Вот конфиги: /etc/ipsec/ipsec.conf
config setup
interfaces="ipsec0=eth0"
klipsdebug=none
plutodebug=none
uniqueids=yes
nat_traversal=yes
conn club-connect
left=x.x.x.x
leftid=x.x.x.x
leftsubnet=192.168.121.0/24
leftnexthop=x.x.x.x # Тут указал свой шлюз
right=y.y.y.y
rightsubnet=192.168.111.0/24
rightid=y.y.y.y
rightnexthop=x.x.x.x # тут указал свой домашний ip (не знаю что сюда нужно вписывать)
keyexchange=ike
ikelifetime=240m
keylife=3600s
pfs=yes
compress=no
auth=esp
esp=3des-sha1-96
authby=secret
keyingtries=0
auto=start
include /etc/ipsec/ipsec.d/examples/no_oe.conf
/etc/ipsec/ipsec.secrets
x.x.x.x y.y.y.y: PSK "key123"
В логах при подключении получаю следующее :
May 27 16:30:38 localhost pluto[16953]: Starting Pluto (Openswan Version 2.4.9 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OE_]{vKgCoOI)
May 27 16:30:38 localhost pluto[16953]: Setting NAT-Traversal port-4500 floating to on
May 27 16:30:38 localhost pluto[16953]: port floating activation criteria nat_t=1/port_fload=1
May 27 16:30:38 localhost pluto[16953]: including NAT-Traversal patch (Version 0.6c)
May 27 16:30:38 localhost pluto[16953]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
May 27 16:30:38 localhost pluto[16953]: starting up 1 cryptographic helpers
May 27 16:30:38 localhost pluto[16953]: started helper pid=16954 (fd:6)
May 27 16:30:38 localhost pluto[16953]: Using NETKEY IPsec interface code on 2.6.24-gentoo-r4
May 27 16:30:38 localhost pluto[16953]: Changing to directory '/etc/ipsec/ipsec.d/cacerts'
May 27 16:30:38 localhost pluto[16953]: Changing to directory '/etc/ipsec/ipsec.d/aacerts'
May 27 16:30:38 localhost pluto[16953]: Changing to directory '/etc/ipsec/ipsec.d/ocspcerts'
May 27 16:30:38 localhost pluto[16953]: Changing to directory '/etc/ipsec/ipsec.d/crls'
May 27 16:30:38 localhost pluto[16953]: Warning: empty directory
May 27 16:30:38 localhost pluto[16953]: added connection description "club-connect"
May 27 16:30:38 localhost pluto[16953]: listening for IKE messages
May 27 16:30:38 localhost pluto[16953]: adding interface tun0/tun0 192.168.3.1:500
May 27 16:30:38 localhost pluto[16953]: adding interface tun0/tun0 192.168.3.1:4500
May 27 16:30:38 localhost pluto[16953]: adding interface eth2/eth2 192.168.1.1:500
May 27 16:30:38 localhost pluto[16953]: adding interface eth2/eth2 192.168.1.1:4500
May 27 16:30:38 localhost pluto[16953]: adding interface eth1/eth1 192.168.121.1:500
May 27 16:30:38 localhost pluto[16953]: adding interface eth1/eth1 192.168.121.1:4500
May 27 16:30:39 localhost pluto[16953]: adding interface eth0/eth0 x.x.x.x:500
May 27 16:30:39 localhost pluto[16953]: adding interface eth0/eth0 x.x.x.x:4500
May 27 16:30:39 localhost pluto[16953]: adding interface eth3/eth3 192.168.2.1:500
May 27 16:30:39 localhost pluto[16953]: adding interface eth3/eth3 192.168.2.1:4500
May 27 16:30:39 localhost pluto[16953]: adding interface lo/lo 127.0.0.1:500
May 27 16:30:39 localhost pluto[16953]: adding interface lo/lo 127.0.0.1:4500
May 27 16:30:39 localhost pluto[16953]: loading secrets from "/etc/ipsec/ipsec.secrets"
May 27 16:30:39 localhost pluto[16953]: "/etc/ipsec/ipsec.secrets" line 17: RSA modulus too small for security: less than 512 bits
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: initiating Main Mode
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: ignoring unknown Vendor ID payload [8f9cc94e01248ecdf147594c284b213b]
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: ignoring Vendor ID payload [draft-stenberg-ipsec-nat-traversal-01]
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: ignoring Vendor ID payload [draft-stenberg-ipsec-nat-traversal-02]
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] method set to=107
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 107
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] method set to=108
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: received Vendor ID payload [RFC 3947] method set to=110
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: received Vendor ID payload [Dead Peer Detection]
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: STATE_MAIN_I2: sent MI2, expecting MR2
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: I did not send a certificate because I do not have one.
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: STATE_MAIN_I3: sent MI3, expecting MR3
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: ignoring informational payload, type INVALID_PAYLOAD_TYPE
May 27 16:30:39 localhost pluto[16953]: "club-connect" #1: received and ignored informational message
May 27 16:31:49 localhost pluto[16953]: "club-connect" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
May 27 16:31:49 localhost pluto[16953]: "club-connect" #1: starting keying attempt 2 of an unlimited number
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: initiating Main Mode to replace #1
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: ignoring unknown Vendor ID payload [8f9cc94e01248ecdf147594c284b213b]
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: ignoring Vendor ID payload [draft-stenberg-ipsec-nat-traversal-01]
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: ignoring Vendor ID payload [draft-stenberg-ipsec-nat-traversal-02]
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] method set to=107
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 107
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] method set to=108
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: received Vendor ID payload [RFC 3947] method set to=110
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: received Vendor ID payload [Dead Peer Detection]
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: STATE_MAIN_I2: sent MI2, expecting MR2
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: I did not send a certificate because I do not have one.
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: STATE_MAIN_I3: sent MI3, expecting MR3
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: ignoring informational payload, type INVALID_PAYLOAD_TYPE
May 27 16:31:49 localhost pluto[16953]: "club-connect" #2: received and ignored informational message
May 27 16:32:59 localhost pluto[16953]: "club-connect" #2: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
И так далее ... Помогите разобраться, в чем может быть проблема ?