2.2.6 - Lost LAN conection when IPSEC tunnel is conected only first time booting
-
Good morning everyone.
I have an strange issue.
Details:
LAN IP pfSense: 10.133.30.1TUNNEL IPSEC: Phase 2
Local Network LAN Subnet
Remote Network 10.0.0.0/8Advanced setting Enable bypasslan for LAN…..... checked.
When IPSEC tunnel is on, I lost ping from LAN to LAN IP (10.133.30.1), something like traffic going to 10.x.x.x. is tryning to go by IPSEC TUNNEL I think............, and not working OK the bypass for LAN option.
If I restart ipsec services, have no more problems, but have to do this manually every time after reboot.Any idea ?
Thanks in advance!!!!
-
What does the output of 'ipsec statusall' show when it's working vs. when it's not?
-
@cmb:
What does the output of 'ipsec statusall' show when it's working vs. when it's not?
@cmb thks for your reply!!!
1-
After reboot, IPSEC conected, ping from LAN SUBNET to LAN PF IP NO REPLY[root@vpn-sanmartin ~]# ipsecstats
ah packets with hmac-md5: 2522
esp input packets processed: 1149
esp output packets processed: 1373
esp packets with rijndael-cbc: 2522
esp bytes received: 328016
esp bytes transmitted: 333190no SA found 14 (output)
m_clone processing: 0 mbufs + 0 clusters coalesced
m_makespace: 1371 mbufs insertedheader position [front/middle/end]: 0/1149/0
[root@vpn-sanmartin ~]# ipsec status all
Security Associations (1 up, 0 connecting):
no match
[root@vpn-sanmartin ~]#2-
After "ipsec restart", IPSEC conected, ping from LAN SUBNET to LAN PF IP REPLY OK[root@vpn-sanmartin ~]# ipsecstats
ah packets with hmac-md5: 6604
esp input packets processed: 3145
esp output packets processed: 3459
esp packets with rijndael-cbc: 6604
esp bytes received: 1580864
esp bytes transmitted: 648373policy violations: input 38 output 0
no SA found 16 (output)
m_clone processing: 0 mbufs + 0 clusters coalesced
m_makespace: 3451 mbufs insertedheader position [front/middle/end]: 0/3145/0
[root@vpn-sanmartin ~]# ipsec status all
Security Associations (1 up, 0 connecting):
no match
[root@vpn-sanmartin ~]#I think the problem is remote NET in IPSEC phase 2 –> 10.0.0.0/8 , and LAN SUBNET is 10.133.0.0/16
Traffic is to 10.133.0.0/16 is trying to go via IPSEC tunnel, and no recognized like LAN SUBNET.But most strange is this only happen after reboot, first time. Restarting IPSEC all goes ok again.
Very strange issue.............
-
at the moment, to resolve this…........... no very nice, but confirm what I said....
made a shell script xxx.sh, in /usr/local/etc/rc.d/
"
sleep 40
ipsec stop
sleep 5
ipsec start
" -
Not really sure, but other thing to try…....
CLIENTE IPSEC
Phase 2 proposal (SA/Key Exchange) ONLY CHECK
Encryption algorithms
AES / Blowfish / 3DES / CAST128 / DESHash algorithms ONLYE CHECK
MD5 and SHA1have to try it some more days...........
-
That's 'ipsec statusall', no space in between, but that likely isn't going to be telling in this case. What does the output of "setkey -DP" show when it's not working and when it is? I'm thinking there's an ordering issue of some sort there.
-
@cmb:
That's 'ipsec statusall', no space in between, but that likely isn't going to be telling in this case. What does the output of "setkey -DP" show when it's not working and when it is? I'm thinking there's an ordering issue of some sort there.
**
ipsec statusall (ipsec conected after reboot, no LAN ping from LAN subnet)[root@vpn-gualeguaychu ~]# ipsec statusall
Status of IKE charon daemon (weakSwan 5.3.3, FreeBSD 10.1-RELEASE-p24, i386):
uptime: 3 minutes, since Mar 17 14:45:02 2016
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 3
loaded plugins: charon unbound aes des blowfish rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey ipseckey pem openssl fips-prf xcbc cmac hmac curl attr kernel-pfkey kernel-pfroute resolve socket-default stroke vici updown eap-identity eap-sim eap-md5 eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap whitelist addrblock unity
Listening IP addresses:
181.xxx.xxx.xxx
10.85.30.1
Connections:
bypasslan: %any…%any IKEv1/2
bypasslan: local: uses public key authentication
bypasslan: remote: uses public key authentication
bypasslan: child: 10.85.0.0/16|/0 === 10.85.0.0/16|/0 PASS
con1000: 181.xxx.xxx.xxx...201.xxx.xxx.xxx IKEv1 Aggressive, dpddelay=10s
con1000: local: [gualeguaychu@osprera.org.ar] uses pre-shared key authentication
con1000: remote: [201.xxx.xxx.xxx] uses pre-shared key authentication
con1000: child: 10.85.0.0/16|/0 === 10.0.0.0/8|/0 TUNNEL, dpdaction=restart
Shunted Connections:
bypasslan: 10.85.0.0/16|/0 === 10.85.0.0/16|/0 PASS
Routed Connections:
con1000{4}: ROUTED, TUNNEL, reqid 1
con1000{4}: 10.85.0.0/16|/0 === 10.0.0.0/8|/0
Security Associations (1 up, 0 connecting):
con1000[1]: ESTABLISHED 3 minutes ago, 181.xxx.xxx.xxx[gualeguaychu@osprera.org.ar]…201.xxx.xxx.xxx[201.216.208.113]
con1000[1]: IKEv1 SPIs: 51f33f634aae57e2_i* 6761851f86de30b5_r, pre-shared key reauthentication in 7 hours
con1000[1]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
con1000{2}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: cbfd4079_i 046b1ec2_o
con1000{2}: AES_CBC_256/HMAC_MD5_96, 273639 bytes_i (1235 pkts, 0s ago), 316104 bytes_o (1283 pkts, 0s ago), rekeying in 19 minutes
con1000{2}: 10.85.0.0/16|/0 === 10.0.0.0/8|/0
[root@vpn-gualeguaychu ~]#**
setkey -DP (ipsec conected after reboot, no LAN ping from LAN subnet)[root@vpn-gualeguaychu ~]# setkey -DP
10.0.0.0/8[any] 10.85.0.0/16[any] any
in ipsec
esp/tunnel/201.xxx.xxx.xxx-181.xxx.xxx.xxx/unique:1
created: Mar 17 14:45:29 2016 lastused: Mar 17 14:52:15 2016
lifetime: 2147483647(s) validtime: 0(s)
spid=6 seq=3 pid=91411
refcnt=1
10.85.0.0/16[any] 10.85.0.0/16[any] any
in none
created: Mar 17 14:45:52 2016 lastused: Mar 17 14:45:52 2016
lifetime: 2147483647(s) validtime: 0(s)
spid=10 seq=2 pid=91411
refcnt=1
10.85.0.0/16[any] 10.0.0.0/8[any] any
out ipsec
esp/tunnel/181.xxx.xxx.xxx-201.xxx.xxx.xxx/unique:1
created: Mar 17 14:45:29 2016 lastused: Mar 17 14:52:16 2016
lifetime: 2147483647(s) validtime: 0(s)
spid=5 seq=1 pid=91411
refcnt=1
10.85.0.0/16[any] 10.85.0.0/16[any] any
out none
created: Mar 17 14:45:52 2016 lastused: Mar 17 14:45:52 2016
lifetime: 2147483647(s) validtime: 0(s)
spid=9 seq=0 pid=91411
refcnt=1
[root@vpn-gualeguaychu ~]#
then, ipsec stop, ipsec start: (ipsec conected, PING ok to LAN from LAN subnet)
ipsec statusall
[root@vpn-gualeguaychu ~]# ipsec statusall
Status of IKE charon daemon (weakSwan 5.3.3, FreeBSD 10.1-RELEASE-p24, i386):
uptime: 12 seconds, since Mar 17 14:54:26 2016
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 3
loaded plugins: charon unbound aes des blowfish rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey ipseckey pem openssl fips-prf xcbc cmac hmac curl attr kernel-pfkey kernel-pfroute resolve socket-default stroke vici updown eap-identity eap-sim eap-md5 eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap whitelist addrblock unity
Listening IP addresses:
181.xxx.xxx.xxx
10.85.30.1
Connections:
bypasslan: %any…%any IKEv1/2
bypasslan: local: uses public key authentication
bypasslan: remote: uses public key authentication
bypasslan: child: 10.85.0.0/16|/0 === 10.85.0.0/16|/0 PASS
con1000: 181.xxx.xxx.xxx...201.xxx.xxx.xxx IKEv1 Aggressive, dpddelay=10s
con1000: local: [gualeguaychu@osprera.org.ar] uses pre-shared key authentication
con1000: remote: [201.xxx.xxx.xxx] uses pre-shared key authentication
con1000: child: 10.85.0.0/16|/0 === 10.0.0.0/8|/0 TUNNEL, dpdaction=restart
Shunted Connections:
bypasslan: 10.85.0.0/16|/0 === 10.85.0.0/16|/0 PASS
Routed Connections:
con1000{1}: ROUTED, TUNNEL, reqid 1
con1000{1}: 10.85.0.0/16|/0 === 10.0.0.0/8|/0
Security Associations (1 up, 0 connecting):
con1000[1]: ESTABLISHED 12 seconds ago, 181.xxx.xxx.xxx[gualeguaychu@osprera.org.ar]…201.xxx.xxx.xxx[201.216.208.113]
con1000[1]: IKEv1 SPIs: 1d1e895fe7c58369_i* 0134c120391e748b_r, pre-shared key reauthentication in 7 hours
con1000[1]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
con1000{2}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: c8dbde05_i 04d2c445_o
con1000{2}: AES_CBC_256/HMAC_MD5_96, 17097 bytes_i (124 pkts, 0s ago), 30560 bytes_o (122 pkts, 0s ago), rekeying in 22 minutes
con1000{2}: 10.85.0.0/16|/0 === 10.0.0.0/8|/0
[root@vpn-gualeguaychu ~]#**
setkey -DP[root@vpn-gualeguaychu ~]# setkey -DP
10.85.0.0/16[any] 10.85.0.0/16[any] any
in none
created: Mar 17 14:54:27 2016 lastused: Mar 17 14:56:20 2016
lifetime: 2147483647(s) validtime: 0(s)
spid=14 seq=3 pid=44444
refcnt=1
10.0.0.0/8[any] 10.85.0.0/16[any] any
in ipsec
esp/tunnel/201.xxx.xxx.xxx-181.xxx.xxx.xxx/unique:1
created: Mar 17 14:54:27 2016 lastused: Mar 17 14:56:19 2016
lifetime: 2147483647(s) validtime: 0(s)
spid=18 seq=2 pid=44444
refcnt=1
10.85.0.0/16[any] 10.85.0.0/16[any] any
out none
created: Mar 17 14:54:27 2016 lastused: Mar 17 14:56:20 2016
lifetime: 2147483647(s) validtime: 0(s)
spid=13 seq=1 pid=44444
refcnt=1
10.85.0.0/16[any] 10.0.0.0/8[any] any
out ipsec
esp/tunnel/181.xxx.xxx.xxx-201.xxx.xxx.xxx/unique:1
created: Mar 17 14:54:27 2016 lastused: Mar 17 14:56:20 2016
lifetime: 2147483647(s) validtime: 0(s)
spid=17 seq=0 pid=44444
refcnt=1
[root@vpn-gualeguaychu ~]#