[Shorewall-users] IPSEC tunnel up, but no traffic coming through

[Wouter Amsterdam]

Hi all,



I finally got my IPSec tunnel from my Fedora firewall system (running
Shorewall 4.0.6) to a remote Draytek Router up-and-running, but I'm having

[Tom Eastep]

Post by Wouter Amsterdam
I finally got my IPSec tunnel from my Fedora firewall system (running
Shorewall 4.0.6) to a remote Draytek Router up-and-running, but I'm

[Wouter Amsterdam]

Tom,

First of all: thanks for your swift reply earlier. I tried uploading the real dumpfile some time ago, but forgot to zip it. After a some time away from the office I now try again.
I think I changed my config files according to http://www.shorewall.net/IPSEC-2.6.html, but still nothing. I checked and double-checked my racoon.conf and setkey.conf files, but maybe by now I have changed these files so often I'm overlooking a crucial detail? This time I did create the shorewall dump file (attached) and took some time analyzing it. In the 10th line of the Conntrack Table there seems to be some sort of communication between my firewall's external IP and an internal IP at the remote site (vpn21) which is [UNREPLIED]. Does this mean traffic is going into the tunnel to the remote site, but does not return?

TIA,
Wouter

[Tom Eastep]

Post by Wouter Amsterdam
dump file (attached) and took some time analyzing it.
In the 10th line of the Conntrack Table there seems to be some sort of
communication between my firewall's external IP and an internal IP at
the remote site (vpn21) which is [UNREPLIED]. Does this mean traffic
is going into the tunnel to the remote site, but does not return?

The support guidelines clearly state that you should clear the netfilter
counters, try the failing connection, take the dump, and explain in the
report what you tried and how it failed. All we have here is a dump and an
observation about a particular connection so I can only tell you that the
[UNREPLIED] entry is an attempt to connect from 212.115.197.253 to
192.168.21.51. There is no security policy covering that connection so the
traffic DID NOT GO THROUGH THE TUNNEL. Given that it was addressed to an RFC
1918 address, the packet was simply dropped when or before it reached the
internet core routers.

If you look down in the section of the dump titled PFKEY SPD, you will see
all of the Security Policies that you have defined. The only one with source
212.115.197.253 is from gateway to gateway. So the other gateway is the only
host that this gateway can communicate with through the tunnel.

As spelled out in the Shorewall IPSEC 2.6 documentation, it takes 8 security
policies to completely cover the combinations when connecting two local
subnets via IPSEC.

I can see no reason that zones loc6 and loc7 should not be able communicate
with the remote network. Note though that you can totally eliminate
Shorewall from the issue by doing 'shorewall clear' then trying to
communicate. If that doesn't work then your Shorewall configuration is not
the immediate cause of the problem. Be sure to 'shorewall start' after the
test since your firewall will be wide open after the 'shorewall clear'.

-Tom

[Wouter Amsterdam]

The support guidelines clearly state that you should clear the netfilter counters, try the failing connection,
take the dump, and explain in the report what you tried and how it failed.

Tom,

Thanks for your patience with me; I hope I followed the correct procedure this time.

I wish to establish a VPN connection between my local firewall (212.115.197.253 - running shorewall and racoon) which serves both LAN's 192.168.0.0/24 and 192.168.6.0/24, and a remote Draytek router (92.64.158.73 - capable of VPN tunneling) which serves 192.168.21.0/24.

After resetting shorewall counters I started racoon in foreground mode

[Tom Eastep]

Wouter Amsterdam wrote:

<absurdly-formatted post>

Please -- fix your mailer.

Each paragraph is one long line. I'm very busy right now and quoting an
email like yours take 3 times as long as one that is correctly formatted.

Thanks.

Post by Wouter Amsterdam
I wish to establish a VPN connection between my local firewall
(212.115.197.253 - running shorewall and racoon) which serves both
LAN's 192.168.0.0/24 and 192.168.6.0/24, and a remote Draytek router
(92.64.158.73 - capable of VPN tunneling) which serves 192.168.21.0/24.
After resetting shorewall counters I started racoon in foreground mode