Openswan и DI-804HV (не могу запустить между ними туннель)

[chama]

Пытаюсь настроить vpn туннель openswan с dlink DI-804HV по инструкции с википедии от openswan
http://wiki.openswan.org/index.php/Openswan/DI-804HV

На линуксе
eth0 -> внутрь
eth1 -> наружу

ipsec.conf

Код: Выделить всё

version 2.0     # conforms to second version of ipsec.conf specification

config setup

        interfaces="ipsec0=eth1"
        klipsdebug=none
        plutodebug=none

conn jmp-cgy
        left=81.17.10.70
        leftid=81.27.10.70
        leftsubnet=10.202.1.0/24
        leftnexthop=81.17.10.69
        right=62.168.225.205
        rightsubnet=10.204.80.0/24
        rightid=62.168.225.205
        rightnexthop=62.168.225.201
        keyexchange=ike
        ikelifetime=240m
        keylife=3600s
        pfs=yes
        compress=no
        authby=secret
        keyingtries=0
        auto=start

на dlink проставлял вст так как там и написано

Mar 13 11:41:37 vpn ipsec__plutorun: Starting Pluto subsystem...
Mar 13 11:41:37 vpn ipsec__plutorun: Unknown default RSA hostkey scheme, not generating a default hostkey
Mar 13 11:41:37 vpn pluto[5800]: Starting Pluto (Openswan Version 2.4.9 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OE_]{vKgCoOI)
Mar 13 11:41:37 vpn pluto[5800]: Setting NAT-Traversal port-4500 floating to off
Mar 13 11:41:37 vpn pluto[5800]: port floating activation criteria nat_t=0/port_fload=1
Mar 13 11:41:37 vpn pluto[5800]: including NAT-Traversal patch (Version 0.6c) [disabled]
Mar 13 11:41:37 vpn pluto[5800]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Mar 13 11:41:37 vpn pluto[5800]: starting up 1 cryptographic helpers
Mar 13 11:41:37 vpn pluto[5800]: started helper pid=5802 (fd:6)
Mar 13 11:41:37 vpn pluto[5800]: Using NETKEY IPsec interface code on 2.6.24-gentoo-r3
Mar 13 11:41:37 vpn ipsec_setup: ...Openswan IPsec started
Mar 13 11:41:37 vpn ipsec__plutorun: ipsec_auto: fatal error in "private": %defaultroute requested but not known
Mar 13 11:41:37 vpn ipsec__plutorun: ipsec_auto: fatal error in "clear": %defaultroute requested but not known
Mar 13 11:41:37 vpn pluto[5800]: Changing to directory '/etc/ipsec/ipsec.d/cacerts'
Mar 13 11:41:37 vpn pluto[5800]: Changing to directory '/etc/ipsec/ipsec.d/aacerts'
Mar 13 11:41:37 vpn pluto[5800]: Changing to directory '/etc/ipsec/ipsec.d/ocspcerts'
Mar 13 11:41:37 vpn pluto[5800]: Changing to directory '/etc/ipsec/ipsec.d/crls'
Mar 13 11:41:37 vpn pluto[5800]: Warning: empty directory
Mar 13 11:41:37 vpn pluto[5800]: loading secrets from "/etc/ipsec/ipsec.secrets"
Mar 13 11:41:37 vpn pluto[5800]: added connection description "jmp-cgy"
Mar 13 11:41:37 vpn ipsec__plutorun: ipsec_auto: fatal error in "block": %defaultroute requested but not known
Mar 13 11:41:37 vpn ipsec__plutorun: ipsec_auto: fatal error in "private-or-clear": %defaultroute requested but not known
Mar 13 11:41:37 vpn ipsec__plutorun: ipsec_auto: fatal error in "clear-or-private": %defaultroute requested but not known
Mar 13 11:41:37 vpn ipsec__plutorun: ipsec_auto: fatal error in "packetdefault": %defaultroute requested but not known
Mar 13 11:41:37 vpn pluto[5800]: listening for IKE messages
Mar 13 11:41:37 vpn pluto[5800]: adding interface eth0/eth0 10.202.1.101:500
Mar 13 11:41:37 vpn pluto[5800]: adding interface eth1/eth1 81.17.10.70:500
Mar 13 11:41:37 vpn pluto[5800]: adding interface lo/lo 127.0.0.1:500
Mar 13 11:41:37 vpn pluto[5800]: forgetting secrets
Mar 13 11:41:37 vpn pluto[5800]: loading secrets from "/etc/ipsec/ipsec.secrets"
Mar 13 11:41:37 vpn ipsec__plutorun: 021 no connection named "private"
Mar 13 11:41:37 vpn ipsec__plutorun: ...could not route conn "private"
Mar 13 11:41:37 vpn ipsec__plutorun: 021 no connection named "clear"
Mar 13 11:41:37 vpn ipsec__plutorun: ...could not route conn "clear"
Mar 13 11:41:37 vpn ipsec__plutorun: 021 no connection named "block"
Mar 13 11:41:37 vpn ipsec__plutorun: ...could not route conn "block"
Mar 13 11:41:37 vpn ipsec__plutorun: 021 no connection named "private-or-clear"
Mar 13 11:41:37 vpn ipsec__plutorun: ...could not route conn "private-or-clear"
Mar 13 11:41:37 vpn ipsec__plutorun: 021 no connection named "clear-or-private"
Mar 13 11:41:37 vpn ipsec__plutorun: ...could not route conn "clear-or-private"
Mar 13 11:41:37 vpn ipsec__plutorun: 021 no connection named "packetdefault"
Mar 13 11:41:37 vpn ipsec__plutorun: ...could not route conn "packetdefault"
Mar 13 11:41:37 vpn pluto[5800]: "jmp-cgy" #1: initiating Main Mode
Mar 13 11:41:37 vpn ipsec__plutorun: 104 "jmp-cgy" #1: STATE_MAIN_I1: initiate
Mar 13 11:41:37 vpn ipsec__plutorun: ...could not start conn "jmp-cgy"
Mar 13 11:41:37 vpn pluto[5800]: "jmp-cgy" #1: Can't authenticate: no preshared key found for `81.27.10.70' and `62.168.225.205'. Attribute OAKLEY_AUTHENTICAT
ION_METHOD
Mar 13 11:41:37 vpn pluto[5800]: "jmp-cgy" #1: no acceptable Oakley Transform
Mar 13 11:41:37 vpn pluto[5800]: "jmp-cgy" #1: sending notification NO_PROPOSAL_CHOSEN to 62.168.225.205:500

dlink в логах пишет

Sunday April 27, 2008 10:57:23 Receive IKE INFO : 81.17.10.70 --> 62.168.225.205
Sunday April 27, 2008 10:57:24 Send IKE (INFO) : delete 62.168.225.205 -> 81.17.10.70 phase 1
Sunday April 27, 2008 10:57:24 IKE phase1 (ISAKMP SA) remove : 62.168.225.205 <-> 81.17.10.70
Sunday April 27, 2008 10:57:54 Receive IKE M1(INIT) : 81.17.10.70 --> 62.168.225.205
Sunday April 27, 2008 10:57:54 Try to match with ENC:3DES AUTH:PSK HASH:MD5 Group:Group5
Sunday April 27, 2008 10:57:54 Try to match with ENC:3DES AUTH:PSK HASH:SHA1 Group:Group5
Sunday April 27, 2008 10:57:54 Try to match with ENC:3DES AUTH:PSK HASH:SHA1 Group:Group2
Sunday April 27, 2008 10:57:54 Try to match with ENC:3DES AUTH:PSK HASH:MD5 Group:Group2
Sunday April 27, 2008 10:57:54 Send IKE M2(RESP) : 62.168.225.205 --> 81.17.10.70
Sunday April 27, 2008 10:57:54 Receive IKE INFO : 81.17.10.70 --> 62.168.225.205
Sunday April 27, 2008 10:57:59 IKED re-TX : RESP to 81.17.10.70
Sunday April 27, 2008 10:57:59 Receive IKE INFO : 81.17.10.70 --> 62.168.225.205
Sunday April 27, 2008 10:58:04 IKED re-TX : RESP to 81.17.10.70
Sunday April 27, 2008 10:58:04 Receive IKE INFO : 81.17.10.70 --> 62.168.225.205
Sunday April 27, 2008 10:58:14 IKED re-TX : RESP to 81.17.10.70
Sunday April 27, 2008 10:58:14 Receive IKE INFO : 81.17.10.70 --> 62.168.225.205
Sunday April 27, 2008 10:58:24 IKED re-TX : RESP to 81.17.10.70
Sunday April 27, 2008 10:58:24 Receive IKE INFO : 81.17.10.70 --> 62.168.225.205
Sunday April 27, 2008 10:58:44 IKED re-TX : RESP to 81.17.10.70
Sunday April 27, 2008 10:58:44 Receive IKE INFO : 81.17.10.70 --> 62.168.225.205

и не подсоединяется

Пробовал и другие варианты но не работает
http://www.dlink.ru/technical/faq_vpn_5.php
Любители ASPLinux

[chama]

И еще

ipsec auto --status
000 interface lo/lo 127.0.0.1
000 interface eth1/eth1 81.17.10.70
000 interface eth0/eth0 10.202.1.101
000 %myid = (none)
000 debug none
000
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256
000
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000
000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}
000
000 "jmp-cgy": 10.202.1.0/24===81.17.10.70[81.27.10.70]---81.17.10.69...62.168.225.201---62.168.225.205===10.204.80.0/24; prospective erouted; eroute owner: #0
000 "jmp-cgy": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;
000 "jmp-cgy": ike_life: 14400s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "jmp-cgy": policy: PSK+ENCRYPT+TUNNEL+PFS+UP; prio: 24,24; interface: eth1; encap: esp;
000 "jmp-cgy": newest ISAKMP SA: #0; newest IPsec SA: #0;
000
000 #1: "jmp-cgy":500 STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 2s; nodpd
000 #1: pending Phase 2 for "jmp-cgy" replacing #0
000

[KiWi]

Да что мелочится-то, давай ещё!

[chama]

Да что мелочится-то, давай ещё!

А что еще можно дать?

Еще в логах пишет

Mar 13 21:52:10 vpn pluto[31158]: "jmp-cgy" #27: max number of retransmissions (20) reached STATE_MAIN_I1. No response (or no acceptable response) to our firs
t IKE message
Mar 13 21:52:10 vpn pluto[31158]: "jmp-cgy" #27: starting keying attempt 28 of an unlimited number
Mar 13 21:52:10 vpn pluto[31158]: "jmp-cgy" #28: initiating Main Mode to replace #27

[netjedi]

Доброго всем!

Код: Выделить всё

Mar 13 11:41:37 vpn pluto[5800]: "jmp-cgy" #1: Can't authenticate: no preshared key found for `81.27.10.70' and `62.168.225.205'. Attribute OAKLEY_AUTHENTICAT

нету ключа PSK для этой пары ip'шникв `81.27.10.70' and `62.168.225.205'
смотри файл ipsec.secrets
_____________
Всего!