no ping "echo' on host in remote net - site to site tunnel with vti is up - nat iusse? #319

svente08 · 2021-04-13T09:42:49Z

svente08
Apr 13, 2021

Hi all,

trying to get my ipsec env runnig for more than 5 days. Ive read so many thread here and on google I'm kind of desperated.

Tunnel is working with a vti on both end. Both ipsec node are behind a NAT.

I guess its not a big thing what it missing here but for some reason I dont get it. PLEASE HELP.

Thx
Sven

ping is working from:

ipsecnode-net-A (10.254.03) to ipsecnode-net-B (10.100.0.12) (and vice versa)

10.254.0.3:/# ping 10.100.0.12
PING 10.100.0.12 (10.100.0.12) 56(84) bytes of data.
64 bytes from 10.100.0.12: icmp_seq=1 ttl=64 time=0.605 ms
64 bytes from 10.100.0.12: icmp_seq=2 ttl=64 time=0.599 ms

no ping:

host-in-net-A (10.254.0.12) to ipsecnode-net-B (10.100.0.12)

10.254.0.12:/# ping 10.100.0.12
PING 10.100.0.12 (10.100.0.12) 56(84) bytes of data.
.
.

10.254.0.3:/# :/# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether fa:16:3e:9f:28:b8 brd ff:ff:ff:ff:ff:ff
inet 10.254.0.3/24 brd 10.254.0.255 scope global dynamic ens3
valid_lft 84241sec preferred_lft 84241sec
inet6 fe80::f816:3eff:fe9f:28b8/64 scope link
valid_lft forever preferred_lft forever
3: ip_vti0@NONE: mtu 1480 qdisc noop state DOWN group default qlen 1000
link/ipip 0.0.0.0 brd 0.0.0.0
4: vti0@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1480 qdisc noqueue state UNKNOWN group default qlen 1000
link/ipip 10.254.0.3 peer 85.158.0.92
inet6 fe80::5efe:afe:3/64 scope link
valid_lft forever preferred_lft forever

ping goes trough the tunnel (same on other site) but I get no echo on host-10.254.0.12

10.254.0.3:/# ip -s tunnel show
ip_vti0: ip/ip remote any local any ttl inherit nopmtudisc key 0
RX: Packets Bytes Errors CsumErrs OutOfSeq Mcasts
0 0 0 0 0 0
TX: Packets Bytes Errors DeadLoop NoRoute NoBufs
0 0 0 0 0 0
vti0: ip/ip remote 85.158.0.92 local 10.254.0.3 ttl inherit key 32
RX: Packets Bytes Errors CsumErrs OutOfSeq Mcasts
20 1680 0 0 0 0
TX: Packets Bytes Errors DeadLoop NoRoute NoBufs
20 1680 0 0 0 0

10.254.0.3:/# cat strongswan.conf (same on other site)

charon {
load_modular = yes
install_routes = 0
plugins {
include strongswan.d/charon/*.conf
}
}

10.254.0.3:/# ip -s xfrm state
src 10.254.0.3 dst 85.158.0.92
proto esp spi 0xc4027043(3288494147) reqid 2(0x00000002) mode tunnel
replay-window 0 seq 0x00000000 flag af-unspec (0x00100000)
mark 0x20/0xffffffff
auth-trunc hmac(sha256) 0x190b4e317dade988ee69a2362e7a2685470b8aa6b00831e3df22d98d91d62b6e (256 bits) 128
enc cbc(aes) 0xcd30c816f19d1f0b0ede1d333b93059dd25dd89d3d96b58f5d9eb49323d6f1f0 (256 bits)
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay context: seq 0x0, oseq 0x133, bitmap 0x00000000
lifetime config:
limit: soft (INF)(bytes), hard (INF)(bytes)
limit: soft (INF)(packets), hard (INF)(packets)
expire add: soft 27727(sec), hard 28800(sec)
expire use: soft 0(sec), hard 0(sec)
lifetime current:
25788(bytes), 307(packets)
add 2021-04-13 09:27:32 use 2021-04-13 09:27:32
stats:
replay-window 0 replay 0 failed 0
src 85.158.0.92 dst 10.254.0.3
proto esp spi 0xc6d3ea29(3335776809) reqid 2(0x00000002) mode tunnel
replay-window 32 seq 0x00000000 flag af-unspec (0x00100000)
auth-trunc hmac(sha256) 0x140434690477c34474a6eb07bb9919972d4283c82d04258ca7add1b914472d8a (256 bits) 128
enc cbc(aes) 0x54f357f6c6e8e2519f314063163fb81e04c3b42ed52f156cf068efd70f018fae (256 bits)
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay context: seq 0x133, oseq 0x0, bitmap 0xffffffff
lifetime config:
limit: soft (INF)(bytes), hard (INF)(bytes)
limit: soft (INF)(packets), hard (INF)(packets)
expire add: soft 28223(sec), hard 28800(sec)
expire use: soft 0(sec), hard 0(sec)
lifetime current:
25788(bytes), 307(packets)
add 2021-04-13 09:27:32 use 2021-04-13 09:27:32
stats:
replay-window 0 replay 0 failed 0

10.254.0.3:/# iptables-save

*filter
:INPUT DROP [4:1456]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [3:252]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
:ufw-logging-allow - [0:0]
:ufw-logging-deny - [0:0]
:ufw-not-local - [0:0]
:ufw-reject-forward - [0:0]
:ufw-reject-input - [0:0]
:ufw-reject-output - [0:0]
:ufw-skip-to-policy-forward - [0:0]
:ufw-skip-to-policy-input - [0:0]
:ufw-skip-to-policy-output - [0:0]
:ufw-track-forward - [0:0]
:ufw-track-input - [0:0]
:ufw-track-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-user-input - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-output - [0:0]
-A INPUT -j ufw-before-logging-input
-A INPUT -j ufw-before-input
-A INPUT -j ufw-after-input
-A INPUT -j ufw-after-logging-input
-A INPUT -j ufw-reject-input
-A INPUT -j ufw-track-input
-A FORWARD -j ufw-before-logging-forward
-A FORWARD -j ufw-before-forward
-A FORWARD -j ufw-after-forward
-A FORWARD -j ufw-after-logging-forward
-A FORWARD -j ufw-reject-forward
-A FORWARD -j ufw-track-forward
-A OUTPUT -j ufw-before-logging-output
-A OUTPUT -j ufw-before-output
-A OUTPUT -j ufw-after-output
-A OUTPUT -j ufw-after-logging-output
-A OUTPUT -j ufw-reject-output
-A OUTPUT -j ufw-track-output
-A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
-A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-forward -j ufw-user-forward
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
-A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A ufw-before-input -j ufw-not-local
-A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
-A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
-A ufw-before-input -j ufw-user-input
-A ufw-before-output -o lo -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -j ufw-user-output
-A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
-A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
-A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
-A ufw-skip-to-policy-forward -j DROP
-A ufw-skip-to-policy-input -j DROP
-A ufw-skip-to-policy-output -j ACCEPT
-A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
-A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
-A ufw-user-limit-accept -j ACCEPT
COMMIT

Answered by svente08

Apr 14, 2021

Config seems to be ok? Will look into audit log with provider.

Ping goes its way but I get no echo on host 10.254.0.11.

10.254.0.11:/# ping 10.100.0.12
PING 10.100.0.12 (10.100.0.12) 56(84) bytes of data.

10.254.0.3:/# tcpdump icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vti0, link-type RAW (Raw IP), capture size 262144 bytes
07:10:25.406741 IP 10.254.0.11 > 10.100.0.12: ICMP echo request, id 12, seq 1, length 64
07:10:25.409683 IP 10.100.0.12 > 10.254.0.11: ICMP echo reply, id 12, seq 1, length 64

View full answer

Thermi · 2021-04-13T21:01:44Z

Thermi
Apr 13, 2021

Please pastebin the output of iptables-save -c, and also make sure the hosts in either network have the right route to the corresponding remote network (meaning the route over the local VPN peer).

EDIT:

Also please pastebin the output of swanctl -l, swanctl -L´, and your complete swanctl/ipsec config. Also the outputs of ip route show table allandip rule`.

Also make sure forwarding is locally enabled and for the interfaces involved (sysctl net.ipv4.ip_forward=1 net.ipv4.conf.vti0.forwarding=1 net.ipv4.conf.ens3.forwarding=1).
Are these VMs running on a hypervisor?

0 replies

svente08 · 2021-04-14T06:24:51Z

svente08
Apr 14, 2021
Author

Hi Thermi,

Many thx for looking into it!!!!

all Instance are located on an openstack at a German hosting provider. I don't understand the issue at all and I'm not doing it for the first time. I also thought of a problem in the provider's backend. But I dont have any approach.

Here you go:

10.254.0.3:/# iptables-save -c

*filter
:INPUT DROP [5:1476]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [8:672]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
:ufw-logging-allow - [0:0]
:ufw-logging-deny - [0:0]
:ufw-not-local - [0:0]
:ufw-reject-forward - [0:0]
:ufw-reject-input - [0:0]
:ufw-reject-output - [0:0]
:ufw-skip-to-policy-forward - [0:0]
:ufw-skip-to-policy-input - [0:0]
:ufw-skip-to-policy-output - [0:0]
:ufw-track-forward - [0:0]
:ufw-track-input - [0:0]
:ufw-track-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-user-input - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-output - [0:0]
[14447:38319219] -A INPUT -j ufw-before-logging-input
[14447:38319219] -A INPUT -j ufw-before-input
[5:1476] -A INPUT -j ufw-after-input
[5:1476] -A INPUT -j ufw-after-logging-input
[5:1476] -A INPUT -j ufw-reject-input
[5:1476] -A INPUT -j ufw-track-input
[250:21000] -A FORWARD -j ufw-before-logging-forward
[250:21000] -A FORWARD -j ufw-before-forward
[0:0] -A FORWARD -j ufw-after-forward
[0:0] -A FORWARD -j ufw-after-logging-forward
[0:0] -A FORWARD -j ufw-reject-forward
[0:0] -A FORWARD -j ufw-track-forward
[5064:427068] -A OUTPUT -j ufw-before-logging-output
[5064:427068] -A OUTPUT -j ufw-before-output
[64:7428] -A OUTPUT -j ufw-after-output
[64:7428] -A OUTPUT -j ufw-after-logging-output
[64:7428] -A OUTPUT -j ufw-reject-output
[64:7428] -A OUTPUT -j ufw-track-output
[0:0] -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
[0:0] -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
[5:1476] -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
[247:20748] -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
[0:0] -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
[0:0] -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
[3:252] -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
[0:0] -A ufw-before-forward -j ufw-user-forward
[304:24156] -A ufw-before-input -i lo -j ACCEPT
[14126:38292895] -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
[0:0] -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
[0:0] -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
[0:0] -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
[0:0] -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
[0:0] -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
[0:0] -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
[17:2168] -A ufw-before-input -j ufw-not-local
[0:0] -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
[0:0] -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
[17:2168] -A ufw-before-input -j ufw-user-input
[304:24156] -A ufw-before-output -o lo -j ACCEPT
[4696:395484] -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[64:7428] -A ufw-before-output -j ufw-user-output
[0:0] -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
[0:0] -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
[0:0] -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
[17:2168] -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
[0:0] -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
[0:0] -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
[0:0] -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
[0:0] -A ufw-not-local -j DROP
[0:0] -A ufw-skip-to-policy-forward -j DROP
[0:0] -A ufw-skip-to-policy-input -j DROP
[0:0] -A ufw-skip-to-policy-output -j ACCEPT
[7:420] -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
[49:6336] -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
[12:692] -A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
[0:0] -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
[0:0] -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
[0:0] -A ufw-user-limit-accept -j ACCEPT
COMMIT

10.100.0.12:/# iptables-save -c

*filter
:INPUT DROP [5:1820]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
:ufw-logging-allow - [0:0]
:ufw-logging-deny - [0:0]
:ufw-not-local - [0:0]
:ufw-reject-forward - [0:0]
:ufw-reject-input - [0:0]
:ufw-reject-output - [0:0]
:ufw-skip-to-policy-forward - [0:0]
:ufw-skip-to-policy-input - [0:0]
:ufw-skip-to-policy-output - [0:0]
:ufw-track-forward - [0:0]
:ufw-track-input - [0:0]
:ufw-track-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-user-input - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-output - [0:0]
[2633:321726] -A INPUT -j ufw-before-logging-input
[2633:321726] -A INPUT -j ufw-before-input
[5:1820] -A INPUT -j ufw-after-input
[5:1820] -A INPUT -j ufw-after-logging-input
[5:1820] -A INPUT -j ufw-reject-input
[5:1820] -A INPUT -j ufw-track-input
[0:0] -A FORWARD -j ufw-before-logging-forward
[0:0] -A FORWARD -j ufw-before-forward
[0:0] -A FORWARD -j ufw-after-forward
[0:0] -A FORWARD -j ufw-after-logging-forward
[0:0] -A FORWARD -j ufw-reject-forward
[0:0] -A FORWARD -j ufw-track-forward
[2543:406765] -A OUTPUT -j ufw-before-logging-output
[2543:406765] -A OUTPUT -j ufw-before-output
[37:3676] -A OUTPUT -j ufw-after-output
[37:3676] -A OUTPUT -j ufw-after-logging-output
[37:3676] -A OUTPUT -j ufw-reject-output
[37:3676] -A OUTPUT -j ufw-track-output
[0:0] -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
[0:0] -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
[0:0] -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
[5:1820] -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
[0:0] -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
[0:0] -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
[0:0] -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
[0:0] -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
[0:0] -A ufw-before-forward -j ufw-user-forward
[292:22708] -A ufw-before-input -i lo -j ACCEPT
[2210:290518] -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
[0:0] -A ufw-before-input -m conntrack --ctstate INVALID -j DROP
[0:0] -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
[0:0] -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
[0:0] -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
[2:168] -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
[0:0] -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
[129:8332] -A ufw-before-input -j ufw-not-local
[0:0] -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
[0:0] -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
[129:8332] -A ufw-before-input -j ufw-user-input
[292:22708] -A ufw-before-output -o lo -j ACCEPT
[2214:380381] -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[37:3676] -A ufw-before-output -j ufw-user-output
[0:0] -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
[0:0] -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
[0:0] -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
[129:8332] -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
[0:0] -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
[0:0] -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
[0:0] -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
[0:0] -A ufw-not-local -j DROP
[0:0] -A ufw-skip-to-policy-forward -j DROP
[0:0] -A ufw-skip-to-policy-input -j DROP
[0:0] -A ufw-skip-to-policy-output -j ACCEPT
[0:0] -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
[37:3676] -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
[124:6512] -A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
[0:0] -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
[0:0] -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
[0:0] -A ufw-user-limit-accept -j ACCEPT
COMMIT

10.254.0.3:/# sysctl -p
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.vti0.disable_policy = 1
net.ipv4.conf.vti0.forwarding = 1
net.ipv4.conf.ens3.forwarding = 1

10.100.0.12:/# sysctl -p
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.vti0.disable_policy = 1
net.ipv4.conf.vti0.forwarding = 1
net.ipv4.conf.ens3.forwarding = 1

10.254.0.3:/# ip route show table all
default via 10.254.0.1 dev ens3 proto dhcp src 10.254.0.3 metric 100
10.100.0.0/24 dev vti0 scope link
10.254.0.0/24 dev ens3 proto kernel scope link src 10.254.0.3
169.254.169.254 via 10.254.0.2 dev ens3 proto dhcp src 10.254.0.3 metric 100
broadcast 10.254.0.0 dev ens3 table local proto kernel scope link src 10.254.0.3
local 10.254.0.3 dev ens3 table local proto kernel scope host src 10.254.0.3
broadcast 10.254.0.255 dev ens3 table local proto kernel scope link src 10.254.0.3
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
::1 dev lo proto kernel metric 256 pref medium
fe80::/64 dev ens3 proto kernel metric 256 pref medium
fe80::/64 dev vti0 proto kernel metric 256 pref medium
local ::1 dev lo table local proto kernel metric 0 pref medium
anycast fe80:: dev ens3 table local proto kernel metric 0 pref medium
anycast fe80:: dev vti0 table local proto kernel metric 0 pref medium
local fe80::5efe:afe:3 dev vti0 table local proto kernel metric 0 pref medium
local fe80::f816:3eff:fe9f:28b8 dev ens3 table local proto kernel metric 0 pref medium
multicast ff00::/8 dev ens3 table local proto kernel metric 256 pref medium
multicast ff00::/8 dev vti0 table local proto kernel metric 256 pref medium

10.100.0.12:/# ip route show table all
default via 10.100.0.1 dev ens3 proto dhcp src 10.100.0.12 metric 100
10.100.0.0/24 dev ens3 proto kernel scope link src 10.100.0.12
10.254.0.0/24 dev vti0 scope link
169.254.169.254 via 10.100.0.2 dev ens3 proto dhcp src 10.100.0.12 metric 100
broadcast 10.100.0.0 dev ens3 table local proto kernel scope link src 10.100.0.12
local 10.100.0.12 dev ens3 table local proto kernel scope host src 10.100.0.12
broadcast 10.100.0.255 dev ens3 table local proto kernel scope link src 10.100.0.12
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
::1 dev lo proto kernel metric 256 pref medium
fe80::/64 dev ens3 proto kernel metric 256 pref medium
fe80::/64 dev vti0 proto kernel metric 256 pref medium
local ::1 dev lo table local proto kernel metric 0 pref medium
anycast fe80:: dev ens3 table local proto kernel metric 0 pref medium
anycast fe80:: dev vti0 table local proto kernel metric 0 pref medium
local fe80::5efe:a64:c dev vti0 table local proto kernel metric 0 pref medium
local fe80::f816:3eff:fedc:85fb dev ens3 table local proto kernel metric 0 pref medium
multicast ff00::/8 dev ens3 table local proto kernel metric 256 pref medium
multicast ff00::/8 dev vti0 table local proto kernel metric 256 pref medium

10.254.0.3:/# ip rule
0: from all lookup local
220: from all lookup 220
32766: from all lookup main
32767: from all lookup default

10.100.0.12:/# ip rule
0: from all lookup local
220: from all lookup 220
32766: from all lookup main
32767: from all lookup default

10.254.0.3:/# cat ipsec.conf

config setup
charondebug="all"
uniqueids=yes
strictcrlpolicy=no

conn xxxx-to-kunde100
authby=secret
left=%defaultroute
leftid=85.158.0.93
leftsubnet=10.254.0.0/24
right=85.158.0.92
rightsubnet=10.100.0.0/24
ike=aes256-sha2_256-modp1024!
esp=aes256-sha2_256!
keyingtries=0
ikelifetime=1h
lifetime=8h
dpddelay=30
dpdtimeout=120
dpdaction=restart
auto=start
keyexchange=ikev2
mark=32

10.100.0.12:/# cat ipsec.conf
config setup
charondebug="all"
uniqueids=yes
strictcrlpolicy=no

conn kunde100-to-xxxx
authby=secret
left=%defaultroute
leftid=85.158.0.92
leftsubnet=10.100.0.0/24
right=85.158.0.93
rightsubnet=10.254.0.0/24
ike=aes256-sha2_256-modp1024!
esp=aes256-sha2_256!
keyingtries=0
ikelifetime=1h
lifetime=8h
dpddelay=30
dpdtimeout=120
dpdaction=restart
keyexchange=ikev2
auto=start
mark=32

10.254.0.3:/# ipsec statusall
Status of IKE charon daemon (strongSwan 5.8.2, Linux 5.4.0-70-generic, x86_64):
uptime: 11 seconds, since Apr 14 06:03:38 2021
malloc: sbrk 2297856, mmap 0, used 621952, free 1675904
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 7
loaded plugins: charon aesni aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm drbg attr kernel-netlink resolve socket-default stroke vici updown eap-mschapv2 xauth-generic counters
Listening IP addresses:
10.254.0.3
Connections:
xxxx-to-kunde100: %any...85.158.0.92 IKEv2, dpddelay=30s
xxxx-to-kunde100: local: [85.158.0.93] uses pre-shared key authentication
xxxx-to-kunde100: remote: [85.158.0.92] uses pre-shared key authentication
xxxx-to-kunde100: child: 10.254.0.0/24 === 10.100.0.0/24 TUNNEL, dpdaction=restart
Security Associations (1 up, 1 connecting):
(unnamed)[2]: CONNECTING, 10.254.0.3[%any]...85.158.0.92[%any]
(unnamed)[2]: IKEv2 SPIs: c7492c968d7082ad_i 84512fe25f4e2622_r*
(unnamed)[2]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
(unnamed)[2]: Tasks passive: IKE_CERT_PRE IKE_AUTH IKE_CERT_POST IKE_CONFIG CHILD_CREATE IKE_AUTH_LIFETIME IKE_MOBIKE
xxxx-to-kunde100[1]: ESTABLISHED 11 seconds ago, 10.254.0.3[85.158.0.93]...85.158.0.92[85.158.0.92]
xxxx-to-kunde100[1]: IKEv2 SPIs: 399985629922766a_i* e9d0ba6c76d81d60_r, pre-shared key reauthentication in 38 minutes
xxxx-to-kunde100[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
xxxx-to-kunde100{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c70f37aa_i c9009b28_o
xxxx-to-kunde100{1}: AES_CBC_256/HMAC_SHA2_256_128, 252 bytes_i (3 pkts, 6s ago), 252 bytes_o (3 pkts, 6s ago), rekeying in 7 hours
xxxx-to-kunde100{1}: 10.254.0.0/24 === 10.100.0.0/24

10.100.0.12:/# ipsec statusall
Status of IKE charon daemon (strongSwan 5.8.2, Linux 5.4.0-70-generic, x86_64):
uptime: 13 minutes, since Apr 14 06:03:34 2021
malloc: sbrk 2703360, mmap 0, used 854240, free 1849120
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 8
loaded plugins: charon aesni aes rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm drbg attr kernel-netlink resolve socket-default stroke vici updown eap-mschapv2 xauth-generic counters
Listening IP addresses:
10.100.0.12
Connections:
kunde100-to-xxxx: %any...85.158.0.93 IKEv2, dpddelay=30s
kunde100-to-xxxx: local: [85.158.0.92] uses pre-shared key authentication
kunde100-to-xxxx: remote: [85.158.0.93] uses pre-shared key authentication
kunde100-to-xxxx: child: 10.100.0.0/24 === 10.254.0.0/24 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 connecting):
kunde100-to-xxxx[2]: ESTABLISHED 13 minutes ago, 10.100.0.12[85.158.0.92]...85.158.0.93[85.158.0.93]
kunde100-to-xxxx[2]: IKEv2 SPIs: 399985629922766a_i e9d0ba6c76d81d60_r*, pre-shared key reauthentication in 34 minutes
kunde100-to-xxxx[2]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
kunde100-to-xxxx{2}: INSTALLED, TUNNEL, reqid 2, ESP in UDP SPIs: c9009b28_i c70f37aa_o
kunde100-to-xxxx{2}: AES_CBC_256/HMAC_SHA2_256_128, 252 bytes_i (3 pkts, 784s ago), 252 bytes_o (3 pkts, 784s ago), rekeying in 7 hours
kunde100-to-xxxx{2}: 10.100.0.0/24 === 10.254.0.0/24

10.254.0.3:/# swanctl -l
(unnamed): #5, CONNECTING, IKEv2, 24d0920932ef4f57_i a363b906821c77cf_r*
local '%any' @ 10.254.0.3[500]
remote '%any' @ 85.158.0.92[500]
AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
passive: IKE_CERT_PRE IKE_AUTH IKE_CERT_POST IKE_CONFIG CHILD_CREATE IKE_AUTH_LIFETIME IKE_MOBIKE
xxxx-to-kunde100: #1, ESTABLISHED, IKEv2, 399985629922766a_i* e9d0ba6c76d81d60_r
local '85.158.0.93' @ 10.254.0.3[4500]
remote '85.158.0.92' @ 85.158.0.92[4500]
AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
established 115s ago, reauth in 2188s
xxxx-to-kunde100: #1, reqid 1, INSTALLED, TUNNEL-in-UDP, ESP:AES_CBC-256/HMAC_SHA2_256_128
installed 115s ago, rekeying in 27610s, expires in 28685s
in c70f37aa (0x00000020), 252 bytes, 3 packets, 110s ago
out c9009b28 (0x00000020), 252 bytes, 3 packets, 110s ago
local 10.254.0.0/24
remote 10.100.0.0/24

10.254.0.3:/# swanctl -L
xxxx-to-kunde100: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 30s
local: %any
remote: 85.158.0.92
local pre-shared key authentication:
id: 85.158.0.93
remote pre-shared key authentication:
id: 85.158.0.92
xxxx-to-kunde100: TUNNEL, rekeying every 28260s, dpd action is restart
local: 10.254.0.0/24
remote: 10.100.0.0/24

These 3 packets are test ping from host 10.254.0.11 to ipsec host 10.100.0.12

10.100.0.12:/# swanctl -l
(unnamed): #5, CONNECTING, IKEv2, 7eaa413595ff4615_i 8812db6de18af004_r*
local '%any' @ 10.100.0.12[500]
remote '%any' @ 85.158.0.93[500]
AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
passive: IKE_CERT_PRE IKE_AUTH IKE_CERT_POST IKE_CONFIG CHILD_CREATE IKE_AUTH_LIFETIME IKE_MOBIKE
kunde100-to-xxxx: #2, ESTABLISHED, IKEv2, 399985629922766a_i e9d0ba6c76d81d60_r*
local '85.158.0.92' @ 10.100.0.12[4500]
remote '85.158.0.93' @ 85.158.0.93[4500]
AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
established 157s ago, reauth in 2686s
kunde100-to-xxxx: #2, reqid 2, INSTALLED, TUNNEL-in-UDP, ESP:AES_CBC-256/HMAC_SHA2_256_128
installed 157s ago, rekeying in 27639s, expires in 28643s
in c9009b28 (0x00000020), 252 bytes, 3 packets, 153s ago
out c70f37aa (0x00000020), 252 bytes, 3 packets, 153s ago
local 10.100.0.0/24
remote 10.254.0.0/24

10.100.0.12:/# swanctl -L
kunde100-to-xxxx: IKEv2, reauthentication every 3060s, no rekeying, dpd delay 30s
local: %any
remote: 85.158.0.93
local pre-shared key authentication:
id: 85.158.0.92
remote pre-shared key authentication:
id: 85.158.0.93
kunde100-to-xxxx: TUNNEL, rekeying every 28260s, dpd action is restart
local: 10.100.0.0/24
remote: 10.254.0.0/24

1 reply

Thermi Apr 14, 2021

Hi, okay. While pinging, please run tcpdump on the ethernet interface and check for icmp packets.

The problem with hypervisors is not that they are faulty or anything, but by default they ususally only permit outgoing packets with the source IP being the one assigned to the host, but not any other.
See the wiki on cloud platforms: https://wiki.strongswan.org/projects/strongswan/wiki/Cloudplatforms
Please review any audit logs regarding network events on the hypervisor. It might log packets that it drops. Other than that, log packets on the endpoint and check if they actually make it there.

svente08 · 2021-04-14T07:15:04Z

svente08
Apr 14, 2021
Author

Config seems to be ok? Will look into audit log with provider.

Ping goes its way but I get no echo on host 10.254.0.11.

10.254.0.11:/# ping 10.100.0.12
PING 10.100.0.12 (10.100.0.12) 56(84) bytes of data.

10.254.0.3:/# tcpdump icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vti0, link-type RAW (Raw IP), capture size 262144 bytes
07:10:25.406741 IP 10.254.0.11 > 10.100.0.12: ICMP echo request, id 12, seq 1, length 64
07:10:25.409683 IP 10.100.0.12 > 10.254.0.11: ICMP echo reply, id 12, seq 1, length 64

9 replies

Thermi Apr 14, 2021

Haven't worked on something running openstack, sorry. Other than googling, I can't help you any further.
If you have to stay at that provider with openstack, you could try using some type of overlay network that encapsulates the packets. Preferably obviously something that is easy to set up, preferably fully automatic.

svente08 Apr 14, 2021
Author

You got got me wrong. I dont want/need further help from you you helped me so much!!! Many thanks for that.

Just wanted to know if you had similar issues in past and the provider made some changes on thier backend. But anyway l get in touch with them.

Cheers
Svente

Thermi Apr 14, 2021

Alright. Good effort.

svente08 Apr 14, 2021
Author

For those who have same issue:

According to cloud provider this should make it happen:

openstack port set --allowed-address ip-address=192.168.0.0/24 'port'

Let you know.

svente08 Apr 14, 2021
Author

It works now.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

no ping "echo' on host in remote net - site to site tunnel with vti is up - nat iusse? #319

{{title}}

Replies: 3 comments 10 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

no ping "echo' on host in remote net - site to site tunnel with vti is up - nat iusse? #319

svente08 Apr 13, 2021

Replies: 3 comments · 10 replies

Thermi Apr 13, 2021

svente08 Apr 14, 2021 Author

Thermi Apr 14, 2021

svente08 Apr 14, 2021 Author

Thermi Apr 14, 2021

svente08 Apr 14, 2021 Author

Thermi Apr 14, 2021

svente08 Apr 14, 2021 Author

svente08 Apr 14, 2021 Author

svente08
Apr 13, 2021

Replies: 3 comments 10 replies

Thermi
Apr 13, 2021

svente08
Apr 14, 2021
Author

svente08
Apr 14, 2021
Author

svente08 Apr 14, 2021
Author

svente08 Apr 14, 2021
Author

svente08 Apr 14, 2021
Author