Re: IPSec on blue packets rejected

On 11/1/2011 9:58 PM, Mike Beirne wrote:
> Hello,
> 
> I tried to create a ticket, but after I created the account, it said
> that I didn't have ticket creation privileges.
> 
> My issue is that for testing purposes, I set up an IPSec tunnel on blue
> and it shows that it is up, but the packets are being rejected by the
> firewall.
> 
> The /usr/local/bin/ipsecupdown.sh script seems to have a line for nat on
> the red, but not the blue.
> 
> Here is the message:
> Nov  1 21:41:07 ipcop2 kernel: BLUE REJECT IN=wlan-1 OUT=lan-1
> SRC=192.168.64.110 DST=192.168.69.12 LEN=60 TOS=0x00 PREC=0x00 TTL=63
> ID=2913 DF PROTO=TCP SPT=60828 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0
> 
> How do I get the firewall to not block my packets?
> 
> Mike
> 
> ------------------------------------------------------------------------------
> RSA® Conference 2012
> Save $700 by Nov 18
> Register now!
> http://p.sf.net/sfu/rsa-sfdev2dev1
> _______________________________________________
> IPCop-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel
> 

To further test this, I set up a second IPCop 2.0 box and configured a
IPSec net-to-net VPN between them. After the VPN comes up, I can ping
the remote IPCop interface, but not any machines on the remote network.
I also did a wireshark capture on the blue network to verify that only
"ESP" traffic was flowing between the two IPCop boxes.

Ubuntu10 192.168.69.12 ->Green 192.168.69.1-IPCop1-Blue 192.168.64.1 ->
Red 192.168.64.10-IPCop2-Green 192.168.68.1 -> laptop 192.168.68.204

The laptop can ping the 192.168.69.1 interface, but not the
192.168.69.12 on the Ubuntu Linux box and SSH fails to the Linux box too.

The error in the IPCop1:/ver/log/messages is:
Nov  2 09:47:28 ipcop2 kernel: BLUE REJECT IN=wlan-1 OUT=lan-1
SRC=192.168.68.204 DST=192.168.69.12 LEN=60 TOS=0x00 PREC=0x00 TTL=62
ID=63601 DF PROTO=TCP SPT=39202 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0




------------------------------------------------------------------------------
RSA(R) Conference 2012
Save $700 by Nov 18
Register now
http://p.sf.net/sfu/rsa-sfdev2dev1