你好，我正在运行 Barrier Breaker 版本的 OpenWRT，并且已经根据以下内容设置了 VPN： http://wiki.openwrt.org/inbox/strongswan.howto 我可以使用 iPhone 或 Mac 连接到 VPN（连接到 10.10.1.0/24 网络）。我也可以从 Windows 7 连接。使用 DHCP 成功为客户端分配 IP。连接后，我无法访问网络上的任何内容。/etc/firewall.user 包含：
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
iptables -I INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
iptables -I FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT
iptables -I FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
iptables -I OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
# Enable ssh and HTTP to router
iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT
iptables -I OUTPUT 1 -p tcp --sport 22 -j ACCEPT
iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT
iptables -I OUTPUT 1 -p tcp --sport 80 -j ACCEPT
/etc/ipsec.conf 包含：
# ipsec.conf - strongSwan IPsec configuration file
# basic configuration
config setup
# strictcrlpolicy=yes
# uniqueids = no
conn ios
keyexchange=ikev1
authby=xauthrsasig
xauth=server
left=%any
leftsubnet=0.0.0.0/0
leftfirewall=yes
leftcert=serverCert.pem
right=%any
rightsubnet=10.10.1.0/24
rightsourceip=%dhcp
rightcert=clientCert.pem
forceencaps=yes
auto=add
conn %default
keyexchange=ikev2
ike=aes256-sha1-modp1024!
esp=aes256-sha1!
dpdaction=clear
dpddelay=300s
rekey=no
conn win7
left=%any
leftsubnet=0.0.0.0/0
leftauth=pubkey
leftcert=serverCert.pem
[email protected]
leftfirewall=yes
right=%any
rightauth=eap-mschapv2
rightsendcert=never
rightsubnet=10.10.1.0/24
rightsourceip=%dhcp
eap_identity=%any
auto=add
（上面已经将路由器的真实域名替换为xxx.yyy.com）。
/etc/strongswan.conf 包含：
# strongswan.conf - strongSwan configuration file
charon {
dns1 = 10.10.1.1
# number of worker threads in charon
threads = 16
# send strongswan vendor ID?
# send_vendor_id = yes
plugins {
dhcp {
server = 10.10.1.1
}
sql {
# loglevel to log into sql database
loglevel = -1
# URI to the database
# database = sqlite:///path/to/file.db
# database = mysql://user:password@localhost/database
}
}
# ...
}
pluto {
}
libstrongswan {
# set to no, the DH exponent size is optimized
# dh_exponent_ansi_x9_42 = no
}
当我连接 Windows 7 和 iPhone 时，路由器上的 ipsec 状态显示：
Security Associations (2 up, 0 connecting):
ios[5]: ESTABLISHED 4 seconds ago, xxx.xxx.xxx.xxx[C=AU, O=Netroworx, CN=xxx.xxx.com]...xxx.xxx.xxx.xxx[C=AU, O=Netroworx, CN=client]
ios{5}: INSTALLED, TUNNEL, ESP in UDP SPIs: c8618e27_i 0923f471_o
ios{5}: 0.0.0.0/0 === 10.10.1.89/32
win7[4]: ESTABLISHED 45 seconds ago, xxx.xxx.xxx.xxx[xxx.xxx.com]...xxx.xxx.xxx[192.168.191.131]
win7{4}: INSTALLED, TUNNEL, ESP in UDP SPIs: cae3b4a6_i 67f3eaf0_o
win7{4}: 0.0.0.0/0 === 10.10.1.0/24
（敏感ips及域名用xxx替换）
关于为什么数据包不能通过 VPN 路由，您有什么想法吗？
这可能是 NAT 的问题吗？
更新：尝试在 Barrier Breaker 上安装 strongswan 时出现以下信息：
opkg install strongswan-full
Installing strongswan-full (5.0.4-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/strongswan-full_5.0.4-1_ar71xx.ipk.
Multiple packages (kmod-crypto-hash and kmod-crypto-hash) providing same name marked HOLD or PREFER. Using latest.
Multiple packages (kmod-crypto-manager and kmod-crypto-manager) providing same name marked HOLD or PREFER. Using latest.
Multiple packages (kmod-crypto-core and kmod-crypto-core) providing same name marked HOLD or PREFER. Using latest.
Collected errors:
* satisfy_dependencies_for: Cannot satisfy the following dependencies for strongswan-full:
* kernel (= 3.10.18-1-0de2f8afeb2eecb34eeca6f54b460523) *
* opkg_install_cmd: Cannot install package strongswan-full.
答案1
我遇到了完全相同的问题。您找到解决方案了吗？一些专家说，我需要伪装流量。请尝试以下操作：
iptables -I POSTROUTING 1 -s 10.10.1.0/24 -j MASQUERADE -t nat
iptables -I FORWARD -m conntrack --ctstate SNAT -j ACCEPT
iptables -I FORWARD -m conntrack -s 10.10.1.0/24 --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
它对我不起作用，但也许对你有用。