Join Log in
Score:0
kita avatar Server

ipsec xfrm esp routing

nc flag
kita

i need a little help/explanation why the following netsetup is not working:

PC1 (192.168.66.1) <-- PLAIN --> (192.168.66.2)PC-GW(192.168.88.2) <-- ESP --> (192.168.88.1) PC2

I can send packets from PC1 192.168.66.1 to PC2 192.168.88.1 and the PC-GW encapsulate esp and the PC2 recv the esp packets, it works fine.

But if i send esp packets from PC2 192.168.88.1 to PC1 192.168.66.1, the PC-GW forwaded the esp packets without decapsulate/decryption and PC1 gets an esp packet.

If both systems use ESP it works fine:

PC1 (192.168.66.1) <-- ESP--> (192.168.88.1) PC2

I have tried several different configuration, this is the commands i use:

ip xfrm state add src 192.168.66.1/32 dst 192.168.88.1/32 proto esp spi 0x01000000 reqid 0x01000000 mode transport aead 'rfc4106(gcm(aes))' 0x000000000000000000000000000000000000000000000000000000000000000000000000 128 sel src 192.168.66.1/32 dst 192.168.88.1/32
ip xfrm state add src 192.168.88.1/32 dst 192.168.66.1/32 proto esp spi 0x01000000 reqid 0x02000000 mode transport aead 'rfc4106(gcm(aes))' 0x000000000000000000000000000000000000000000000000000000000000000000000000 128 sel src 192.168.88.1/32 dst 192.168.66.1/32
ip xfrm policy add src 192.168.66.1/32 dst 192.168.88.1/32 dir out tmpl src 192.168.66.1/32 dst 192.168.88.1/32 proto esp reqid 0x01000000 mode transport
ip xfrm policy add src 192.168.88.1/32 dst 192.168.66.1/32 dir in tmpl src 192.168.88.1/32 dst 192.168.66.1/32 proto esp reqid 0x02000000 mode transport

With help of tcpdump i have captured all interfaces.

I don't use openswap, this test setup is not a real use scenario. This is just to try out and i want to learn how it works.

358
1 + 0
Score:1
avatar Server
cn flag
ecdsa

That's not how Transport Mode is supposed to be used (i.e. with forwarded traffic and IP addresses that are not local to the system). You might want to to look into BEET mode (never standardized), which is similar to Transport Mode, in that it does not add an additional IP header, but allows replacing the source and destination IP addresses and which the Linux kernel and some IKE daemons support.

Having said that, let me try to explain what you are seeing. The Linux kernel matches forwarded traffic first against fwd policies, but then also against out policies, which is why the outbound traffic is processed by the outbound IPsec SA. However, there is no IPsec SA lookup for the inbound traffic because the destination IP address is not local, i.e. that traffic is forwarded right away for best performance.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.