l2tp/ipsec - xl2tpd/strongswan

[jeka.pro]

привет, есть офисный сервер в виде виртуальной машины, на нём стоит debian wheezy

виртуальная машина входит во множество виртуальных машин, расположенных на физических серверах, которые находятся за NAT через железку dir 300 (dd-wrt)

на самом dir 300 через веб морду dd-wrt проброшены порты на виртуальный сервер

iptables -L

Код: Выделить всё

...
Chain FORWARD (policy ACCEPT)
...
ACCEPT     tcp  --  anywhere             192.168.0.115       tcp dpt:1701
ACCEPT     udp  --  anywhere             192.168.0.115       udp dpt:1701
ACCEPT     udp  --  anywhere             192.168.0.115       udp dpt:500
ACCEPT     udp  --  anywhere             192.168.0.115       udp dpt:4500
...

iptables -t nat -L

Код: Выделить всё

Chain PREROUTING (policy ACCEPT)
...
DNAT       tcp  --  anywhere             8.8.8.8 tcp dpt:1701 to:192.168.0.115:1701
DNAT       udp  --  anywhere             8.8.8.8 udp dpt:1701 to:192.168.0.115:1701
DNAT       udp  --  anywhere             8.8.8.8 udp dpt:500 to:192.168.0.115:500
DNAT       udp  --  anywhere             8.8.8.8 udp dpt:4500 to:192.168.0.115:4500
...
DNAT       0    --  anywhere             8.8.8.8 to:192.168.0.115

также через веб морду dd-wrt виртуальный сервер отделён в dmz (последняя строчка лога)

есть задача установить доступ для windows 7 в офисную сеть при помощи VPN, l2tp/ikev1 (psk)

для этого был установлен xl2tpd и openswan, подружится с openswan не получилось, через полминуты гугления документации на оф сайте strongswan, было принято решение заменить openswan на strongswan

что происходит дальше? дальше прекрасно заходит по чистому l2tp - на xl2tpd. безо всяких нареканий. работает на ура.

меняем в подключении > Свойства > Безопасность > Дополнительные параметры > L2TP > Для проверки подлинности использовать предварительный ключ: PSK_KEY

подключаемся к strongswan, проходим IKE_SA, проходим даже CHILD_SA, соединение якобы успешно устанавливается а лог xl2tpd пустой ^^

логи:

мега спойлер запуска

Spoiler

Starting strongSwan 5.1.1 IPsec [starter]...
# deprecated keyword 'nat_traversal' in config setup
# deprecated keyword 'charonstart' in config setup
# deprecated keyword 'plutostart' in config setup
### 3 parsing errors (0 fatal) ###
00[DMN] Starting IKE charon daemon (strongSwan 5.1.1, Linux 3.2.0-4-amd64, x86_64)
00[LIB] plugin 'aes': loaded successfully
00[LIB] plugin 'des': loaded successfully
00[LIB] plugin 'rc2': loaded successfully
00[LIB] plugin 'sha1': loaded successfully
00[LIB] plugin 'sha2': loaded successfully
00[LIB] plugin 'md5': loaded successfully
00[LIB] plugin 'random': loaded successfully
00[LIB] plugin 'nonce': loaded successfully
00[LIB] plugin 'x509': loaded successfully
00[LIB] plugin 'revocation': loaded successfully
00[LIB] plugin 'constraints': loaded successfully
00[LIB] plugin 'pubkey': loaded successfully
00[LIB] plugin 'pkcs1': loaded successfully
00[LIB] plugin 'pkcs7': loaded successfully
00[LIB] plugin 'pkcs8': loaded successfully
00[LIB] plugin 'pkcs12': loaded successfully
00[LIB] plugin 'pgp': loaded successfully
00[LIB] plugin 'dnskey': loaded successfully
00[LIB] plugin 'sshkey': loaded successfully
00[LIB] plugin 'pem': loaded successfully
00[LIB] plugin 'fips-prf': loaded successfully
00[LIB] plugin 'gmp': loaded successfully
00[LIB] plugin 'xcbc': loaded successfully
00[LIB] plugin 'cmac': loaded successfully
00[LIB] plugin 'hmac': loaded successfully
00[LIB] plugin 'attr': loaded successfully
00[LIB] plugin 'kernel-netlink': loaded successfully
00[LIB] plugin 'resolve': loaded successfully
00[LIB] plugin 'socket-default': loaded successfully
00[LIB] plugin 'stroke': loaded successfully
00[LIB] plugin 'updown': loaded successfully
00[LIB] plugin 'xauth-generic': loaded successfully
00[KNL] known interfaces and IP addresses:
00[KNL] lo
00[KNL] 127.0.0.1
00[KNL] ::1
00[KNL] eth0
00[KNL] 192.168.0.115
00[KNL] fe80::215:5dff:fe00:883c
00[LIB] feature PUBKEY:ECDSA in plugin 'pem' has unmet dependency: PUBKEY:ECDSA
00[LIB] feature PUBKEY:DSA in plugin 'pem' has unmet dependency: PUBKEY:DSA
00[LIB] feature PRIVKEY:DSA in plugin 'pem' has unmet dependency: PRIVKEY:DSA
00[LIB] feature CERT_DECODE:X509_OCSP_REQUEST in plugin 'pem' has unmet dependency: CERT_DECODE:X509_OCSP_REQUEST
00[LIB] feature PRF:PRF_CAMELLIA128_XCBC in plugin 'xcbc' has unmet dependency: CRYPTER:CAMELLIA_CBC-16
00[LIB] feature SIGNER:CAMELLIA_XCBC_96 in plugin 'xcbc' has unmet dependency: CRYPTER:CAMELLIA_CBC-16
00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'
00[ASN] file content is not binary ASN.1
00[ASN] -----BEGIN CERTIFICATE-----
00[ASN] -----END CERTIFICATE-----
00[ASN] L0 - x509:
00[ASN] L1 - tbsCertificate:
00[ASN] L2 - DEFAULT v1:
00[ASN] L3 - version:
00[ASN] X.509v3
00[ASN] L2 - serialNumber:
00[ASN] L2 - signature:
00[ASN] L3 - algorithmIdentifier:
00[ASN] L4 - algorithm:
00[ASN] 'sha-1WithRSAEncryption'
00[ASN] L2 - issuer:
00[ASN] 'C=AU, ST=Some-State, O=Internet Widgits Pty Ltd'
00[ASN] L2 - validity:
00[ASN] L3 - notBefore:
00[ASN] L4 - utcTime:
00[ASN] 'Nov 22 04:43:36 UTC 2013'
00[ASN] L3 - notAfter:
00[ASN] L4 - utcTime:
00[ASN] 'Nov 20 04:43:36 UTC 2023'
00[ASN] L2 - subject:
00[ASN] 'C=AU, ST=Some-State, O=Internet Widgits Pty Ltd'
00[ASN] L2 - subjectPublicKeyInfo:
00[ASN] -- > --
00[ASN] L0 - subjectPublicKeyInfo:
00[ASN] L1 - algorithm:
00[ASN] L2 - algorithmIdentifier:
00[ASN] L3 - algorithm:
00[ASN] 'rsaEncryption'
00[ASN] L1 - subjectPublicKey:
00[ASN] -- > --
00[ASN] L0 - RSAPublicKey:
00[ASN] L1 - modulus:
00[ASN] L1 - publicExponent:
00[ASN] -- < --
00[ASN] -- < --
00[ASN] L2 - optional extensions:
00[ASN] L3 - extensions:
00[ASN] L4 - extension:
00[ASN] L5 - extnID:
00[ASN] 'subjectKeyIdentifier'
00[ASN] L5 - critical:
00[ASN] FALSE
00[ASN] L5 - extnValue:
00[ASN] L6 - keyIdentifier:
00[ASN] L4 - extension:
00[ASN] L5 - extnID:
00[ASN] 'authorityKeyIdentifier'
00[ASN] L5 - critical:
00[ASN] FALSE
00[ASN] L5 - extnValue:
00[ASN] L6 - authorityKeyIdentifier:
00[ASN] L7 - keyIdentifier:
00[ASN] L4 - extension:
00[ASN] L5 - extnID:
00[ASN] 'basicConstraints'
00[ASN] L5 - critical:
00[ASN] FALSE
00[ASN] L5 - extnValue:
00[ASN] L6 - basicConstraints:
00[ASN] L7 - CA:
00[ASN] TRUE
00[ASN] L1 - signatureAlgorithm:
00[ASN] L2 - algorithmIdentifier:
00[ASN] L3 - algorithm:
00[ASN] 'sha-1WithRSAEncryption'
00[ASN] L1 - signatureValue:
00[LIB] signature verification:
00[ASN] L0 - digestInfo:
00[ASN] L1 - digestAlgorithm:
00[ASN] L2 - algorithmIdentifier:
00[ASN] L3 - algorithm:
00[ASN] 'sha-1'
00[ASN] L1 - digest:
00[CFG] loaded ca certificate "C=AU, ST=Some-State, O=Internet Widgits Pty Ltd" from '/usr/local/etc/ipsec.d/cacerts/strongSWANcacert.pem'
00[CFG] loading aa certificates from '/usr/local/etc/ipsec.d/aacerts'
00[CFG] loading ocsp signer certificates from '/usr/local/etc/ipsec.d/ocspcerts'
00[CFG] loading attribute certificates from '/usr/local/etc/ipsec.d/acerts'
00[CFG] loading crls from '/usr/local/etc/ipsec.d/crls'
00[CFG] loading secrets from '/usr/local/etc/ipsec.secrets'
00[CFG] loaded IKE secret for 192.168.0.115 %any
00[CFG] loaded IKE secret for 8.8.8.8 %any
00[LIB] loaded plugins: charon aes des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic
00[LIB] unable to load 6 plugin features (6 due to unmet dependencies)
00[JOB] spawning 16 worker threads
07[LIB] created thread 07 [27399]
07[JOB] started worker thread 07
07[JOB] no events, waiting
08[LIB] created thread 08 [27400]
08[JOB] started worker thread 08
08[JOB] watcher going to select()
08[JOB] watcher got notification, rebuilding
08[JOB] watcher going to select()
09[LIB] created thread 09 [27401]
09[JOB] started worker thread 09
09[NET] waiting for data on sockets
10[LIB] created thread 10 [27402]
10[JOB] started worker thread 10
11[LIB] created thread 11 [27403]
11[JOB] started worker thread 11
06[LIB] created thread 06 [27398]
06[JOB] started worker thread 06
12[LIB] created thread 12 [27404]
12[JOB] started worker thread 12
13[LIB] created thread 13 [27405]
13[JOB] started worker thread 13
14[LIB] created thread 14 [27406]
14[JOB] started worker thread 14
15[LIB] created thread 15 [27407]
15[JOB] started worker thread 15
16[LIB] created thread 16 [27408]
05[LIB] created thread 05 [27397]
16[JOB] started worker thread 16
05[JOB] started worker thread 05
04[LIB] created thread 04 [27396]
04[JOB] started worker thread 04
03[LIB] created thread 03 [27395]
03[JOB] started worker thread 03
02[LIB] created thread 02 [27394]
02[JOB] started worker thread 02
01[LIB] created thread 01 [27393]
01[JOB] started worker thread 01
charon (27392) started after 40 ms
08[JOB] watched FD 16 ready to read
08[JOB] watcher going to select()
11[CFG] received stroke: add connection 'rw-jeka'
08[JOB] watcher got notification, rebuilding
11[CFG] conn rw-jeka
08[JOB] watcher going to select()
11[CFG] left=192.168.0.115
11[CFG] leftsubnet=(null)
11[CFG] leftsourceip=(null)
11[CFG] leftdns=(null)
11[CFG] leftauth=psk
11[CFG] leftauth2=(null)
11[CFG] leftid=192.168.0.115
11[CFG] leftid2=(null)
11[CFG] leftrsakey=(null)
11[CFG] leftcert=(null)
11[CFG] leftcert2=(null)
11[CFG] leftca=(null)
11[CFG] leftca2=(null)
11[CFG] leftgroups=(null)
11[CFG] leftgroups2=(null)
11[CFG] leftupdown=(null)
11[CFG] right=%any
11[CFG] rightsubnet=0.0.0.0/0
11[CFG] rightsourceip=192.168.111.0/24
11[CFG] rightdns=(null)
11[CFG] rightauth=psk
11[CFG] rightauth2=(null)
11[CFG] rightid=(null)
11[CFG] rightid2=(null)
11[CFG] rightrsakey=(null)
11[CFG] rightcert=(null)
11[CFG] rightcert2=(null)
11[CFG] rightca=(null)
11[CFG] rightca2=(null)
11[CFG] rightgroups=(null)
11[CFG] rightgroups2=(null)
11[CFG] rightupdown=(null)
11[CFG] eap_identity=(null)
11[CFG] aaa_identity=(null)
11[CFG] xauth_identity=(null)
11[CFG] ike=aes128-sha1-modp2048,3des-sha1-modp1536
11[CFG] esp=aes128-sha1,3des-sha1
11[CFG] ah=(null)
11[CFG] dpddelay=30
11[CFG] dpdtimeout=180
11[CFG] dpdaction=3
11[CFG] closeaction=0
11[CFG] mediation=no
11[CFG] mediated_by=(null)
11[CFG] me_peerid=(null)
11[CFG] keyexchange=ikev1
11[CFG] adding virtual IP address pool 192.168.111.0/24
11[CFG] added configuration 'rw-jeka'

[jeka.pro]

продолжЭние ЭпоПеи

http://pastebin.com/raw.php?i=S8URS3jj

смущает не понимание как же работает плавный переход с 8.8.8.8 на 192.168/16

Код: Выделить всё

03[ENC] verifying message structure
03[ENC] found payload of type HASH_V1
03[ENC] found payload of type SECURITY_ASSOCIATION_V1
03[ENC] found payload of type NONCE_V1
03[ENC] found payload of type ID_V1
03[ENC] found payload of type ID_V1
03[ENC] found payload of type NAT_OA_V1
03[ENC] found payload of type NAT_OA_V1
03[ENC] parsed QUICK_MODE request 2 [ HASH SA No ID ID NAT-OA NAT-OA ]
03[IKE] changing received traffic selectors 9.9.9.9/32[udp/l2f]=== 8.8.8.8/32[udp/l2f] due to NAT
03[CFG] looking for a child config for 192.168.0.115/32[udp/l2f] === 9.9.9.9/32[udp/l2f]
03[CFG] proposing traffic selectors for us:
03[CFG]  192.168.0.115/32
03[CFG] proposing traffic selectors for other:
03[CFG]  0.0.0.0/0
03[CFG]   candidate "rw-jeka" with prio 1+1
03[CFG] found matching child config "rw-jeka" with prio 2
03[CFG] selecting traffic selectors for other:
03[CFG]  config: 0.0.0.0/0, received: 9.9.9.9/32[udp/l2f] => match: 9.9.9.9/32[udp/l2f]
03[CFG] selecting traffic selectors for us:
03[CFG]  config: 192.168.0.115/32, received: 192.168.0.115/32[udp/l2f] => match: 192.168.0.115/32[udp/l2f]
03[CFG] selecting proposal:

при том что порты по факту проброшены за NAT, правильные ли?

смущает периодичность sa payload missing

Код: Выделить всё

06[ENC] insert decrypted payload of type HASH_V1 at end of list
06[ENC] verifying message structure
06[ENC] found payload of type HASH_V1
06[ENC] parsed QUICK_MODE request 3 [ HASH ]
06[IKE] sa payload missing
06[IKE] queueing INFORMATIONAL task
06[IKE] activating new tasks

xl2tpd ну тут всё стабильно :>

Код: Выделить всё

xl2tpd[27409]: IPsec SAref does not work with L2TP kernel mode yet, enabling forceuserspace=yes
xl2tpd[27409]: setsockopt recvref[30]: Protocol not available
xl2tpd[27409]: This binary does not support kernel L2TP.
xl2tpd[27409]: xl2tpd version xl2tpd-1.3.1 started on vpn PID:27409
xl2tpd[27409]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
xl2tpd[27409]: Forked by Scott Balmos and David Stipp, (C) 2001
xl2tpd[27409]: Inherited by Jeff McAdams, (C) 2002
xl2tpd[27409]: Forked again by Xelerance (www.xelerance.com) (C) 2006
xl2tpd[27409]: Listening on IP address 192.168.0.115, port 1701

[jeka.pro]

конфиги

/etc/xl2tpd/xl2tpd.conf

Код: Выделить всё

;
; Sample l2tpd configuration file
;
; This example file should give you some idea of how the options for l2tpd
; should work.  The best place to look for a list of all options is in
; the source code itself, until I have the time to write better documetation :)
; Specifically, the file "file.c" contains a list of commands at the end.
;
; You most definitely don't have to spell out everything as it is done here
;
 [global]                                                               ; Global parameters:
debug network = yes
debug tunnel = yes
 ipsec saref = no
; saref refinfo = 30
 listen-addr = 192.168.0.115
 port = 1701                                                    ; * Bind to port 1701
 auth file = /etc/xl2tpd/l2tp-secrets   ; * Where our challenge secrets are
; access control = yes                                  ; * Refuse connections without IP match
 rand source = dev                     ; Source for entropy for random
;                                       ; numbers, options are:
;                                       ; dev - reads of /dev/urandom
;                                       ; sys - uses rand()
;                                       ; egd - reads from egd socket
;                                       ; egd is not yet implemented
;
 [lns default]                                                  ; Our fallthrough LNS definition
 exclusive = yes                                                ; * Only permit one tunnel per host
 assign ip = yes
 ip range = 10.0.0.1-10.10.0.4  ; * Allocate from this IP range
; no ip range = 192.168.0.3-192.168.0.9 ; * Except these hosts
; ip range = 192.168.0.5                                ; * But this one is okay
; ip range = lac1-lac2                                  ; * And anything from lac1 to lac2's IP
; lac = 192.168.1.4 - 192.168.1.8               ; * These can connect as LAC's
; no lac = untrusted.marko.net                  ; * This guy can't connect
 hidden bit = no                                                ; * Use hidden AVP's?
 local ip = 10.0.0.5                            ; * Our local IP to use
 length bit = yes                                               ; * Use length bit in payload?
 require chap = yes                                     ; * Require CHAP auth. by peer
 refuse pap = yes                                               ; * Refuse PAP authentication
 refuse chap = no                                               ; * Refuse CHAP authentication
 refuse authentication = no                     ; * Refuse authentication altogether
 require authentication = yes                   ; * Require peer to authenticate
 unix authentication = no                               ; * Use /etc/passwd for auth.
 name = peer.Gov.ru                                           ; * Report this as our hostname
 ppp debug = yes                                                ; * Turn on PPP debugging
 pppoptfile = /etc/ppp/options.l2tpd.lns        ; * ppp options file
; call rws = 10                                                 ; * RWS for call (-1 is valid)
; tunnel rws = 4                                                ; * RWS for tunnel (must be > 0)
 flow bit = yes                                         ; * Include sequence numbers
 challenge = no                                         ; * Challenge authenticate peer ;
; rx bps = 10000000                             ; Receive tunnel speed
; tx bps = 10000000                             ; Transmit tunnel speed
; bps = 100000                                  ; Define both receive and transmit speed in one option

/etc/ipsec.conf

Код: Выделить всё

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
        charondebug = "dmn 2, mgr 2, ike 2, chd 2, job 2, cfg 2, knl 2, net 2, asn 2, enc 2, lib 2, esp 2, tls 2, tnc 2, imc 2, imv 2, pts 2"
        #charondebug = "asn 2, enc 2, lib 2, esp 2, tls 2, tnc 2, imc 2, imv 2, pts 2"
        # strictcrlpolicy=yes
        # uniqueids = no
        nat_traversal=yes
        #strictpolicy=no
        charonstart=yes
        plutostart=no
        #charondebug="ike 2, knl 2, net 3, cfg 0"

# Add connections here.

# Sample VPN connections

#conn sample-self-signed
#      leftsubnet=10.1.0.0/16
#      leftcert=selfCert.der
#      leftsendcert=never
#      right=192.168.0.2
#      rightsubnet=10.2.0.0/16
#      rightcert=peerCert.der
#      auto=start

#conn sample-with-ca-cert
#      leftsubnet=10.1.0.0/16
#      leftcert=myCert.pem
#      right=192.168.0.2
#      rightsubnet=10.2.0.0/16
#      rightid="C=CH, O=Linux strongSwan CN=peer name"
#      auto=start


conn rw-jeka
        ikelifetime=60m
        keylife=20m
        rekeymargin=3m
        keyingtries=1
        dpdaction=restart
        #dpdelay=30s
        dpdtimeout=180s
        keyexchange=ikev1
        authby=secret
        left=192.168.0.115
        #left=9.9.9.9
        #leftsubnet=192.168.0.0/24
        leftid=192.168.0.115
        #leftcert=/etc/ipsec.d/certs/servercert.pem
        #leftauth=pubkey
        right=%any
        #rightauth=eap-mschapv2
        #rightsendcert=never
        rightsubnet=0.0.0.0/0
        rightsourceip=192.168.111.0/24
        type=tunnel
        auto=add

/etc/strongswan.conf

Код: Выделить всё

# strongswan.conf - strongSwan configuration file

charon {

#       load = curl test-vectors aes des sha1 sha2 md5 pem pkcs1 gmp random x509 revocation hmac xcbc cmac ctr ccm gcm stroke kernel-netlink socket-default $

        # number of worker threads in charon
        threads = 16

        # send strongswan vendor ID?
        # send_vendor_id = yes

        plugins {

                sql {
                        # loglevel to log into sql database
                        loglevel = -1

                        # URI to the database
                        # database = sqlite:///path/to/file.db
                        # database = mysql://user:password@localhost/database
                }
        }

        # ...
}

pluto {

}

libstrongswan {

        #  set to no, the DH exponent size is optimized
        #  dh_exponent_ansi_x9_42 = no
}

ipsec statusall

Код: Выделить всё

root@vpn:~# ipsec statusall
Status of IKE charon daemon (strongSwan 5.1.1, Linux 3.2.0-4-amd64, x86_64):
  uptime: 8 seconds, since Nov 24 14:27:33 2013
  malloc: sbrk 262144, mmap 0, used 225072, free 37072
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 7
  loaded plugins: charon aes des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic
Virtual IP pools (size/online/offline):
  192.168.111.0/24: 254/0/0
Listening IP addresses:
  192.168.0.115
Connections:
     rw-jeka:  192.168.0.115...%any  IKEv1, dpddelay=30s
     rw-jeka:   local:  [192.168.0.115] uses pre-shared key authentication
     rw-jeka:   remote: uses pre-shared key authentication
     rw-jeka:   child:  dynamic === 0.0.0.0/0 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 connecting):
     rw-jeka[1]: ESTABLISHED 3 seconds ago, 192.168.0.115[192.168.0.115]...9.9.9.9[9.9.9.9]
     rw-jeka[1]: IKEv1 SPIs: 90b394d6268b77a1_i ae44327ab524f0e4_r*, pre-shared key reauthentication in 54 minutes
     rw-jeka[1]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
     rw-jeka{1}:  INSTALLED, TRANSPORT, ESP in UDP SPIs: c18e3040_i 12971c72_o
     rw-jeka{1}:  AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 14 minutes
     rw-jeka{1}:   192.168.0.115/32[udp/l2f] === 9.9.9.9/32[udp/l2f]
root@vpn:~#

8.8.8.8 - VPN сервер

9.9.9.9 - VPN клиент, у которого расшарено PPPoe-подключение на ещё одну сетевую карточку, которая ведёт в локальную сеть

когда выполняется подключение к VPN-серверу внутри локальной сети из виртуальной машины (на другом физическом компьютере) то всё работает на ура!

В чём же виноват NAT ?

Код: Выделить всё

root@vpn:~# /usr/local/sbin/ipsec version
Linux strongSwan U5.1.1/K3.2.0-4-amd64
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil, Switzerland
See 'ipsec --copyright' for copyright information.

--enable-nat-transport is deprecated, as i know

ну неужели всё дело в том что pppoe-подключение расшарено ?

почему молчит xl2tpd ?

[jeka.pro]

tcpdump спалил тему и был найден виновник трагедии

netfilter «знает» два протокола из семейства IPsec: Authentication Header (-p ah) и Encapsulating Security Payload (-p esp).

Код: Выделить всё

AH

Для протокола AH поддерживается единственная опция

    --ahspi значение[:значение] — позволяет указать значение (или диапазон значений) SPI (Security Parameter Index).

ESP

Протокол ESP имеет аналогичную по смыслу опцию

    --espspi значение[:значение]

В большинстве конфигураций IPsec-пакеты просто пропускаются фаерволом (пусть с ними разбирается IPsec-подсистема):

Код: Выделить всё

iptables -I INPUT -p ah -j ACCEPT
iptables -I INPUT -p esp -j ACCEPT