openswan ipsec을 사용하여 Hub 및 Spoke를 구성했습니다. 터널은 즉시 시작되지만 문제는 다음과 같습니다.
Spoke1 can ping/access HUB's LAN and vice-versa (S1 -- HUB && HUB -- S1)
Spoke2 can ping/access HUB's LAN and vice-versa (S1 -- HUB && HUB -- S2)
하지만,
Spoke1 can **not** ping/access Spoke2 and vice-versa (**S1 -- S2 && S2 -- S1 NOT WORKING**)
구성:
Hub: 10.103.6.7/23 LAN: 10.1.0.0/16
Spoke1: 10.103.6.40/23 LAN: 10.1.2.0/24
Spoke2: 10.103.6.97/23 LAN: 10.1.1.0/24
Spoke1의 구성: ( /etc/ipsec.conf)
config setup
nat_traversal=yes
oe=off
protostack=netkey
conn NGpassthrough
left=10.1.2.1
right=0.0.0.0
leftsubnet=10.1.2.0/24
rightsubnet=10.1.2.0/24
authby=never
type=passthrough
auto=route
conn NG
right=10.103.6.7
rightsubnet=10.1.0.0/16
left=10.103.6.40
leftsubnet=10.1.2.0/24
leftnexthop=10.103.6.1
leftupdown="ipsec _updown --route yes"
auto=start
leftid=10.103.6.40
rightid=10.103.6.7
#x_rightdynamic=yes
authby=secret
compress=no
failureshunt=drop
dpddelay=15
dpdtimeout=60
dpdaction=restart
pfs=yes
ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048
esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1
허브 구성: (/etc/ipsec.conf)
config setup
nat_traversal=yes
oe=off
protostack=netkey
conn NGpassthrough
left=10.1.0.1
right=0.0.0.0
leftsubnet=10.1.0.0/16
rightsubnet=10.1.0.0/16
authby=never
type=passthrough
auto=route
conn NG
right=10.103.6.40
rightsubnet=10.1.2.0/24
left=10.103.6.7
leftsubnet=10.1.0.0/16
leftnexthop=10.103.6.1
leftupdown="ipsec _updown --route yes"
auto=start
leftid=10.103.6.7
rightid=10.103.6.40
#x_rightdynamic=yes
authby=secret
compress=no
failureshunt=drop
dpddelay=15
dpdtimeout=60
dpdaction=restart
pfs=yes
ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048
esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1
conn NG1passthrough
left=10.1.0.1
right=0.0.0.0
leftsubnet=10.1.0.0/16
rightsubnet=10.1.0.0/16
authby=never
type=passthrough
auto=route
conn NG1
right=10.103.6.97
rightsubnet=10.1.1.0/24
left=10.103.6.7
leftsubnet=10.1.0.0/16
leftnexthop=10.103.6.1
leftupdown="ipsec _updown --route yes"
auto=start
leftid=10.103.6.7
rightid=10.103.6.97
#x_rightdynamic=yes
authby=secret
compress=no
failureshunt=drop
dpddelay=15
dpdtimeout=60
dpdaction=restart
pfs=yes
ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048
esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1
Spoke2의 구성: (/etc/ipsec.conf)
config setup
nat_traversal=yes
oe=off
protostack=netkey
conn NGpassthrough
left=10.1.1.1
right=0.0.0.0
leftsubnet=10.1.1.0/255.255.255.0
rightsubnet=10.1.1.0/255.255.255.0
authby=never
type=passthrough
auto=route
conn NG
right=10.103.6.7
rightsubnet=10.1.0.0/16
left=10.103.6.97
leftsubnet=10.1.1.0/255.255.255.0
leftnexthop=10.103.6.1
auto=start
leftid=10.103.6.97
rightid=10.103.6.7
#x_rightdynamic=yes
authby=secret
compress=no
failureshunt=drop
dpddelay=15
dpdtimeout=60
dpdaction=restart
pfs=yes
ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048
esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1
Spoke1에 추가된 경로:
10.1.0.0/16 via 10.1.2.1 dev br0 (lan interface)
HUB에 추가된 경로:
10.1.1.0/24 via 10.1.0.1 dev br0 (lan interface)
10.1.2.0/24 via 10.1.0.1 dev br0 (lan interface)
Spoke2에 추가된 경로:
10.1.0.0/16 via 10.1.1.1 dev br-lan (lan interface)
데이터 패킷은 HUB의 PREROUTING 테이블에 들어가지만 FORWARD 테이블이나 INPUT 테이블에는 들어가지 않습니다. 경로를 삭제하고 iptables를 새로 고쳤습니다. 하지만 여전히 같은 문제에 직면해 있습니다.