我正在运行带有 IPsec（strongswan）和 OpenVPN 容器的部署。
IPsec 的配置：
config setup
conn customer
keyexchange=ikev1
left=%defaultroute
leftsubnet=192.168.224.0/24
right=X.X.X.X
rightsubnet=10.5.0.0/16
ike=aes256-sha256-modp3072!
esp=aes256-sha256-modp3072!
authby=psk
ikelifetime=28800
lifetime=3600
auto=start
type=tunnel
ipsec 启动 sh：
ip link add name eth1 type dummy
ifconfig eth1 up
ip addr add 192.168.224.1 dev eth1
ifconfig eth1 mtu 1440
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -I FORWARD -s 0/0 -i tun0 -o eth0 -j ACCEPT
ipsec start
IPsec 已正常运行！
我可以 ping IPsec 另一端的服务器。
openvpn配置：
server 192.168.255.0 255.255.255.0
verb 3
key /etc/openvpn/pki/private/vpn.seeberger.adito.cloud.key
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/vpn.seeberger.adito.cloud.crt
dh /etc/openvpn/pki/dh.pem
tls-auth /etc/openvpn/pki/ta.key
key-direction 0
keepalive 10 60
persist-key
persist-tun
proto udp
# Rely on Docker to do port mapping, internally always 1194
port 1194
dev tun0
status /tmp/openvpn-status.log
user nobody
group nogroup
comp-lzo no
### Route Configurations Below
route 10.5.0.0 255.255.0.0
### Push Configurations Below
push "route 10.5.0.0 255.255.0.0"
#push "block-outside-dns"
#push "dhcp-option DNS 8.8.8.8"
#push "dhcp-option DNS 8.8.4.4"
push "comp-lzo no"
ifconfig:
server 192.168.255.0 255.255.255.0
verb 3
key /etc/openvpn/pki/private/vpn.seeberger.adito.cloud.key
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/vpn.seeberger.adito.cloud.crt
dh /etc/openvpn/pki/dh.pem
tls-auth /etc/openvpn/pki/ta.key
key-direction 0
keepalive 10 60
persist-key
persist-tun
proto udp
# Rely on Docker to do port mapping, internally always 1194
port 1194
dev tun0
status /tmp/openvpn-status.log
user nobody
group nogroup
comp-lzo no
### Route Configurations Below
route 10.5.0.0 255.255.0.0
### Push Configurations Below
push "route 10.5.0.0 255.255.0.0"
#push "block-outside-dns"
#push "dhcp-option DNS 8.8.8.8"
#push "dhcp-option DNS 8.8.4.4"
push "comp-lzo no"
ifconfig：
eth0 Link encap:Ethernet HWaddr 4A:1C:D3:AB:2E:DE
inet addr:10.42.74.74 Bcast:0.0.0.0 Mask:255.255.255.255
inet6 addr: fe80::481c:d3ff:feab:2ede/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1440 Metric:1
RX packets:1454 errors:0 dropped:0 overruns:0 frame:0
TX packets:316 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:234613 (229.1 KiB) TX bytes:26814 (26.1 KiB)
eth1 Link encap:Ethernet HWaddr 9E:B3:59:1F:3A:03
inet addr:192.168.224.1 Bcast:0.0.0.0 Mask:255.255.255.255
inet6 addr: fe80::9cb3:59ff:fe1f:3a03/64 Scope:Link
UP BROADCAST RUNNING NOARP MTU:1440 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:70 (70.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.255.1 P-t-P:192.168.255.2 Mask:255.255.255.255
inet6 addr: fe80::a4c1:6d34:21b:1d7a/64 Scope:Link
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:4 errors:0 dropped:0 overruns:0 frame:0
TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:240 (240.0 B) TX bytes:304 (304.0 B)
路线-n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 169.254.1.1 0.0.0.0 UG 0 0 0 eth0
10.5.0.0 192.168.255.2 255.255.0.0 UG 0 0 0 tun0
169.254.1.1 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
192.168.255.0 192.168.255.2 255.255.255.0 UG 0 0 0 tun0
192.168.255.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
您能帮助我使用 iptable 路由将流量从 tun0 路由到 ipsec 隧道吗，这样我就可以从本地 PC ping 一个服务器（例如 10.5.1.170）到 ipsec 隧道另一端的服务器？
- -编辑 - -
openvpn客户端IP: 192.168.255.6
ipsec-container 上的 tcpdump：ping openvpn-container -> 10.5.1.170（正常！）
13:33:18.347397 IP 10.42.74.71.4500 > X.X.X.X.4500: UDP-encap: ESP(spi=0xb6ab40ec,seq=0x15), length 136
13:33:18.358348 IP X.X.X.X.4500 > 10.42.74.71.4500: UDP-encap: ESP(spi=0xcd9b9abe,seq=0x16), length 136
13:33:18.358348 IP 10.5.1.170 > 192.168.224.1: ICMP echo reply, id 8192, seq 0, length 64
ping openvpn-client -> 10.5.1.170 (不工作！)
13:27:03.644454 IP 192.168.255.6 > 10.5.1.170: ICMP echo request, id 1, seq 952, length 40
XXXX是对方公司的ip
在此先行致以最诚挚的问候和感谢。
上布
答案1
这行不通。您的 IPsec 隧道位于子网192.168.224.0/24和之间10.5.0.0/16。源 IP192.168.255.6不匹配该 IPsec 策略的数据包将被丢弃。
如果您无法更改 IPsec 策略（因此它涵盖这些数据包），您可以将数据包从 NAT 转移192.168.255.0/24到 IP，192.168.224.0/24以便策略匹配。