VPN Tunnel sa IPSec i L2TP na Debian-u

[b4sh]

Pozdrav svima,
neznam dali netko ima iskustva sa IPSec/L2TP na debianu ali se vec par dana sa tim zabavljam i nikako da to rijesim . Sto se tice pptp (Layer Two Tunneling Protocol- 1024Bit) to mi nije bio problem jer je to jednostavno bilo rijesiti nego sam dobio od firme jos jedan L2TP/IPSec (Internet Protocol Security-2048-Bit) kljuc uz to sve jer kazu da taj pptp nije bas siguran pa zato jos ovo dodatno (Preshared Key) . PPTP radi provjereno ali ovo drugo nisam siguran pa zato i ovo pitanje .

Momentalna konfiguracija izgleda ovako :

/etc/ipsec.conf

Kod: Označi sve

# Add connections here

config setup
       virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
       nat_traversal=yes
       protostack=netkey
       oe=no
  # Replace eth0 with your network interface
       plutoopts="--interface=eth0"
  # conn L2TP-PSK
       authby=secret
       pfs=no
       auto=add
       keyingtries=3
       dpddelay=30
       dpdtimeout=120
       dpdaction=clear
       rekey=yes
       ikelifetime=8h
       keylife=1h
       type=transport
  # Replace IP address with your local IP (private, behind NAT IP is okay as well)
       left=%defaultroute
       leftnexthop=%defaultroute
       leftprotoport=17/1701
  # Replace IP address with your VPN server's IP
       right=%any
       rightprotoport=17/1701

/etc/ipsec.secrets

Kod: Označi sve

192.168.2.1 %any: PSK " *"

/etc/xl2tpd/xl2tpd.conf

Kod: Označi sve

[lac vpn-connection]
  lns = 0.0.0.0
  ppp debug = yes
  pppoptfile = /etc/ppp/options.l2tpd.client
  length bit = yes

kod lns= rekli su da slobodno stavim 0.0.0.0 da netrabam njihov IP


/etc/ppp/options.l2tpd.client

Kod: Označi sve

ipcp-accept-local
 ipcp-accept-remote
 refuse-eap
 require-mschap-v2
 noccp
 noauth
 idle 1800
 mtu 1410
 mru 1410
 defaultroute
 usepeerdns
 debug
 lock
 connect-delay 5000
 name       moj_vpn_username
 password      moj_password

Firma mi je reka da netrabam upisivati njihov IP upisuvati na mejstu right=%any zato sam i stavio %any

Kod ipsec.secrets nisam siguran sta da stavim , da stavim svoj localni IP ili IP od routera 192.168.2.1 ?? U svakom slucaju kod komande ipsec status dobivam ovo :

IPsec running - pluto pid: 12529
pluto pid 12529
No tunnels up

Po mome zakljucku reko bi da neradi ili se varam . Mozda je potrebno jos nesto i na iptables configurirati ? Ako je netko napravio iskustvo na tome ili ima neko rijesenje nek se slobodno javi ili vidi gore u navedenom configu nekakvu gresku . Svaki novi prijedlog ili rijesenje moga problema dobivam jednu sjedu manje i jedan dan zivota duze .

Hvala unaprijed i stretan Uskrs

LP b4sh

[b4sh]

Izgleda da cu dobiti jos koju sjedu

[glaskoncILLa]

passworde u fileovima si zamijenio ili je ovo tocna konfiguracija onoga u fileovima?
jer ako je, fale ti password/psk..

a uvijek mozes i startati klijent sa debugom, pa ce nam svima biti jasnije u kom dijelu stvar pukne..

[b4sh]

sve sam pregledo negdje drugdje lezi zec

Kod: Označi sve

#  ipsec auto --add L2TP-PSK-CLIENT
ignoring invalid defaultnexthop: illegal (non-DNS-name) character in name

Kod: Označi sve

#  ipsec auto --up L2TP-PSK-CLIENT
029 "L2TP-PSK-CLIENT": cannot initiate connection without knowing peer IP address (kind=CK_TEMPLATE)

Aj sad budi pametan

ipsec verify pokazuje da je sve ok ali ona dva gore tu sam malo zbunjen ili je bug ili nesto drugo sto nije sa ove planete

Kod: Označi sve

# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.37-g955aaafb-dirty/K2.6.37 (klips)
Checking for IPsec support in kernel                            [OK]
 KLIPS: checking for NAT Traversal support                      [OK]
 KLIPS: checking for OCF crypto offload support                 [N/A]
 SAref kernel support                                           [N/A]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [OK]
Two or more interfaces found, checking IP forwarding            [OK]
Checking NAT and MASQUERADEing                                  [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [WARNING]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]

idemo dalje za iste pare ....... bit ce sjedih

[glaskoncILLa]

daj grep defaultroutenexthop /usr/lib/ipsec/auto

[b4sh]

Danas sam par stvari u configu izmjenio kao npr. left=%defaultroute umjesto %defaultroute stavio sam moj IP i tako isto right=%any %any sa IP od firme u svakom slucaju se nesto desava ali ne u potpunosti jos nesto nestima .

Kod: Označi sve

#/etc/init.d/ipsec restart
ipsec_setup: Stopping Openswan IPsec...
ipsec_setup: Starting Openswan IPsec 2.6.37-g955aaafb-dirty...
ipsec_setup: ipsec0 -> NULL mtu=0(0) -> 0

#/etc/init.d/xl2tpd restart
Restarting xl2tpd: xl2tpd.

#ipsec auto --add L2TP-PSK

#ipsec auto --up L2TP-PSK
104 "L2TP-PSK" #1: STATE_MAIN_I1: initiate
003 "L2TP-PSK" #1: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000008]
003 "L2TP-PSK" #1: received Vendor ID payload [RFC 3947] method set to=109 
003 "L2TP-PSK" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 109
003 "L2TP-PSK" #1: ignoring Vendor ID payload [FRAGMENTATION]
003 "L2TP-PSK" #1: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
003 "L2TP-PSK" #1: ignoring Vendor ID payload [IKE CGA version 1]
106 "L2TP-PSK" #1: STATE_MAIN_I2: sent MI2, expecting MR2
003 "L2TP-PSK" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): i am NATed
108 "L2TP-PSK" #1: STATE_MAIN_I3: sent MI3, expecting MR3
003 "L2TP-PSK" #1: discarding duplicate packet; already STATE_MAIN_I3
010 "L2TP-PSK" #1: STATE_MAIN_I3: retransmission; will wait 20s for response
003 "L2TP-PSK" #1: discarding duplicate packet; already STATE_MAIN_I3
010 "L2TP-PSK" #1: STATE_MAIN_I3: retransmission; will wait 40s for response
003 "L2TP-PSK" #1: discarding duplicate packet; already STATE_MAIN_I3
031 "L2TP-PSK" #1: max number of retransmissions (2) reached STATE_MAIN_I3.  Possible authentication failure: no acceptable response to our first encrypted message
000 "L2TP-PSK" #1: starting keying attempt 2 of at most 3, but releasing whack

Izgleda da je to veci problem sa tim IPSec i L2TP na linuxu a google je pun u vezi toga svi nekako na pola puta i jesu nasli rjesenje i nisu nasli pa ti sad budi pametan . Neznam ni sam koliko sam vec config izmjenio presto sam brojati .

LP b4sh