Incoming IPSec traffic on Linux host is not processed via the VTI tunnel using XFRM rules

dimitri

6/5/24, 3:31 PM

I have the following setup:

Remote IPSec VPN gateway: 81.x.x.x
Local machine address: 172.22.1.156
VPN-assigned IP: 10.0.30.97

VTI tunnel interface:

vti0: ip/ip remote 81.x.x.x local 172.22.1.156 ttl inherit nopmtudisc key 1000
inet 10.0.30.97/22 scope global vti0

Route to remote subnet 10.x.x.x:

10.0.0.0/8 dev vti0 scope link 
10.0.28.0/22 dev vti0 proto kernel scope link src 10.0.30.97

XFRM state:

src 81.x.x.x dst 172.22.1.156
        proto esp spi 0xxxxxxxxx reqid 0 mode tunnel
        replay-window 0 
        auth-trunc hmac(sha256) 0xxxxx 128
        enc cbc(aes) 0xxxxx
        encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
        anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
        sel src 0.0.0.0/0 dst 0.0.0.0/0 
src 172.22.1.156 dst 81.x.x.x
        proto esp spi 0xxxxxxxxx reqid 0 mode tunnel
        replay-window 0 
        auth-trunc hmac(sha256) 0xxxxxxxxx 128
        enc cbc(aes) 0xxxxxxxxx
        encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
        anti-replay context: seq 0x0, oseq 0x26, bitmap 0x00000000
        sel src 0.0.0.0/0 dst 0.0.0.0/0

XFRM policy:

src 0.0.0.0/0 dst 0.0.0.0/0 
        dir in priority 0 ptype main 
        mark 0x3e8/0xffffffff 
        tmpl src 81.x.x.x dst 172.22.1.156
                proto esp reqid 0 mode tunnel
src 0.0.0.0/0 dst 0.0.0.0/0 
        dir out priority 0 ptype main 
        mark 0x3e8/0xffffffff 
        tmpl src 172.22.1.156 dst 81.x.x.x
                proto esp reqid 0 mode tunnel

With this setup there is a problem with incoming IPSec traffic routing. According to the wireshark logs the packets go correctly in both directions, for example I can ping the remote host on 10.x.x.x subnet and there is an encrypted ESP reply returned (containing ICMP encapsulated data) but it never gets processed on the VTI tunnel and forwarded to 172.22.1.156. Decryption and auth keys are set correctly and can decrypt incoming ESP packets in the wireshark. Is there any additional policy or route missing?

110

1 + 0

linux

ipsec

Score:0

Server

dimitri

6/10/24, 3:46 PM

Answering my own question:

Automatic UDP IPSec decapsulation only works on Linux if there is a listening UDP socket on port 4500 with UDP_ENCAP socket option set to UDP_ENCAP_ESPINUDP.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Incoming IPSec traffic on Linux host is not processed via the VTI tunnel using XFRM rules

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.