#####################
使用setkey设置 spd, 再使用 racoon来协商 sa信息并支持natt .
[192.168.125.10/30]<--(路由)-->[192.168.125.14/30]
没有所带的网段. 只测试了两点间的通信. 后面带网段时是要再写spd信息吗?
配置里直接启动了 nat-t 不启动它时配置文件差一行. ipsec的封装用的是 esp启动nat-t封装用的是 esp-udp
#cat /etc/racoon/racoon.conf
log notify;
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
listen {
adminsock disabled;
}
timer
{
# To keep the NAT-mappings on your NAT gateway, there must be
# The default is 20s. Set it to 0s to disable sending completely.
natt_keepalive 10 sec;
}
remote "192.168.125.10" {
remote_address 192.168.125.10;
exchange_mode main;
proposal {
encryption_algorithm aes;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 5;
}
generate_policy off;
nat_traversal force;
}
sainfo address 192.168.125.14/32[any] any address 192.168.125.10/32[any] any {
pfs_group 5;
encryption_algorithm aes;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
#cat psk.txt
192.168.125.10 abcd1234
#手动加上
spdadd -4 192.168.125.14 192.168.125.10 any -P out ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 192.168.125.10 192.168.125.14 any -P in ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
--------------------
# setkey -D
192.168.125.14[4500] 192.168.125.10[4500]
esp-udp mode=tunnel spi=11506335(0x00af929f) reqid=0(0x00000000)
E: aes-cbc 8b56ee03 25cd2348 cd4a15d8 aaa0755b
A: hmac-sha1 df471b37 41063f59 37c5133e 386e80e6 4f4b07e8
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 3 11:36:22 2018 current: Feb 3 11:39:13 2018
diff: 171(s) hard: 28800(s) soft: 23040(s)
last: Feb 3 11:36:23 2018 hard: 0(s) soft: 0(s)
current: 252(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 3 hard: 0 soft: 0
sadb_seq=1 pid=949 refcnt=0
192.168.125.10[4500] 192.168.125.14[4500]
esp-udp mode=tunnel spi=190166737(0x0b55b6d1) reqid=0(0x00000000)
E: aes-cbc 71e0462c fe6a9bbb 656cb9b6 2233aa34
A: hmac-sha1 a1a0d1f5 280f9ec6 770d544a 5b0603a8 c49f45de
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 3 11:36:22 2018 current: Feb 3 11:39:13 2018
diff: 171(s) hard: 28800(s) soft: 23040(s)
last: Feb 3 11:36:23 2018 hard: 0(s) soft: 0(s)
current: 252(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 3 hard: 0 soft: 0
sadb_seq=0 pid=949 refcnt=0
# setkey -DP 有很多racoon加的条目. 其中有手动加的两行. 还有一行 fwd是自动出现的.
192.168.125.10[any] 192.168.125.14[any] 255
fwd prio def ipsec
esp/tunnel/192.168.125.10-192.168.125.14/require
created: Feb 3 11:22:28 2018 lastused:
lifetime: 0(s) validtime: 0(s)
spid=362 seq=21 pid=951
refcnt=1
192.168.125.10[any] 192.168.125.14[any] 255
in prio def ipsec
esp/tunnel/192.168.125.10-192.168.125.14/require
created: Feb 3 11:22:28 2018 lastused: Feb 3 11:36:25 2018
lifetime: 0(s) validtime: 0(s)
spid=352 seq=22 pid=951
refcnt=2
192.168.125.14[any] 192.168.125.10[any] 255
out prio def ipsec
esp/tunnel/192.168.125.14-192.168.125.10/require
created: Feb 3 11:22:28 2018 lastused: Feb 3 11:36:25 2018
lifetime: 0(s) validtime: 0(s)
spid=345 seq=23 pid=951
refcnt=2
-------------------------------
192.168.125.10
#cat /etc/racoon/racoon.conf
log notify;
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
listen {
adminsock disabled;
}
timer
{
# To keep the NAT-mappings on your NAT gateway, there must be
# The default is 20s. Set it to 0s to disable sending completely.
natt_keepalive 10 sec;
}
remote "192.168.125.14" {
remote_address 192.168.125.14;
exchange_mode main;
proposal {
encryption_algorithm aes;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 5;
}
generate_policy off;
nat_traversal force;
}
#
sainfo address 192.168.125.10/32[any] any address 192.168.125.14/32[any] any {
pfs_group 5;
encryption_algorithm aes;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
# cat psk.txt
192.168.125.14 abcd1234
spdadd -4 192.168.125.14/32 192.168.125.10/32 any -P in ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 192.168.125.10/32 192.168.125.14/32 any -P out ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
--------------
# setkey -D
192.168.125.10[4500] 192.168.125.14[4500]
esp-udp mode=tunnel spi=190166737(0x0b55b6d1) reqid=0(0x00000000)
E: aes-cbc 71e0462c fe6a9bbb 656cb9b6 2233aa34
A: hmac-sha1 a1a0d1f5 280f9ec6 770d544a 5b0603a8 c49f45de
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 3 11:36:22 2018 current: Feb 3 11:41:42 2018
diff: 320(s) hard: 28800(s) soft: 23040(s)
last: Feb 3 11:36:23 2018 hard: 0(s) soft: 0(s)
current: 252(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 3 hard: 0 soft: 0
sadb_seq=1 pid=1014 refcnt=0
192.168.125.14[4500] 192.168.125.10[4500]
esp-udp mode=tunnel spi=11506335(0x00af929f) reqid=0(0x00000000)
E: aes-cbc 8b56ee03 25cd2348 cd4a15d8 aaa0755b
A: hmac-sha1 df471b37 41063f59 37c5133e 386e80e6 4f4b07e8
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 3 11:36:22 2018 current: Feb 3 11:41:42 2018
diff: 320(s) hard: 28800(s) soft: 23040(s)
last: Feb 3 11:36:23 2018 hard: 0(s) soft: 0(s)
current: 252(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 3 hard: 0 soft: 0
sadb_seq=0 pid=1014 refcnt=0
# setkey -DP
192.168.125.10[any] 192.168.125.14[any] 255
out prio def ipsec
esp/tunnel/192.168.125.10-192.168.125.14/require
created: Feb 3 11:22:15 2018 lastused: Feb 3 11:36:25 2018
lifetime: 0(s) validtime: 0(s)
spid=521 seq=21 pid=1015
refcnt=3
192.168.125.14[any] 192.168.125.10[any] 255
fwd prio def ipsec
esp/tunnel/192.168.125.14-192.168.125.10/require
created: Feb 3 11:22:15 2018 lastused:
lifetime: 0(s) validtime: 0(s)
spid=514 seq=22 pid=1015
refcnt=1
192.168.125.14[any] 192.168.125.10[any] 255
in prio def ipsec
esp/tunnel/192.168.125.14-192.168.125.10/require
created: Feb 3 11:22:15 2018 lastused: Feb 3 11:36:25 2018
lifetime: 0(s) validtime: 0(s)
spid=504 seq=0 pid=1015
refcnt=1
----------------------------
racoon -F -d -d -d -v -L 启动. 有这样的提示表示racoon没有找到合适的 spd项目.
2018-02-03 13:32:24: DEBUG: pfkey.c:235:pfkey_handler(): got pfkey X_SPDDUMP message
2018-02-03 13:32:24: DEBUG2: plog.c:241:plogdump():
02120200 02000000 00000000 4f050000
2018-02-03 13:32:24: DEBUG: pfkey.c:252:pfkey_handler(): pfkey X_SPDDUMP failed: No such file or directory
我发现racoon.conf里的算法名字和setkey有些对不上. 不同的linux发行版也有差别! 感觉有点儿神奇!!
##################################
下面用setkey直接写sad spd.
这样设置简单. 少一个守护进程听在 500上.(这个进程的安全方面就不用考虑了)
同时也带来了一些问题. 没有 log 可以帮助排错.
没有racoon来判断你加进去的 spd条目是不是正确. 设置出了错只能一脸的茫然.
这种方式我还没想出办法来支持esp-udp封装. 因为没有进程会listen udp 4500.
--------
192.168.125.14
# cat file
add -4 192.168.125.10 192.168.125.14 esp 0x1001 -m tunnel
-E blowfish-cbc 0xf797fcaae3fb6320f25415ebd8adc525517620dc6bea4ff8f3cfe768d2cd219e1cf7c7e15ff7c72c3ab45b10712f92c8f01e72727f0fb622
-A hmac-sha1 0xd64ffbac35949351fb12dbc1774732e57fb4e471 ;
add -4 192.168.125.14 192.168.125.10 esp 0x2001 -m tunnel
-E blowfish-cbc 0x25bc815defd9fef626cad802d25752a0677f798ef7910aa16f89b9ae1dfe1c7561ba554c6fcb397786e1253c387677ef39c765e81ea2ef29
-A hmac-sha1 0x802aa95c18319dd8a0fc6be2d70c8560625569e5 ;
spdadd -4 192.168.125.14 192.168.125.10 any -P out ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 192.168.125.10 192.168.125.14 any -P in ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
#cat file |setkey -c
-------------
192.168.125.10
# cat file
add -4 192.168.125.10 192.168.125.14 esp 0x1001 -m tunnel
-E blowfish-cbc 0xf797fcaae3fb6320f25415ebd8adc525517620dc6bea4ff8f3cfe768d2cd219e1cf7c7e15ff7c72c3ab45b10712f92c8f01e72727f0fb622
-A hmac-sha1 0xd64ffbac35949351fb12dbc1774732e57fb4e471 ;
add -4 192.168.125.14 192.168.125.10 esp 0x2001 -m tunnel
-E blowfish-cbc 0x25bc815defd9fef626cad802d25752a0677f798ef7910aa16f89b9ae1dfe1c7561ba554c6fcb397786e1253c387677ef39c765e81ea2ef29
-A hmac-sha1 0x802aa95c18319dd8a0fc6be2d70c8560625569e5 ;
spdadd -4 192.168.125.14/32 192.168.125.10/32 any -P in ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 192.168.125.10/32 192.168.125.14/32 any -P out ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
ipsec没有网络接口,也没有路由的概念.
两边ipsec设备下面的网段的连通是因为符合 proxy id(spd条目) 被加上ipsec包头,转发到IPsec通道中.
这样来实现两个私有网段互联的. ipsec SA信息使这些内网数据包的下一跳指到ipsec对端的那台设备上去.
---------------
192.168.125.14上的设置.
这样的设置. 会把两端的私有网络(10.0.10.0/24 <-->10.0.14.0/24) 通信数据放到esp tunnel中.
但是 ipsec SA两端设备的通信确不会被加上 esp tunnel数据.
add -4 192.168.125.10 192.168.125.14 esp 0x1001 -m tunnel
-E blowfish-cbc 0xf797fcaae3fb6320f25415ebd8adc525517620dc6bea4ff8f3cfe768d2cd219e1cf7c7e15ff7c72c3ab45b10712f92c8f01e72727f0fb622
-A hmac-sha1 0xd64ffbac35949351fb12dbc1774732e57fb4e471 ;
add -4 192.168.125.14 192.168.125.10 esp 0x2001 -m tunnel
-E blowfish-cbc 0x25bc815defd9fef626cad802d25752a0677f798ef7910aa16f89b9ae1dfe1c7561ba554c6fcb397786e1253c387677ef39c765e81ea2ef29
-A hmac-sha1 0x802aa95c18319dd8a0fc6be2d70c8560625569e5 ;
#spdadd -4 192.168.125.14 192.168.125.10 any -P out ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
#spdadd -4 192.168.125.10 192.168.125.14 any -P in ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
spdadd -4 10.0.14.0/24 10.0.10.0/24 any -P out ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 10.0.10.0/24 10.0.14.0/24 any -P in ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
----------------
对端 192.168.125.10上的设置
add -4 192.168.125.10 192.168.125.14 esp 0x1001 -m tunnel
-E blowfish-cbc 0xf797fcaae3fb6320f25415ebd8adc525517620dc6bea4ff8f3cfe768d2cd219e1cf7c7e15ff7c72c3ab45b10712f92c8f01e72727f0fb622
-A hmac-sha1 0xd64ffbac35949351fb12dbc1774732e57fb4e471 ;
add -4 192.168.125.14 192.168.125.10 esp 0x2001 -m tunnel
-E blowfish-cbc 0x25bc815defd9fef626cad802d25752a0677f798ef7910aa16f89b9ae1dfe1c7561ba554c6fcb397786e1253c387677ef39c765e81ea2ef29
-A hmac-sha1 0x802aa95c18319dd8a0fc6be2d70c8560625569e5 ;
#spdadd -4 192.168.125.14/32 192.168.125.10/32 any -P in ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
#spdadd -4 192.168.125.10/32 192.168.125.14/32 any -P out ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
spdadd -4 10.0.14.0/24 10.0.10.0/24 any -P in ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 10.0.10.0/24 10.0.14.0/24 any -P out ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
-----------------
两个公网设备的通信抓包
01:23:51.576012 IP 192.168.125.14 > 192.168.125.10: ICMP echo request, id 810, seq 4, length 64
01:23:51.576406 IP 192.168.125.10 > 192.168.125.14: ICMP echo reply, id 810, seq 4, length 64
01:23:52.599946 IP 192.168.125.14 > 192.168.125.10: ICMP echo request, id 810, seq 5, length 64
01:23:52.600323 IP 192.168.125.10 > 192.168.125.14: ICMP echo reply, id 810, seq 5, length 64
01:23:53.623919 IP 192.168.125.14 > 192.168.125.10: ICMP echo request, id 810, seq 6, length 64
私有网络通信的数据.
01:23:33.158374 IP 192.168.125.10 > 192.168.125.14: ESP(spi=0x00001001,seq=0x2c), length 116
01:23:33.158900 IP 192.168.125.14 > 192.168.125.10: ESP(spi=0x00002001,seq=0x2c), length 116
01:23:34.159797 IP 192.168.125.10 > 192.168.125.14: ESP(spi=0x00001001,seq=0x2d), length 116
01:23:34.160281 IP 192.168.125.14 > 192.168.125.10: ESP(spi=0x00002001,seq=0x2d), length 116
-------------------------
如果ipsec两端设备的通信也需要保护. 那就把上面配置中注释掉的两行 sp加上.
这里不细写了. 测试效果完全正常.
使用setkey设置 spd, 再使用 racoon来协商 sa信息并支持natt .
[192.168.125.10/30]<--(路由)-->[192.168.125.14/30]
没有所带的网段. 只测试了两点间的通信. 后面带网段时是要再写spd信息吗?
配置里直接启动了 nat-t 不启动它时配置文件差一行. ipsec的封装用的是 esp启动nat-t封装用的是 esp-udp
-----------
192.168.125.14#cat /etc/racoon/racoon.conf
log notify;
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
listen {
adminsock disabled;
}
timer
{
# To keep the NAT-mappings on your NAT gateway, there must be
# The default is 20s. Set it to 0s to disable sending completely.
natt_keepalive 10 sec;
}
remote "192.168.125.10" {
remote_address 192.168.125.10;
exchange_mode main;
proposal {
encryption_algorithm aes;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 5;
}
generate_policy off;
nat_traversal force;
}
sainfo address 192.168.125.14/32[any] any address 192.168.125.10/32[any] any {
pfs_group 5;
encryption_algorithm aes;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
#cat psk.txt
192.168.125.10 abcd1234
#手动加上
spdadd -4 192.168.125.14 192.168.125.10 any -P out ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 192.168.125.10 192.168.125.14 any -P in ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
--------------------
# setkey -D
192.168.125.14[4500] 192.168.125.10[4500]
esp-udp mode=tunnel spi=11506335(0x00af929f) reqid=0(0x00000000)
E: aes-cbc 8b56ee03 25cd2348 cd4a15d8 aaa0755b
A: hmac-sha1 df471b37 41063f59 37c5133e 386e80e6 4f4b07e8
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 3 11:36:22 2018 current: Feb 3 11:39:13 2018
diff: 171(s) hard: 28800(s) soft: 23040(s)
last: Feb 3 11:36:23 2018 hard: 0(s) soft: 0(s)
current: 252(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 3 hard: 0 soft: 0
sadb_seq=1 pid=949 refcnt=0
192.168.125.10[4500] 192.168.125.14[4500]
esp-udp mode=tunnel spi=190166737(0x0b55b6d1) reqid=0(0x00000000)
E: aes-cbc 71e0462c fe6a9bbb 656cb9b6 2233aa34
A: hmac-sha1 a1a0d1f5 280f9ec6 770d544a 5b0603a8 c49f45de
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 3 11:36:22 2018 current: Feb 3 11:39:13 2018
diff: 171(s) hard: 28800(s) soft: 23040(s)
last: Feb 3 11:36:23 2018 hard: 0(s) soft: 0(s)
current: 252(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 3 hard: 0 soft: 0
sadb_seq=0 pid=949 refcnt=0
# setkey -DP 有很多racoon加的条目. 其中有手动加的两行. 还有一行 fwd是自动出现的.
192.168.125.10[any] 192.168.125.14[any] 255
fwd prio def ipsec
esp/tunnel/192.168.125.10-192.168.125.14/require
created: Feb 3 11:22:28 2018 lastused:
lifetime: 0(s) validtime: 0(s)
spid=362 seq=21 pid=951
refcnt=1
192.168.125.10[any] 192.168.125.14[any] 255
in prio def ipsec
esp/tunnel/192.168.125.10-192.168.125.14/require
created: Feb 3 11:22:28 2018 lastused: Feb 3 11:36:25 2018
lifetime: 0(s) validtime: 0(s)
spid=352 seq=22 pid=951
refcnt=2
192.168.125.14[any] 192.168.125.10[any] 255
out prio def ipsec
esp/tunnel/192.168.125.14-192.168.125.10/require
created: Feb 3 11:22:28 2018 lastused: Feb 3 11:36:25 2018
lifetime: 0(s) validtime: 0(s)
spid=345 seq=23 pid=951
refcnt=2
-------------------------------
192.168.125.10
#cat /etc/racoon/racoon.conf
log notify;
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
listen {
adminsock disabled;
}
timer
{
# To keep the NAT-mappings on your NAT gateway, there must be
# The default is 20s. Set it to 0s to disable sending completely.
natt_keepalive 10 sec;
}
remote "192.168.125.14" {
remote_address 192.168.125.14;
exchange_mode main;
proposal {
encryption_algorithm aes;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 5;
}
generate_policy off;
nat_traversal force;
}
#
sainfo address 192.168.125.10/32[any] any address 192.168.125.14/32[any] any {
pfs_group 5;
encryption_algorithm aes;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
# cat psk.txt
192.168.125.14 abcd1234
spdadd -4 192.168.125.14/32 192.168.125.10/32 any -P in ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 192.168.125.10/32 192.168.125.14/32 any -P out ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
--------------
# setkey -D
192.168.125.10[4500] 192.168.125.14[4500]
esp-udp mode=tunnel spi=190166737(0x0b55b6d1) reqid=0(0x00000000)
E: aes-cbc 71e0462c fe6a9bbb 656cb9b6 2233aa34
A: hmac-sha1 a1a0d1f5 280f9ec6 770d544a 5b0603a8 c49f45de
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 3 11:36:22 2018 current: Feb 3 11:41:42 2018
diff: 320(s) hard: 28800(s) soft: 23040(s)
last: Feb 3 11:36:23 2018 hard: 0(s) soft: 0(s)
current: 252(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 3 hard: 0 soft: 0
sadb_seq=1 pid=1014 refcnt=0
192.168.125.14[4500] 192.168.125.10[4500]
esp-udp mode=tunnel spi=11506335(0x00af929f) reqid=0(0x00000000)
E: aes-cbc 8b56ee03 25cd2348 cd4a15d8 aaa0755b
A: hmac-sha1 df471b37 41063f59 37c5133e 386e80e6 4f4b07e8
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Feb 3 11:36:22 2018 current: Feb 3 11:41:42 2018
diff: 320(s) hard: 28800(s) soft: 23040(s)
last: Feb 3 11:36:23 2018 hard: 0(s) soft: 0(s)
current: 252(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 3 hard: 0 soft: 0
sadb_seq=0 pid=1014 refcnt=0
# setkey -DP
192.168.125.10[any] 192.168.125.14[any] 255
out prio def ipsec
esp/tunnel/192.168.125.10-192.168.125.14/require
created: Feb 3 11:22:15 2018 lastused: Feb 3 11:36:25 2018
lifetime: 0(s) validtime: 0(s)
spid=521 seq=21 pid=1015
refcnt=3
192.168.125.14[any] 192.168.125.10[any] 255
fwd prio def ipsec
esp/tunnel/192.168.125.14-192.168.125.10/require
created: Feb 3 11:22:15 2018 lastused:
lifetime: 0(s) validtime: 0(s)
spid=514 seq=22 pid=1015
refcnt=1
192.168.125.14[any] 192.168.125.10[any] 255
in prio def ipsec
esp/tunnel/192.168.125.14-192.168.125.10/require
created: Feb 3 11:22:15 2018 lastused: Feb 3 11:36:25 2018
lifetime: 0(s) validtime: 0(s)
spid=504 seq=0 pid=1015
refcnt=1
----------------------------
racoon -F -d -d -d -v -L 启动. 有这样的提示表示racoon没有找到合适的 spd项目.
2018-02-03 13:32:24: DEBUG: pfkey.c:235:pfkey_handler(): got pfkey X_SPDDUMP message
2018-02-03 13:32:24: DEBUG2: plog.c:241:plogdump():
02120200 02000000 00000000 4f050000
2018-02-03 13:32:24: DEBUG: pfkey.c:252:pfkey_handler(): pfkey X_SPDDUMP failed: No such file or directory
我发现racoon.conf里的算法名字和setkey有些对不上. 不同的linux发行版也有差别! 感觉有点儿神奇!!
##################################
下面用setkey直接写sad spd.
这样设置简单. 少一个守护进程听在 500上.(这个进程的安全方面就不用考虑了)
同时也带来了一些问题. 没有 log 可以帮助排错.
没有racoon来判断你加进去的 spd条目是不是正确. 设置出了错只能一脸的茫然.
这种方式我还没想出办法来支持esp-udp封装. 因为没有进程会listen udp 4500.
--------
192.168.125.14
# cat file
add -4 192.168.125.10 192.168.125.14 esp 0x1001 -m tunnel
-E blowfish-cbc 0xf797fcaae3fb6320f25415ebd8adc525517620dc6bea4ff8f3cfe768d2cd219e1cf7c7e15ff7c72c3ab45b10712f92c8f01e72727f0fb622
-A hmac-sha1 0xd64ffbac35949351fb12dbc1774732e57fb4e471 ;
add -4 192.168.125.14 192.168.125.10 esp 0x2001 -m tunnel
-E blowfish-cbc 0x25bc815defd9fef626cad802d25752a0677f798ef7910aa16f89b9ae1dfe1c7561ba554c6fcb397786e1253c387677ef39c765e81ea2ef29
-A hmac-sha1 0x802aa95c18319dd8a0fc6be2d70c8560625569e5 ;
spdadd -4 192.168.125.14 192.168.125.10 any -P out ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 192.168.125.10 192.168.125.14 any -P in ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
#cat file |setkey -c
-------------
192.168.125.10
# cat file
add -4 192.168.125.10 192.168.125.14 esp 0x1001 -m tunnel
-E blowfish-cbc 0xf797fcaae3fb6320f25415ebd8adc525517620dc6bea4ff8f3cfe768d2cd219e1cf7c7e15ff7c72c3ab45b10712f92c8f01e72727f0fb622
-A hmac-sha1 0xd64ffbac35949351fb12dbc1774732e57fb4e471 ;
add -4 192.168.125.14 192.168.125.10 esp 0x2001 -m tunnel
-E blowfish-cbc 0x25bc815defd9fef626cad802d25752a0677f798ef7910aa16f89b9ae1dfe1c7561ba554c6fcb397786e1253c387677ef39c765e81ea2ef29
-A hmac-sha1 0x802aa95c18319dd8a0fc6be2d70c8560625569e5 ;
spdadd -4 192.168.125.14/32 192.168.125.10/32 any -P in ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 192.168.125.10/32 192.168.125.14/32 any -P out ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
##################################
继续测试一下. tunnel方式连接两个网段. 用 setkey 直接设置sad, spd .网络结构是这样的.
[10.0.10.2/24]<-->[10.0.10.1/24,192.168.125.10/30]<--(192.168.125.9/30,路由,192.168.125.13/30)-->[192.168.125.14/30,10.0.14.1/24]<-->[10.0.14.2/24]
最两端的 10.0.10.2和 10.0.14.2没有ipsec设置只进行测试
中间的路由只进行包转发.
ipsec设置在 192.168.125.10,192.168.125.14上.
所有的设备都是 linux (debian 9.3). 其实是同一台机器上的两个kvm虚拟机.虚拟机中再各启动一个 docker container.
假设 192.168的网段为公网段. 10.0的网段为私有网段.ipsec没有网络接口,也没有路由的概念.
两边ipsec设备下面的网段的连通是因为符合 proxy id(spd条目) 被加上ipsec包头,转发到IPsec通道中.
这样来实现两个私有网段互联的. ipsec SA信息使这些内网数据包的下一跳指到ipsec对端的那台设备上去.
---------------
192.168.125.14上的设置.
这样的设置. 会把两端的私有网络(10.0.10.0/24 <-->10.0.14.0/24) 通信数据放到esp tunnel中.
但是 ipsec SA两端设备的通信确不会被加上 esp tunnel数据.
add -4 192.168.125.10 192.168.125.14 esp 0x1001 -m tunnel
-E blowfish-cbc 0xf797fcaae3fb6320f25415ebd8adc525517620dc6bea4ff8f3cfe768d2cd219e1cf7c7e15ff7c72c3ab45b10712f92c8f01e72727f0fb622
-A hmac-sha1 0xd64ffbac35949351fb12dbc1774732e57fb4e471 ;
add -4 192.168.125.14 192.168.125.10 esp 0x2001 -m tunnel
-E blowfish-cbc 0x25bc815defd9fef626cad802d25752a0677f798ef7910aa16f89b9ae1dfe1c7561ba554c6fcb397786e1253c387677ef39c765e81ea2ef29
-A hmac-sha1 0x802aa95c18319dd8a0fc6be2d70c8560625569e5 ;
#spdadd -4 192.168.125.14 192.168.125.10 any -P out ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
#spdadd -4 192.168.125.10 192.168.125.14 any -P in ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
spdadd -4 10.0.14.0/24 10.0.10.0/24 any -P out ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 10.0.10.0/24 10.0.14.0/24 any -P in ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
----------------
对端 192.168.125.10上的设置
add -4 192.168.125.10 192.168.125.14 esp 0x1001 -m tunnel
-E blowfish-cbc 0xf797fcaae3fb6320f25415ebd8adc525517620dc6bea4ff8f3cfe768d2cd219e1cf7c7e15ff7c72c3ab45b10712f92c8f01e72727f0fb622
-A hmac-sha1 0xd64ffbac35949351fb12dbc1774732e57fb4e471 ;
add -4 192.168.125.14 192.168.125.10 esp 0x2001 -m tunnel
-E blowfish-cbc 0x25bc815defd9fef626cad802d25752a0677f798ef7910aa16f89b9ae1dfe1c7561ba554c6fcb397786e1253c387677ef39c765e81ea2ef29
-A hmac-sha1 0x802aa95c18319dd8a0fc6be2d70c8560625569e5 ;
#spdadd -4 192.168.125.14/32 192.168.125.10/32 any -P in ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
#spdadd -4 192.168.125.10/32 192.168.125.14/32 any -P out ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
spdadd -4 10.0.14.0/24 10.0.10.0/24 any -P in ipsec esp/tunnel/192.168.125.14-192.168.125.10/require;
spdadd -4 10.0.10.0/24 10.0.14.0/24 any -P out ipsec esp/tunnel/192.168.125.10-192.168.125.14/require;
-----------------
两个公网设备的通信抓包
01:23:51.576012 IP 192.168.125.14 > 192.168.125.10: ICMP echo request, id 810, seq 4, length 64
01:23:51.576406 IP 192.168.125.10 > 192.168.125.14: ICMP echo reply, id 810, seq 4, length 64
01:23:52.599946 IP 192.168.125.14 > 192.168.125.10: ICMP echo request, id 810, seq 5, length 64
01:23:52.600323 IP 192.168.125.10 > 192.168.125.14: ICMP echo reply, id 810, seq 5, length 64
01:23:53.623919 IP 192.168.125.14 > 192.168.125.10: ICMP echo request, id 810, seq 6, length 64
私有网络通信的数据.
01:23:33.158374 IP 192.168.125.10 > 192.168.125.14: ESP(spi=0x00001001,seq=0x2c), length 116
01:23:33.158900 IP 192.168.125.14 > 192.168.125.10: ESP(spi=0x00002001,seq=0x2c), length 116
01:23:34.159797 IP 192.168.125.10 > 192.168.125.14: ESP(spi=0x00001001,seq=0x2d), length 116
01:23:34.160281 IP 192.168.125.14 > 192.168.125.10: ESP(spi=0x00002001,seq=0x2d), length 116
-------------------------
如果ipsec两端设备的通信也需要保护. 那就把上面配置中注释掉的两行 sp加上.
这里不细写了. 测试效果完全正常.