在主机到网络模式下设置 IPSec VPN 的问题

在主机到网络模式下设置 IPSec VPN 的问题

我已经在 CentOS 6.5 上使用 OpenSwan 设置了 IPSec VPN。但无法启动并运行隧道。当站点 B 尝试 ping 我的 VPS(站点 A)时,他们收到以下错误:

Feb 26 11:33:59 [IKEv1 DEBUG]IP = ip1, IKE MM Initiator FSM error history (struct   &0x00007fff3b110df0)  <state>, <event>:  MM_DONE, EV_ERROR-->MM_WAIT_MSG2, EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2, EV_RETRY 
Feb 26 11:33:59 [IKEv1 DEBUG]IP = ip1, IKE SA MM:2bceea55 terminating:  flags 0x01000022, refcnt 0, tuncnt 0
Feb 26 11:33:59 [IKEv1 DEBUG]IP = ip1, sending delete/delete with reason message`

MM_WAIT_MSG2表示返回对等点的路由存在问题。

我已经完成以下工作:

shell>yum install openswan lsof

shell>vim /etc/sysctl.conf 

    net.ipv4.ip_forward = 1
    net.ipv4.conf.all.accept_redirects = 0
    net.ipv4.conf.all.send_redirects = 0

shell>sysctl -p

shell>iptables -A INPUT -p udp --dport 500 -j ACCEPT

shell>iptables -A INPUT -p tcp --dport 4500 -j ACCEPT

shell>iptables -A INPUT -p udp --dport 4500 -j ACCEPT

shell>iptables -t nat -A POSTROUTING -s ip1/32 -d ip3/32 -j SNAT --to ip1

shell>/sbin/service iptables save

shell>service iptables restart

我的ipsec.conf样子如下:

config setup
    # Debug-logging controls:  "none" for (almost) none, "all" for lots.
    # klipsdebug=none
    # plutodebug="control parsing"
    # For Red Hat Enterprise Linux and Fedora, leave protostack=netkey
plutodebug=all
    plutostderrlog=/var/log/pluto.log   
protostack=netkey
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/16
oe=off
# Enable this if you see "failed to find any available worker"
# nhelpers=0
conn my_first_ipsec
    authby=secret
    auto=start
    ike=aes128-sha1;modp1024
    keyexchange=ike
    phase2=esp
    phase2alg=aes128-sha1;modp1024
    type=tunnel
    compress=no
    pfs=no
    left=ip1
    leftid=ip1
    leftsubnet=ip1/32
    leftnexthop=%defaultroute
    right=ip2
    rightsubnet=ip3/32

我的ipsec.secrets样子如下:

ip1 ip2:    PSK "XXXXXXXXXXXXXX"

重新启动 ipsec 服务:

shell>/etc/init.d/ipsec restart

服务正常启动。

我检查了 IP 路由,但没有目标 IP 的路由。因此,我手动添加了它。

shell>route add -host ip3 gw ip1

现在当我检查 ipsec 服务状态时,显示如下:

shell>service ipsec status
IPsec running  - pluto pid: 23570
pluto pid 23570
No tunnels up

shell>ipsec auto--status

000 using kernel interface: netkey
000 interface lo/lo ::1
000 interface lo/lo 127.0.0.1
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 ip1
000 interface eth0/eth0 ip1
000 %myid = (none)
000 debug   raw+crypt+parsing+emitting+control+lifecycle+klips+dns+oppo+controlmore+pfkey+nattraversal+x509+dpd+oppoinfo
000
000 virtual_private (%priv):
000 - allowed 3 subnets: 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/16
000 - disallowed 0 subnets:
000 WARNING: Disallowed subnets in virtual_private= is empty. If you have
000          private address space in internal use, it should be excluded! 
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,1,64} trans={0,1,3072} attrs= {0,1,2048}
000
000 "my_first_ipsec": ip1/32===ip1<ip1>[+S=C]---69.28.92.1...ip2<ip2>[+S=C]===ip3/32; erouted HOLD; eroute owner: #0
000 "my_first_ipsec":     myip=unset; hisip=unset;
000 "my_first_ipsec":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; nat_keepalive: yes
000 "my_first_ipsec":   policy: PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,32; interface: eth0;
000 "my_first_ipsec":   dpd: action:clear; delay:0; timeout:0;
000 "my_first_ipsec":   newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "my_first_ipsec":   IKE algorithms wanted: AES_CBC(7)_128-SHA1(2)_000-MODP1024(2)
000 "my_first_ipsec":   IKE algorithms found:  AES_CBC(7)_128-SHA1(2)_160-MODP1024(2)
000 "my_first_ipsec":   ESP algorithms wanted: AES(12)_128-SHA1(2)_000; pfsgroup=MODP1024(2)
000 "my_first_ipsec":   ESP algorithms loaded: AES(12)_128-SHA1(2)_160
000
000 #77: "my_first_ipsec":500 STATE_MAIN_I3 (sent MI3, expecting MR3); EVENT_RETRANSMIT in 19s; nodpd; idle; import:admin initiate
000 #77: pending Phase 2 for "my_first_ipsec" replacing #0

我还检查了端口 500 和 4500 是否打开。

ip1 的 Nmap 扫描报告

Host is up (0.00056s latency).
PORT     STATE  SERVICE
500/tcp  closed isakmp
4500/tcp closed sae-urn

端口已打开,但 STATE 显示“已关闭”,这意味着没有服务正在监听这些端口。这样可以吗?

  1. 知道为什么站点 B 无法 ping 或 telnet 站点 A 吗?

  2. ipsec auto --status显示myiphisip未设置。这会造成问题吗?

任何帮助将不胜感激。

相关内容