☰

strongSwan 客户端可以连接到互联网（通过 VPN），但无法通过 SSH 连接到 VPN 服务器或 VPN 子网上的其他客户端

tag-icon • tag-icon networking iptables ipsec strongswan
strongSwan 客户端可以连接到互联网（通过 VPN），但无法通过 SSH 连接到 VPN 服务器或 VPN 子网上的其他客户端

我写了一个 strongSwan指导不久前我关注了它。

然后我安装isc-dhcp-server并配置了 strongSwan 以用于 DHCP。

一切正常，除了客户端无法通过 SSH 连接到 VPN 服务器或 VPN 子网上的其他客户端（10.0.2.0/24）。

我不知道我错过了什么。我在另一台服务器上执行了完全相同的步骤，客户端可以通过 SSH 连接到 VPN 服务器和其他客户端（配置相同，但 strongSwan 版本5.5.1不同5.7.2）。

$ ipsec --version

Linux strongSwan U5.7.2/K4.19.0-8-amd64

$ cat /etc/ipsec.conf

config setup
  charondebug="ike 1, knl 1, cfg 0"
  uniqueids=never

conn ikev2
  auto=add
  compress=no
  type=tunnel
  keyexchange=ikev2
  fragmentation=yes
  forceencaps=yes
  ike=aes256gcm16-sha384-modp3072!
  esp=aes256gcm16-sha384-modp3072!
  dpdaction=clear
  dpddelay=300s
  rekey=no
  left=%any
  leftid=my-vpn.com
  leftcert=vpn-server.crt
  leftsendcert=always
  leftsubnet=0.0.0.0/0
  right=%any
  rightid=%any
  rightauth=eap-tls
  rightdns=1.1.1.1,1.0.0.1
  rightsourceip=%dhcp
  rightsendcert=never
  eap_identity=%identity

$ cat /etc/strongswan.conf

libtls {
  suites = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
}
charon {
  plugins {
    dhcp {
      force_server_address = yes
      identity_lease = yes
      interface = ens3
      load = yes
      server = 10.0.2.255
    }
  }
}

$ cat /etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug ens3
iface ens3 inet static
    # Redacted

# The VPN DHCP network interface
auto ens3:1
iface ens3:1 inet static
    address 10.0.2.1
    netmask 255.255.255.0

$ cat /etc/dhcp/dhcpd.conf

default-lease-time 600;
max-lease-time 7200;
ddns-update-style none;
subnet 10.0.2.0 netmask 255.255.255.0 {
  range 10.0.2.10 10.0.2.254;
}

$ iptables-save

# Generated by xtables-save v1.8.2 on Sat May  2 08:16:30 2020
*mangle
:PREROUTING ACCEPT [33047:26369989]
:INPUT ACCEPT [15485:16310786]
:FORWARD ACCEPT [16291:10015891]
:OUTPUT ACCEPT [13361:11160535]
:POSTROUTING ACCEPT [29612:21159798]
-A FORWARD -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
-A FORWARD -p tcp -m policy --dir out --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
COMMIT
# Completed on Sat May  2 08:16:30 2020
# Generated by xtables-save v1.8.2 on Sat May  2 08:16:30 2020
*nat
:PREROUTING ACCEPT [1644:68855]
:INPUT ACCEPT [58:4901]
:POSTROUTING ACCEPT [124:8399]
:OUTPUT ACCEPT [138:9996]
-A POSTROUTING -s 10.0.2.0/24 -o ens3 -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -s 10.0.2.0/24 -o ens3 -j MASQUERADE
COMMIT
# Completed on Sat May  2 08:16:30 2020
# Generated by xtables-save v1.8.2 on Sat May  2 08:16:30 2020
*filter
:INPUT DROP [82:5220]
:FORWARD DROP [32:18146]
:OUTPUT DROP [17:1198]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 50 --connlimit-mask 32 --connlimit-saddr -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 50 --connlimit-mask 32 --connlimit-saddr -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -m limit --limit 60/sec --limit-burst 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -m limit --limit 60/sec --limit-burst 20 -j ACCEPT
-A FORWARD -s 10.0.2.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A FORWARD -d 10.0.2.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 123 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
COMMIT
# Completed on Sat May  2 08:16:30 2020
# Generated by xtables-save v1.8.2 on Sat May  2 08:16:30 2020
*raw
:PREROUTING ACCEPT [33047:26369989]
:OUTPUT ACCEPT [13361:11160535]
COMMIT
# Completed on Sat May  2 08:16:30 2020

$ sysctl -p

net.ipv4.ip_forward = 1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

答案1

向解决这个问题的 Noel 表示感谢。

使用 dnsmasq 与 ISC DHCP 作为 DHCP 服务器并进行以下配置，我现在可以从客户端通过 SSH 连接到服务器。

/etc/dnsmasq.d/01-dhcp-loopback.conf

interface=lo
dhcp-range=10.0.2.10,10.0.2.254,255.255.255.0
port=0

/etc/strongswan.conf

charon {
  load_modular = yes
  plugins {
    include strongswan.d/charon/*.conf
  }
}

include strongswan.d/*.conf

/etc/strongswan.d/charon/dhcp.conf

dhcp {
    force_server_address = yes
    identity_lease = yes
    interface = lo
    load = yes
    server = 10.0.2.1
}

此外，以下 iptables 规则不再需要。

-A INPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT

相关内容