Only one VPN connection

Only one VPN connection

[James Miller]

Hello everyone.

I'm cross posting this message because I'm not sure if my problem is a
Freeswan, IPTables, or both ;).  I can establish only one VPN connection to
our internal network.  If someone else connects, I can no-longer see our
network, if I run ipsec.exe on my workstation (from home) I can reconnect
and the other person gets booted off.  My firewall is acting as the Freeswan
VPN server, I'm running Linux 2.4.21, Super-freeswan-1.99.7.3 and grsecurity
(it doesn't matter if I have grsec enabled or disabled, I get the same
results).  I'm sure it's something stupid that I'm missing.. and I hope that
some additional pairs of eyes can help me determine what I'm doing wrong.


Here's my IPTables rules:

# eth1 is external IP of FW/VPN server
$IPTABLES -N eth1_In_RULE_0
$IPTABLES -A INPUT -i eth1 -p udp -d $FW_VPN_EXT_IP --destination-port
500 -m state --state NEW -j eth1_In_RULE_0
$IPTABLES -A INPUT -i eth1 -p 50 -d $FW_VPN_EXT_IP -m state --state NEW -j
eth1_In_RULE_0
$IPTABLES -A INPUT -i eth1 -p 51 -d $FW_VPN_EXT_IP -m state --state NEW -j
eth1_In_RULE_0
$IPTABLES -A eth1_In_RULE_0 -j LOG --log-level info --log-prefix "IPSec_IN "
$IPTABLES -A eth1_In_RULE_0 -j ACCEPT

$IPTABLES -N eth1_Out_RULE_0
$IPTABLES -A OUTPUT -o eth1 -p udp -d $FW_VPN_EXT_IP --destination-port
500 -m state NEW -j eth1_IN_RULE_0
$IPTABLES -A OUTPUT -o eth1 -p 50 -d $FW_VPN_EXT_IP -m state --state NEW -j
eth1_Out_RULE_0
$IPTABLES -A OUTPUT -o eth1 -p 51 -d $FW_VPN_EXT_IP -m state --state NEW -j
eth1_Out_RULE_0
$IPTABLES -A eth1_Out_RULE_0 -j LOG --log-level info --log-prefix "IPSec_OUT
"
$IPTABLES -A eth1_Out_RULE_0 -j ACCEPT


# eth0 is the internal (trusted) Iface of the FW
$IPTABLES -N RULE_IPSec_FORWARD
$IPTABLES -A FORWARD -i eth0 -o ipsec+ -j RULE_IPSec_FORWARD
$IPTABLES -A FORWARD -i ipsec+ -o eth0 -j RULE_IPSec_FORWARD
$IPTABLES -A RULE_IPSec_FORWARD -j LOG --log-level info --log-prefix
"IPSec_int_Iface_FORWARD "
$IPTABLES -A RULE_IPSec_FORWARD -j ACCEPT

---------------------
WinXP ipsec.conf -- No NAT on client side
conn roadwarrior
	left=%any
	right=207.xxx.xxx.xxx (external IP of FW/VPN server)
	rightca="commented-out"
	network=auto
	auto=start
	pfs=yes

conn roadwarrior-net
	left=%any
	right=207.xxx.xxx.xxx (external IP of FW/VPN server)
	rightsubnet=xxx.xx.xxx.0/255.255.255.0 (internal real IP network)
	rightca="commented-out"
	network=auto
	auto=start
	pfs=yes

------------------------------------
/etc/ipsec.conf on server
config setup
	interfaces=%defaultroute
	klipsdebug=none
	plutodebug=none
	plutoload=%search
	plutostart=%search
	uniqueids=yes

conn %default
	keyingtries=1
	compress=yes
	disablearrivalcheck=no
	authby=rsasig
	leftrsasigkey=%cert
	rightrsasigkey=%cert

conn roadwarrior-net
	leftsubnet=xxx.xx.xxx.0/255.255.255.0 (internal real IP network)
	also=roadwarrior

conn roadwarrior
	right=%any
	left=%defaultroute
	leftcert=Server.CertFilename.pem
	auto=add
	pfs=yes



Thank you very much for your help!
-->jim

Re: Only one VPN connection

[Chris Wilson]

Hi James,

> I'm cross posting this message because I'm not sure if my problem is a
> Freeswan, IPTables, or both ;).  I can establish only one VPN connection to
> our internal network.  If someone else connects, I can no-longer see our
> network, if I run ipsec.exe on my workstation (from home) I can reconnect
> and the other person gets booted off.  My firewall is acting as the Freeswan
> VPN server, I'm running Linux 2.4.21, Super-freeswan-1.99.7.3 and grsecurity
> (it doesn't matter if I have grsec enabled or disabled, I get the same
> results).  I'm sure it's something stupid that I'm missing.. and I hope that
> some additional pairs of eyes can help me determine what I'm doing wrong.

First of all, this is almost certainly a FreeSWAN issue rather than 
iptables.

I just wanted to check that you and the other user are both using
different certificates. Because uniqueids=yes, when you connect to the
server will disconnect anyone else with the same ID.

Also, I believe that you may have problems with having a subnet behind 
your road warriors. This subnet can only be routed to one peer at a time, 
so if one user is using it and another connects, the first user will lose 
their SA for that subnet, and will be unable to use it to talk to the 
server.

Cheers, Chris.
-- 
   ___ __     _
 / __// / ,__(_)_  | Chris Wilson -- UNIX Firewall Lead Developer |
/ (_ / ,\/ _/ /_ \ | NetServers.co.uk http://www.netservers.co.uk |
\ _//_/_/_//_/___/ | 21 Signet Court, Cambridge, UK. 01223 576516 |