☰

Strongswan VPN 隧道已连接，但流量未通过它路由

tag-icon • tag-icon linux vpn kvm-virtualization cisco-asa strongswan
Strongswan VPN 隧道已连接，但流量未通过它路由

我刚刚用 strongswan (4.5) 设置了一个站点到站点的 vpn 隧道。隧道看起来不错，并且连接到另一端，但似乎在通过隧道路由流量时存在问题。

任何想法？

谢谢！

网络图

+----------------------------------+
|Dedicated server: starfleet       |                   +-----------------+
|                                  |                   |  CISCO ASA      |
|        +-------------------------|     internet      |                 |
|        |eth0: XX.XX.XX.195/29    +-------------------|  YY.YYY.YYY.155 |
|        +-------------------------|                   +------+----------+
|        |virbr1: 192.168.100.1/24 |                          |
|        +----+--------------------|                          |
|             |                    |                          |
|             |                    |                   +-----------------+
|             |                    |                   |network          |
|     +-------+                    |                   |                 |
|     |                            |                   |172.30.20.0/27   |
|     |                            |                   +-----------------+
| +------------------------------+ |
| | kvm server: enterprise       | |
| |                              | |
| |                              | |
| | eth0: 192.168.100.100/24     | |
| +------------------------------+ |
+----------------------------------+

软件

  • debian wheezy
  • strongswan 4.5.2-1.5+deb7u1
  • kvm 和 libvirt（192.168.100.x 网络）

/etc/ipsec.conf

root@starfleet ~ # cat /etc/ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
    plutodebug="all"
    plutostderrlog=/var/log/pluto-ipsec
    charonstart=no
    plutostart=yes

conn net-net
     ikelifetime=86400s
     keylife=3600s
     rekeymargin=3m
     keyingtries=1
     keyexchange=ikev1
     authby=secret
     ike=aes256-sha-modp1024!
     esp=aes256-sha
     right=YY.YYY.YYY.155
     rightsubnet=172.30.20.0/27
     left=XX.XX.XX.195
     leftsubnet=192.168.100.0/24
     leftfirewall=yes
     pfs=no
     auto=add

Ipsec 启动

root@starfleet ~ # ipsec up net-net
002 "net-net" #1: initiating Main Mode
102 "net-net" #1: STATE_MAIN_I1: initiate
003 "net-net" #1: ignoring Vendor ID payload [FRAGMENTATION c0000000]
104 "net-net" #1: STATE_MAIN_I2: sent MI2, expecting MR2
003 "net-net" #1: ignoring Vendor ID payload [Cisco-Unity]
003 "net-net" #1: received Vendor ID payload [XAUTH]
003 "net-net" #1: ignoring Vendor ID payload [###############################]
003 "net-net" #1: ignoring Vendor ID payload [Cisco VPN 3000 Series]
106 "net-net" #1: STATE_MAIN_I3: sent MI3, expecting MR3
002 "net-net" #1: Peer ID is ID_IPV4_ADDR: 'YY.YYY.YYY.155'
002 "net-net" #1: ISAKMP SA established
004 "net-net" #1: STATE_MAIN_I4: ISAKMP SA established
002 "net-net" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#1}
110 "net-net" #2: STATE_QUICK_I1: initiate
002 "net-net" #2: sent QI2, IPsec SA established {ESP=>0x8a12ab22 <0xa01abba1}
004 "net-net" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x8a12ab22     <0xa01abba1}

root@starfleet ~ # ipsec status
000 "net-net":     192.168.100.0/24===XX.XX.XX.195[XX.XX.XX.195]...YY.YYY.YYY.155[YY.YYY.YYY.155]===172.30.20. 0/27; erouted; eroute owner: #2
000 "net-net":   newest ISAKMP SA: #1; newest IPsec SA: #2; 
000 
000 #2: "net-net" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 3331s; newest IPSEC; eroute owner
000 #2: "net-net" [email protected] (0 bytes) [email protected] (0 bytes); tunnel
000 #1: "net-net" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 86050s; newest ISAKMP
000

网络信息

tun0接口由openvpn服务器使用。

病毒1接口是 kvm 网络

root@starfleet ~ # ip -4 a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    inet XX.XX.XX.195/29 brd XX.XX.XX.199 scope global eth0
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
    inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
5: virbr1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    inet 192.168.100.1/24 brd 192.168.100.255 scope global virbr1

root@starfleet ~ # ip -4 r s t 0
default via XX.XX.XX.193 dev eth0 
10.8.0.0/16 via 10.8.0.2 dev tun0 
10.8.0.2 dev tun0  proto kernel  scope link  src 10.8.0.1 
XX.XX.XX.192/29 via XX.XX.XX.193 dev eth0 
XX.XX.XX.192/29 dev eth0  proto kernel  scope link  src XX.XX.XX.195 
192.168.100.0/24 dev virbr1  proto kernel  scope link  src 192.168.100.1 
local 10.8.0.1 dev tun0  table local  proto kernel  scope host  src 10.8.0.1 
broadcast XX.XX.XX.192 dev eth0  table local  proto kernel  scope link  src XX.XX.XX.195 
local XX.XX.XX.195 dev eth0  table local  proto kernel  scope host  src XX.XX.XX.195 
broadcast XX.XX.XX.199 dev eth0  table local  proto kernel  scope link  src XX.XX.XX.195 
broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
local 127.0.0.1 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
broadcast 192.168.100.0 dev virbr1  table local  proto kernel  scope link  src 192.168.100.1 
local 192.168.100.1 dev virbr1  table local  proto kernel  scope host  src 192.168.100.1 
broadcast 192.168.100.255 dev virbr1  table local  proto kernel  scope link  srr 192.168.100.1

root@starfleet ~ # ip xfrm state
src XX.XX.XX.195 dst YY.YYY.YYY.155
    proto esp spi 0x8a12ab22 reqid 16384 mode tunnel
    replay-window 32 flag af-unspec
    auth-trunc hmac(sha1) 0x######################################## 96
    enc cbc(aes) 0x################################################################
src YY.YYY.YYY.155 dst XX.XX.XX.195
    proto esp spi 0xa01abba1 reqid 16384 mode tunnel
    replay-window 32 flag af-unspec
    auth-trunc hmac(sha1) 0x######################################## 96
    enc cbc(aes) 0x################################################################

root@starfleet ~ # ip xfrm policy
src 192.168.100.0/24 dst 172.30.20.0/27 
    dir out priority 1847 ptype main 
    tmpl src XX.XX.XX.195 dst YY.YYY.YYY.155
        proto esp reqid 16384 mode tunnel
src 172.30.20.0/27 dst 192.168.100.0/24 
    dir fwd priority 1847 ptype main 
    tmpl src YY.YYY.YYY.155 dst XX.XX.XX.195
        proto esp reqid 16384 mode tunnel
src 172.30.20.0/27 dst 192.168.100.0/24 
    dir in priority 1847 ptype main 
    tmpl src YY.YYY.YYY.155 dst XX.XX.XX.195
        proto esp reqid 16384 mode tunnel
src ::/0 dst ::/0 
    socket out priority 0 ptype main 
src ::/0 dst ::/0 
    socket in priority 0 ptype main 
src ::/0 dst ::/0 
    socket out priority 0 ptype main 
src ::/0 dst ::/0 
    socket in priority 0 ptype main 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 ptype main 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 ptype main 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 ptype main 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 ptype main 

root@starfleet ~ # ip route show table 220
root@starfleet ~ # 

root@starfleet ~ # route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         XX.XX.XX.193    0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.0.0     UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
XX.XX.XX.192    XX.XX.XX.193    255.255.255.248 UG    0      0        0 eth0
XX.XX.XX.192    0.0.0.0         255.255.255.248 U     0      0        0 eth0
192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr1

iptables 目录

root@starfleet ~ # iptables-save 
# Generated by iptables-save v1.4.14 on Fri May 24 16:07:39 2013
*nat
:PREROUTING ACCEPT [11:368]
:INPUT ACCEPT [1:48]
:OUTPUT ACCEPT [13:1012]
:POSTROUTING ACCEPT [13:1012]
-A POSTROUTING -s 10.8.0.0/16 ! -d 10.8.0.0/16 -o virbr1 -j MASQUERADE
-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -j MASQUERADE
COMMIT
# Completed on Fri May 24 16:07:39 2013
# Generated by iptables-save v1.4.14 on Fri May 24 16:07:39 2013
*mangle
:PREROUTING ACCEPT [271:19504]
:INPUT ACCEPT [261:19184]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [181:28686]
:POSTROUTING ACCEPT [181:28686]
-A POSTROUTING -o virbr1 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Fri May 24 16:07:39 2013
# Generated by iptables-save v1.4.14 on Fri May 24 16:07:39 2013
*filter
:INPUT ACCEPT [46:3380]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [36:5220]
-A INPUT -i virbr1 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr1 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr1 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr1 -p tcp -m tcp --dport 67 -j ACCEPT
-A FORWARD -s 172.30.20.0/27 -d 192.168.100.0/24 -i eth0 -m policy --dir in --pol ipsec --reqid 16384 --proto esp -j ACCEPT
-A FORWARD -s 192.168.100.0/24 -d 172.30.20.0/27 -o eth0 -m policy --dir out --pol ipsec --reqid 16384 --proto esp -j ACCEPT
-A FORWARD -s 10.8.0.0/16 -o virbr1 -j ACCEPT
-A FORWARD -i virbr1 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 192.168.100.0/24 -o virbr1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.100.0/24 -i virbr1 -j ACCEPT
-A FORWARD -i virbr1 -o virbr1 -j ACCEPT
-A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Fri May 24 16:07:39 2013

TcpDumping 从 192.168.100.100 到 172.30.20.9

所有命令同时运行。

root@enterprise:~# ping 172.30.20.9
PING 172.30.20.9 (172.30.20.9) 56(84) bytes of data.
^C
--- 172.30.20.9 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 4999ms

root@enterprise:~# tcpdump -v -n dst net 172.30.20.0/27
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:23:48.919819 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 1, length 64
16:23:49.918949 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 2, length 64
16:23:50.918950 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 3, length 64
16:23:51.918952 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 4, length 64
16:23:52.918954 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 5, length 64
16:23:53.918951 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.100.100 > 172.30.20.9: ICMP echo request, id 2605, seq 6, length 64

root@starfleet ~ # tcpdump -v -n dst net 172.30.20.0/27
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:23:50.475100 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 1, length 64
16:23:51.474262 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 2, length 64
16:23:52.474280 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 3, length 64
16:23:53.474251 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 4, length 64
16:23:54.474213 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 5, length 64
16:23:55.474173 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
XX.XX.XX.195 > 172.30.20.9: ICMP echo request, id 2605, seq 6, length 64

答案1

tcpdump会话的输出星际舰队揭示了问题。由于这里的 NAT 规则

-A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -j MASQUERADE

源地址为 的 ICMP 请求192.168.100.100将被网络地址转换到xx.xx.xx.195。由于协商的 IPsec 策略适用于来自192.168.100.0/24和 的流量，因此xx.xx.xx.195这些数据包不会被加密。从中可以看出数据包通过 Netfilter 的示意图nat 表中 POSTROUTING 链中的规则在查找 IPsec 转换之前应用（xfrm 查找）。

要解决这个问题一以下的：

  • 从 MASQUERADE 规则中明确排除到目标子网的流量（! -d 172.30.20.0/27）

  • 添加明确豁免规则前化装舞会规则

    -A POSTROUTING -s 192.168.100.0/24 -m policy --dir out --pol ipsec -j ACCEPT

  • 保留 MASQUERADE 规则，但进行配置leftsubnet=xx.xx.xx.195/32（需要调整 Cisco ASA 盒上的配置，如果您的目标实际上是站点到站点隧道，则这无济于事）

答案2

我的情况与 @telemaco 描述的情况非常相似。我的笔记本电脑上的 KVM 上运行着一些测试虚拟机。我的笔记本电脑通过 DHCP 接收其 IP 地址，因此 Strongswan 通过 为我的笔记本电脑分配 VPN 端点 IP 地址leftsourceip=%config。

虚拟机使用私有网络192.168.100.0/24。我的笔记本电脑（KVM 主机）通过 DHCP 接收 IP 地址，并从 Strongswan192.168.50.2/24接收端点 IP 地址。10.0.0.10/26

192.168.0.0/24虚拟机应该访问通过 VPN 路由的网络。

根据@ecdsa 提供的答案，我通过添加以下规则实现了此工作：

-t nat -I POSTROUTING -s 192.168.100.0/24 -d 192.168.0.0/24 -j SNAT --to-source 10.0.0.10

就我而言，ip xfrm policy看起来像这样（摘录）：

src 192.168.0.0/24 dst 10.0.0.10/32 
    dir fwd priority 2851 
    tmpl src xx.xx.xx.xx dst 192.168.50.2
        proto esp reqid 5 mode tunnel
src 192.168.0.0/24 dst 10.0.0.10/32 
    dir in priority 2851 
    tmpl src xx.xx.xx.xx dst 192.168.50.2
        proto esp reqid 5 mode tunnel
src 10.0.0.10/32 dst 192.168.0.0/24 
    dir out priority 2851 
    tmpl src 192.168.50.2 dst xx.xx.xx.xx
        proto esp reqid 5 mode tunnel

这意味着只有本地 IP 地址10.0.0.10才有对应的xfrm lookup规则。这就是需要 NAT 的原因，除非虚拟机子网已添加到 IPsec。

相关内容