Esto siempre ha sido un camello .. describo lo que se hizo con un openwrt
- Habilitar en el firewall la entrada al 500 y 4500
Checking your system to see if IPsec got installed and started correctly:Version check and ipsec on-path [OK]Linux Openswan U2.6.38-gb812c102/K3.18.20 (netkey)Checking for IPsec support in kernel [OK] SAref kernel support [N/A] NETKEY: Testing XFRM related proc values [OK] [OK] [OK]Checking that pluto is running [OK] Pluto listening for IKE on udp 500 [OK] Pluto listening for NAT-T on udp 4500 [OK]Two or more interfaces found, checking IP forwarding [FAILED]Checking NAT and MASQUERADEing [OK]Checking for 'ip' command [OK]Checking /bin/sh is not /bin/dash [OK]Checking for 'iptables' command [OK]Opportunistic Encryption Support [DISABLED]
/usr/libexec/ipsec/look: line 40: hostname: not found Wed Feb 1 08:49:46 COT 2017XFRM state:src 201.245.161.22 dst 169.57.19.100 proto esp spi 0xfbc37609 reqid 16385 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) 0x663f9c7fac7dba6d13c100fc39e71fb6b1c628ca 96 enc cbc(aes) 0xd14c9286719306c192976138490a058778f12b0fc00c44db17a5242e131d3effsrc 169.57.19.100 dst 201.245.161.22 proto esp spi 0x9e4b8f10 reqid 16385 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) 0x99d72359225900cb5a185ac99f61180296cd0484 96 enc cbc(aes) 0x0c2870c9d997a0225900758ffb9341d1f076ff1d48bbf446af7b483ee193f74csrc 201.245.161.22 dst 169.57.19.100 proto esp spi 0x460e2fe8 reqid 16385 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) 0x0abac4946502dbcfc7c705dfcfe527e88060983e 96 enc cbc(aes) 0x2e744bf8b514690947f62468a73976fad35344016df061f2bfc2726a9e46cc63src 169.57.19.100 dst 201.245.161.22 proto esp spi 0x043cf156 reqid 16385 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(sha1) 0xe819f735d7d9f90faba18cf5a6f27df83f3d1f16 96 enc cbc(aes) 0x317a9f1948b64d9dee5bfd0135cd7a99c661b22130093821305a57019313ed04XFRM policy:src 192.168.0.19/32 dst 10.130.67.166/32 dir out priority 2080 tmpl src 201.245.161.22 dst 169.57.19.100 proto esp reqid 16385 mode tunnelsrc 10.130.67.166/32 dst 192.168.0.19/32 dir fwd priority 2080 tmpl src 169.57.19.100 dst 201.245.161.22 proto esp reqid 16385 mode tunnelsrc 10.130.67.166/32 dst 192.168.0.19/32 dir in priority 2080 tmpl src 169.57.19.100 dst 201.245.161.22 proto esp reqid 16385 mode tunnel
Y otros estan en la referencia de implementacion en Debian
-
==============================================================
ipsec.conf
# Manual: ipsec.conf.5 version 2.0 # conforms to second version of ipsec.conf specification # basic configuration config setup protostack=netkey plutostderrlog=/var/log/pluto.log #logfile=/var/log/pluto.log plutodebug="control parsing" # plutodebug="all crypt" plutodebug=all # plutodebug=none # klipsdebug=none # klipsdebug=all dumpdir=/var/run/pluto/ virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 # virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100 nat_traversal=yes nhelpers=0 oe=off #VPN Codema conn inntegra authby=secret #aggrmode=yes auto=start ike=aes256-sha1;modp1536 ikelifetime=86400s ## phase 1 ## keyexchange=ike #keyingtries=%forever ## phase 2 ## phase2=esp phase2alg=aes256-sha1;modp1536 lifetime = 3600s compress=no pfs=no type=tunnel left=201.245.161.22 leftsubnet=192.168.0.19/32 right=169.57.19.100 rightsubnet=10.130.67.166/32 #leftid=201.245.161.22 ## for direct routing ## #leftsubnet=<siteA-public-IP>/32
==============================================================
ipsec.secret
# this file is managed with debconf and will contain the automatically created RSA keysinclude /var/lib/openswan/ipsec.secrets.inc201.245.161.22 169.57.19.100 : PSK "1616conexion"
==============================================================
firewall.user
# Regla previa al MASQ para que IPSEC salga como debe seriptables -t nat -I zone_wan_postrouting 2 -s 192.168.0.19/32 -d 10.130.67.166/32 -j SNAT --to 201.245.161.22iptables -t nat -I zone_wan_postrouting 2 -m policy --dir out --pol ipsec -j RETURN
- http://xmodulo.com/create-site-to-site-ipsec-vpn-tunnel-openswan-linux.html
- http://linuxpitstop.com/install-openswan-and-create-site-to-site-vpn-on-centos-linux/
- https://libreswan.org/wiki/FAQ#NAT_.2B_IPsec_is_not_working-
FIN
Advertencia
Este documento es privado y es de u so exclusivo de sus autores y de SKINA TECH. Cualquier uso sin una autorización escrita es contra la ley de derechos de autor y de propiedad intelectual, y será motivo de una acción legal.
15-Marzo-2006 J.E.Gomez v1.0 Primera version