; nat_keepalive: yes
000 "my_first_ipsec": policy: PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,32; interface: eth0;
000 "my_first_ipsec": dpd: action:clear; delay:0; timeout:0;
000 "my_first_ipsec": newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "my_first_ipsec": IKE algorithms wanted: AES_CBC(7)_128-SHA1(2)_000-MODP1024(2)
000 "my_first_ipsec": IKE algorithms found: AES_CBC(7)_128-SHA1(2)_160-MODP1024(2)
000 "my_first_ipsec": ESP algorithms wanted: AES(12)_128-SHA1(2)_000; pfsgroup=MODP1024(2)
000 "my_first_ipsec": ESP algorithms loaded: AES(12)_128-SHA1(2)_160
000
000 #77: "my_first_ipsec":500 STATE_MAIN_I3 (sent MI3, expecting MR3); EVENT_RETRANSMIT in 19s; nodpd; idle; import:admin initiate
000 #77: pending Phase 2 for "my_first_ipsec" replacing #0
我还检查了端口 500 和 4500 是否打开。
ip1 的 Nmap 扫描报告
Host is up (0.00056s latency).
PORT STATE SERVICE
500/tcp closed isakmp
4500/tcp closed sae-urn
端口已打开，但 STATE 显示“已关闭”，这意味着没有服务正在监听这些端口。这样可以吗？
知道为什么站点 B 无法 ping 或 telnet 站点 A 吗？
ipsec auto --status显示myip和hisip未设置。这会造成问题吗？
任何帮助将不胜感激。