IPSEC not working



  • The Friday's Snapshot killed IPSEC.  Even this mornings did not help.
    May 31 08:27:49 racoon: ERROR: bind(sockname:/var/db/racoon/racoon.sock): No such file or directory
    May 31 08:27:49 racoon: INFO: Reading configuration from "/var/etc/racoon.conf"
    May 31 08:27:49 racoon: INFO: @(#)This product linked OpenSSL 0.9.8e 23 Feb 2007 (http://www.openssl.org/)
    May 31 08:27:49 racoon: INFO: @(#)ipsec-tools 0.8-alpha20090525+natt (http://ipsec-tools.sourceforge.net)
    May 31 08:27:17 racoon: ERROR: bind(sockname:/var/db/racoon/racoon.sock): No such file or directory
    May 31 08:27:17 racoon: INFO: Reading configuration from "/var/etc/racoon.conf"
    May 31 08:27:17 racoon: INFO: @(#)This product linked OpenSSL 0.9.8e 23 Feb 2007 (http://www.openssl.org/)
    May 31 08:27:17 racoon: INFO: @(#)ipsec-tools 0.8-alpha20090525+natt (http://ipsec-tools.sourceforge.net)
    May 31 08:25:25 racoon: ERROR: bind(sockname:/var/db/racoon/racoon.sock): No such file or directory
    May 31 08:25:25 racoon: INFO: Reading configuration from "/var/etc/racoon.conf"
    May 31 08:25:25 racoon: INFO: @(#)This product linked OpenSSL 0.9.8e 23 Feb 2007 (http://www.openssl.org/)
    May 31 08:25:25 racoon: INFO: @(#)ipsec-tools 0.8-alpha20090525+natt (http://ipsec-tools.sourceforge.net)
    May 31 08:22:35 racoon: ERROR: bind(sockname:/var/db/racoon/racoon.sock): No such file or directory
    May 31 08:22:35 racoon: INFO: Reading configuration from "/var/etc/racoon.conf"
    May 31 08:22:35 racoon: INFO: @(#)This product linked OpenSSL 0.9.8e 23 Feb 2007 (http://www.openssl.org/)
    May 31 08:22:35 racoon: INFO: @(#)ipsec-tools 0.8-alpha20090525+natt (http://ipsec-tools.sourceforge.net)



  • Went back and got May 23 from the Web site and back up and runnng.
    RC


  • Rebel Alliance Developer Netgate

    A fix for this went into the tree last night, but I haven't looked to see if a new snap happened with it yet.

    It's an easy fix though, just mkdir -p /var/db/racoon/ and restart the racoon service.

    The new version of ipsec-tools is working much better for me, but is still early on in testing.



  • let me know when, it's solid.  This is the first time in a few weeks that al of my vpn tunnels are up and solid.
    RC


  • Rebel Alliance Developer Netgate

    It doesn't look like a new update has built since before this fix.

    There is also another fix pending because it wasn't automatically adding the firewall rules for NAT-T (udp/4500).

    With that fix, and the mkdir fix, it should be working fine as far as I can tell. Hopefully another snapshot will build today (probably not until this evening at the earliest, if what I have heard is any indication) but we'll see.



  • Thanks for the update.  It's been a pleasure working with you on few of the things. 
    RC



  • I'm running snapshot: pfSense-Full-Update-1.2.3-20090605-1539.tgz

    It looks like something in the new ipsec-tools package or one of the changes broke an aspect of IPSec.

    I have multiple tunnels between my home network and my office with the same destination gateway.  Basically there are multiple subnets at the office and you need 1 tunnel per subnet.

    I had the following tunnels for example:

    Remote Gateway: 1.2.3.4
    Local net: 172.20.20.0 /24
    Remote net: 192.168.1.0 /24

    Remote Gateway: 1.2.3.4
    Local net: 172.20.20.0 /24
    Remote net: 10.10.10.0 /24

    Remote Gateway: 1.2.3.4
    Local net: 172.20.20.0 /24
    Remote net: 172.16.10.0 /24

    With the latest snapshot if there is more than 1 tunnel for the same endpoint it returns the following error:

    Jun  5 18:47:56 pfsense racoon: ERROR: no configuration found for 1.2.3.4.

    As soon as I delete all but a single tunnel per remote gateway that one tunnel recovers.

    I also have been catching the following errors:

    Jun  5 18:47:40 pfsense racoon: ERROR: Cookie mismatch in DPD ACK!.

    It looks like as a result of this error, DPD is killing the tunnel every time the interval trips.

    I also see this error every couple minutes:

    Jun  5 19:09:09 pfsense racoon: WARNING: unrecognized route message with rtm_type: 18


  • Rebel Alliance Developer Netgate

    I haven't tried parallel tunnels with 0.8 yet, but I can see why DPD might freak out.

    Have you tried setting DPD to 0 for all tunnels?



  • I had unset DPD and it stopped the tunnels from being killed every interval.  It did not help with parallel tunnels.


  • Rebel Alliance Developer Netgate

    It looks like ipsec-tools is going to be backed down to 0.7.2 or so, with an added patch or two, instead of all the way up to 0.8. Not sure when those changes will happen though.



  • Well, for what it's worth, the issues I described in http://forum.pfsense.org/index.php/topic,14688.0.html were resolved in 1.2.3 w/ the 0.8 ipsec-tools.  Of course, a lack of parallel tunnels is a rather big problem.


  • Rebel Alliance Developer Netgate

    That is an issue that will be patched if it is reverted to 0.7.2.

    The other person I heard of having trouble with 0.8 also turned out to be a parallel tunnel issue, so that does seem to be broken.

    If we can get 0.7.2 patches so that DPD actually works properly, it will hopefully be stable and usable by everyone.



  • As of the 1.2.3-RC2 built on Sun Jun 14 18:15:10 EDT 2009, parallel tunnel are working.

    But I'm not using DPD so I cannot try. What's the status about this?

    Thanks and regards


  • Rebel Alliance Developer Netgate

    ipsec-tools was backed down to 0.7.2, but I have a patch in that should be helping DPD (or breaking it worse depending on which snapshot is in use). Parallel tunnels work fine with 0.7.2, so that's probably why it's working fine for you.

    I'm waiting on a response from the ipsec-tools developers, hopefully they will have some insight.



  • Thanks for your answer jimp.

    I will try to do some testing with the next patch.

    Keep the good job!



  • I've never gotten IPsec to work properly when going through pfSense. I even tried running it on a VM which worked fine if attempted internally, but try to do it through WAN and you can expect failure. Connections were subsequently denied, even with the proper ports opened.



  • with which version from PfSense?, 1.2 works and the latest 1.23 r2 snapshot works also. I have running 1.2 (carp cluster) with ipsec up and running and the uptime is 458 days….

    regards
    heiko



  • I have been running IPSEC for over 2 years many flavors of PF-Sense no Issues. Except with the issue with one firmware update.
    RC



  • @Papa:

    I've never gotten IPsec to work properly when going through pfSense. I even tried running it on a VM which worked fine if attempted internally, but try to do it through WAN and you can expect failure. Connections were subsequently denied, even with the proper ports opened.

    You're not doing something right. Start a new thread describing your problem.

    The issue in this thread was the 0.8 ipsec-tools version we were testing, which is no longer a problem. Locking thread to prevent further hijacking, as nobody has the same issue as this thread covers.


Log in to reply