I've been trying to resolve a site to site VPN issue for days. I am connecting to a corporate VPN that I do not have control over or access to the settings of. I am running a Digitalocean VPS (not sure if DO specific infrastucture plays a role here) running Ubuntu 16.04 & using Strongswan 5.3.5
I have gone as far as getting what appears to be a successful connection to the VPN confirmed by the network engineer on that end. They can't see any traffic from me & I can't get ping replies from servers on their subnet.
Please help. Not a networking pro, you're welcome (and encouraged) to explain to me like I'm 5. I don't have additional servers to the VPS with Strongswan installed. I need to communicate to the Corporate Servers from the same VPS
ME (VPS) <<<>>> internet <<<>>> CORPORATE VPN <<<>>> CORP SERVERS
138.xx.xx.xx <> internet <> 41.yy.yy.yy <> 172.zz.zz.zz
All info below is taken while VPN tunnel is up.
ipsec statusall
$: ipsec statusall
Status of IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-96-generic, x86_64):
uptime: 20 minutes, since Sep 28 10:30:07 2017
malloc: sbrk 1634304, mmap 0, used 582896, free 1051408
worker threads: 7 of 16 idle, 5/0/4/0 working, job queue: 0/0/0/0, scheduled: 6
loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac ccm gcm attr kernel-libipsec kernel-netlink resolve socket-default connmark farp stroke updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-pam xauth-noauth tnc-tnccs tnccs-20 tnccs-11 tnccs-dynamic dhcp lookip error-notify certexpire led addrblock unity
Listening IP addresses:
138.xx.xx.xx
10.16.0.5
Connections:
my-conn: 138.xx.xx.xx...41.yy.yy.yy IKEv2
my-conn: local: [138.xx.xx.xx] uses pre-shared key authentication
my-conn: remote: [41.yy.yy.yy] uses pre-shared key authentication
my-conn: child: 138.xx.xx.xx/32 === 172.zz.zz.zz/24 TUNNEL
Security Associations (1 up, 0 connecting):
my-conn[1]: ESTABLISHED 20 minutes ago, 138.xx.xx.xx[138.xx.xx.xx]...41.yy.yy.yy[41.yy.yy.yy]
my-conn[1]: IKEv2 SPIs: 981bda0c250576ed_i 890fb1ffd688230e_r*, pre-shared key reauthentication in 7 hours
my-conn[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536
my-conn{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: dbb4f9b1_i 0d49761f_o
my-conn{1}: AES_CBC_256/HMAC_SHA2_256_128, 0 bytes_i, 252 bytes_o (3 pkts, 1197s ago), rekeying in 23 hours
my-conn{1}: 138.xx.xx.xx/32 === 172.ww.ww.ww/32
my-conn{2}: INSTALLED, TUNNEL, reqid 2, ESP in UDP SPIs: 6e95fb25_i 09e475d6_o
my-conn{2}: AES_CBC_256/HMAC_SHA2_256_128, 0 bytes_i, 0 bytes_o, rekeying in 23 hours
my-conn{2}: 138.xx.xx.xx/32 === 172.ww.ww.zz/32
contents of ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file
config setup
cachecrls=yes
uniqueids=yes
nat_traversal=yes
conn %default
ikelifetime=28800s
lifetime=1440m
margintime=3m
keyingtries=2
authby=secret
keyexchange=ikev2
conn my-conn
type=tunnel
left=138.xx.xx.xx
leftsubnet=138.xx.xx.xx
#leftfirewall=yes
right=41.yy.yy.yy
rightsubnet=172.zz.zz.zz/24
ike=aes256-sha256-modp1536
esp=aes256-sha256-modp1536
auto=add
#rightsourceip=172.ww.ww.yy,172.ww.ww.zz
contents of iptables-save
# Generated by iptables-save v1.6.0 on Wed Sep 27 14:36:20 2017
*mangle
:PREROUTING ACCEPT [11416:1336562]
:INPUT ACCEPT [11416:1336562]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [12308:1948095]
:POSTROUTING ACCEPT [12308:1948095]
COMMIT
# Completed on Wed Sep 27 14:36:20 2017
# Generated by iptables-save v1.6.0 on Wed Sep 27 14:36:20 2017
*nat
:PREROUTING ACCEPT [4:200]
:INPUT ACCEPT [2:120]
:OUTPUT ACCEPT [4:266]
:POSTROUTING ACCEPT [4:266]
-A POSTROUTING -s 10.16.0.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -s 10.16.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Sep 27 14:36:20 2017
# Generated by iptables-save v1.6.0 on Wed Sep 27 14:36:20 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [11109:1768005]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -j DROP
-A INPUT -p esp -j ACCEPT
COMMIT
iproute show
$: ip route show
default via 138.xx.xx.xx dev eth0 onlink
10.16.0.0/16 dev eth0 proto kernel scope link src 10.16.0.5
138.xx.xx.xx/20 dev eth0 proto kernel scope link src 138.xx.xx.xx
ifconfig
$: ifconfig
eth0 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
inet addr:138.xx.xx.xx Bcast:138.xx.xx.255 Mask:255.255.xx.0
inet6 addr: fe80::78ab:64ff:fee9:a6a5/64 Scope:Link
inet6 addr: XXXX::XXXX:XXXX:XXXX:XXXX/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:91775 errors:0 dropped:0 overruns:0 frame:0
TX packets:100307 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:14598431 (14.5 MB) TX bytes:23615037 (23.6 MB)
ipsec0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1400 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:12670 errors:0 dropped:0 overruns:0 frame:0
TX packets:12670 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:722578 (722.5 KB) TX bytes:722578 (722.5 KB)
ip route show
$: ip route show table 220
172.zz.zz.yy dev ipsec0 proto static src 138.xx.xx.xx