есть назамысловатый конфиг ipsec для racoon (фактически все дефолтовое)
path pre_shared_key "/usr/local/etc/racoon/psk.txt";
log info;
padding {
maximum_length 20;
randomize off;
strict_check off;
exclusive_tail off;
}
listen
{
isakmp 1.2.3.4 [500];}
timer {
counter 5;
interval 20 sec;
persend 1;
phase1 30 sec;
phase2 15 sec;
# natt_keepalive 10sec;
}
remote anonymous {
exchange_mode main,aggressive;
lifetime time 24 hour;
passive on;
generate_policy on;
proposal_check obey;
#obey, strict or claim
# nat_traversal on;
ike_frag on;
dpd_delay 10;
dpd_retry 5;
dpd_maxfail 5;
proposal {
encryption_algorithm aes 256;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group modp1024;
}
}
sainfo anonymous {
pfs_group modp1024;
lifetime time 86400 sec;
encryption_algorithm aes 256;
authentication_algorithm hmac_sha1, hmac_md5;
lifetime time 1 hour ;
compression_algorithm deflate;
}
все работает без проблем с полпинка
встала необходимость переехать на strongswan. Ну казалось бы, конфиг то же без затей
config setup
charondebug="asn 1, enc 1, job 1"
conn tun2dc
type=tunnel
keyingtries=5
auto=start
keyexchange=ikev1
authby=psk
ike=aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes128-sha1-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha1-modp4096,aes128-sha256-modp1536,aes128-sha1-modp1536,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha384-modp1536,aes256-sha256-modp1536,aes256-sha1-modp1536,aes256-sha384-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024!
esp=aes128gcm16-ecp256,aes256gcm16-ecp384,aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes128-sha1-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha1-modp4096,aes128-sha256-modp1536,aes128-sha1-modp1536,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha384-modp1536,aes256-sha256-modp1536,aes256-sha1-modp1536,aes256-sha384-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024,aes128gcm16,aes256gcm16,aes128-sha256,aes128-sha1,aes256-sha384,aes256-sha256,aes256-sha1!
left=1.2.3.4
leftid=1.2.3.4
# leftsourceip=%config
leftsourceip=1.2.3.4
leftsubnet=192.168.101.0/24
leftfirewall=yes
right=5.6.7.8
rightid=5.6.7.8
rightsourceip=5.6.7.8
rightsubnet=172.23.16.0/24
оно взлетает, но как-то видимо не до конца. Тк пакеты не ходят
root@fbsdap:/usr/local/etc # ipsec statusall
Status of IKE charon daemon (strongSwan 5.6.0, FreeBSD 11.1-RELEASE-p6, amd64):
uptime: 93 seconds, since Dec 18 20:33:37 2017
worker threads: 7 of 16 idle, 5/0/4/0 working, job queue: 0/0/0/0, scheduled: 2
loaded plugins: charon aes des blowfish rc2 sha2 sha1 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkc
tun2dc pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf curve25519 xcbc cmac hmac attr kernel-libipsec kernel-pfroute
resolve socket-default stroke vici updown eap-identity eap-md5 eap-mschapv2 eap-tls eap-ttls eap-peap xauth-generic white
list addrblock
Virtual IP pools (size/online/offline):
5.6.7.8: 1/0/0
Listening IP addresses:
1.2.3.4
Connections:
tun2dc: 1.2.3.4...5.6.7.8 IKEv1
tun2dc: local: [1.2.3.4] uses pre-shared key authentication
tun2dc: remote: [5.6.7.8] uses pre-shared key authentication
tun2dc: child: 192.168.101.0/24 === 172.23.16.0/24 TUNNEL
Security Associations (1 up, 0 connecting):
tun2dc[1]: ESTABLISHED 92 seconds ago, 1.2.3.4[1.2.3.4]...5.6.7.8[5.6.7.8]
tun2dc[1]: IKEv1 SPIs: ae1c03d008276614_i* 6d418d743a6d8de7_r, pre-shared key reauthentication in 2 hours
tun2dc[1]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
tun2dc[1]: Tasks queued: QUICK_MODE
я не вижу
INSTALLED, TUNNEL
а в лог валится
inbound ESP packet does not belong to an installed SA
fbsd11
интерфейс ng0 (mpd5 pppoe)
а что забыл понять не могу
https://ru-root.livejournal.com/2903848.html
dil at Загадочные грабельки в MySQL