[Openswan Users] How to configure nat_traversal in /etc/ipsec.conf

[t***@gmx.de]

Hello,

I try to connect my iPhone through a vpn (IPsec/L2TP) tunnel


1.) within the mobile Internet and
2) within my Wlan.

The network structure looks like this:

LAN (192.168.0.X)
|
iPhone (192.168.4.3) --- Wlan --- Router/Firewall (192.168.4.254) ---
Internet (dynamic IP) --- iPhone (dynamic IP)
| | | |
+----- VPN2 (ipsec/l2tp)
--------------+ +--- VPN1 (ipsec/l2tp)
-----------------------------+

If I use nat_traversal=yes VPN1 runs, but VPN2 does not work.

If I use nat_traversal=no VPN1 does not work, but VPN2 runs.

How can I configure opsenswan, that VPN1 and VPN2 are running?

----> /etc/ipsec.conf
version 2.0 # conforms to second version of ipsec.conf specification
config setup
nat_traversal=yes
nhelpers=0
oe=off
protostack=netkey

# Add connections here

conn L2TP-PSK # VPN1
authby=secret
pfs=no
rekey=no
keyingtries=3
left=%defaultroute
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
rightsubnetwithin=0.0.0.0/0
auto=add

conn L2TP-PSK-WLAN # VPN2
authby=secret
pfs=no
rekey=no
keyingtries=3
left=192.168.4.254
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
rightsubnetwithin=0.0.0.0/0
auto=add

---> /etc/ipsec.secret
include /var/lib/openswan/ipsec.secrets.inc
(ppp0) XX.XX.XX.XX %any: PSK "secret1"
(wlan) 192.168.4.254 %any: PSK "secret2"


---> /var/log/auth.log with nat_traversal=yes + try to connect VPN2:

Jan 6 20:42:55 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
responding to Main Mode from unknown peer 192.168.4.3
Jan 6 20:42:55 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Jan 6 20:42:55 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
STATE_MAIN_R1: sent MR1, expecting MI2
Jan 6 20:42:55 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): no NAT
detected
Jan 6 20:42:55 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Jan 6 20:42:55 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
STATE_MAIN_R2: sent MR2, expecting MI3
Jan 6 20:42:55 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000
Jan 6 20:42:55 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
Main mode peer ID is ID_IPV4_ADDR: '192.168.4.3'
Jan 6 20:42:55 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Jan 6 20:42:55 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
new NAT mapping for #12, was 192.168.4.3:500, now 192.168.4.3:4500
Jan 6 20:42:55 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
STATE_MAIN_R3: sent MR3, ISAKMP SA established
{auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}
Jan 6 20:42:56 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
the peer proposed: 192.168.4.254/32:17/1701 -> 192.168.4.3/32:17/0
Jan 6 20:42:56 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #13:
ENCAPSULATION_MODE_UDP_TRANSPORT_RFC must only be used if NAT-Traversal
is detected
Jan 6 20:42:56 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #13:
sending encrypted notification BAD_PROPOSAL_SYNTAX to 192.168.4.3:4500
Jan 6 20:42:59 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
the peer proposed: 192.168.4.254/32:17/1701 -> 192.168.4.3/32:17/52511
...
Jan 6 20:43:23 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #22:
ENCAPSULATION_MODE_UDP_TRANSPORT_RFC must only be used if NAT-Traversal
is detected
Jan 6 20:43:23 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #22:
sending encrypted notification BAD_PROPOSAL_SYNTAX to 192.168.4.3:4500
Jan 6 20:43:26 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3 #12:
received Delete SA payload: deleting ISAKMP State #12
Jan 6 20:43:26 micky pluto[7159]: "L2TP-PSK-WLAN"[2] 192.168.4.3:
deleting connection "L2TP-PSK-WLAN" instance with peer 192.168.4.3
{isakmp=#0/ipsec=#0}
Jan 6 20:43:26 micky pluto[7159]: packet from 192.168.4.3:4500:
received and ignored informational message


-----> /etc/ipsec.conf:

# /etc/ipsec.conf - Openswan IPsec configuration file
version 2.0 # conforms to second version of ipsec.conf specification

# basic configuration
config setup
# plutodebug / klipsdebug = "all", "none" or a combation from
below:
# "raw crypt parsing emitting control klips pfkey natt x509
private"
# eg: plutodebug="control parsing"
#
# ONLY enable plutodebug=all or klipsdebug=all if you are a
developer !!
#
# NAT-TRAVERSAL support, see README.NAT-Traversal
nat_traversal=yes
#
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
#
# enable this if you see "failed to find any available worker"
nhelpers=0
oe=off
protostack=netkey

# Add connections here

conn L2TP-PSK
authby=secret
pfs=no
rekey=no
keyingtries=3
left=%defaultroute
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
rightsubnetwithin=0.0.0.0/0
auto=add
# sample VPN connections, see /etc/ipsec.d/examples/


#Disable Opportunistic Encryption
# include /etc/ipsec.d/examples/no_oe.conf

conn L2TP-PSK-WLAN
authby=secret
pfs=no
rekey=no
keyingtries=3
left=192.168.4.254
# leftnexthop=%defaultroute
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
rightsubnetwithin=0.0.0.0/0
auto=add
# sample VPN connections, see /etc/ipsec.d/examples/


#Disable Opportunistic Encryption
# include /etc/ipsec.d/examples/no_oe.conf

[t***@gmx.de]

Am 06.01.2013 21:28, schrieb ***@gmx.de:

Nobody has an idea or a tip for me?

Thank you!

Tony

[Bart Smink]

Hi Tony,

I'm not an expert on Openswan, but I do have experience with it. I have
enabled nat_traversal always, and it has never caused me problems. Your
problem seems to occur when you dont have it enabled.

OSX used to have a bug with public ip connections, where it told Openswan
that it was NAT-ed even when this was not true. This can be solved by using
some settings in ipsec.conf.

You need
dpddelay=10
dpdtimeout=90
dpdaction=clear
for the Iphone to work.

I also have this:
ikelifetime=8h
keylife=1h

But I dont know if it is required.

You need this for l2tp tunneling
type=tunnel
compress=no
disablearrivalcheck=no

Not sure about the last two, but I have them enabled.

for l2tp you need:
rightprotoport=17/%any
rightsubnet=vhost:%priv,%no
forceencaps=yes

forceencaps is required for IOS, to fix the false statement of the IOS/OSX
client saying that it is NAT-ed. Indeed this is also the case with OSX.

I hope this helps, but do notice that IPsec tunneling is not always easy.

Greetings,

Bart Smink

Post by t***@gmx.de
Nobody has an idea or a tip for me?
Thank you!
Tony
______________________________**_________________
https://lists.openswan.org/**mailman/listinfo/users<https://lists.openswan.org/mailman/listinfo/users>
Micropayments: https://flattr.com/thing/**38387/IPsec-for-Linux-made-**
easy <https://flattr.com/thing/38387/IPsec-for-Linux-made-easy>
http://www.amazon.com/gp/**product/1904811256/104-**
3099591-2946327?n=283155<http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155>

--
**** DISCLAIMER ****

"This e-mail and any attachment thereto may contain information which is
confidential and/or protected by intellectual property rights and are
intended for the sole use of the recipient(s) named above.
Any use of the information contained herein (including, but not limited to,
total or partial reproduction, communication or distribution in any form)
by other persons than the designated recipient(s) is prohibited.
If you have received this e-mail in error, please notify the sender either
by telephone or by e-mail and delete the material from any computer".

Thank you for your cooperation.

[t***@gmx.de]

Post by Bart Smink
I hope this helps, but do notice that IPsec tunneling is not always easy.

Hi Bart,

your tips are great. Now it works.


Tank you!


Tony