Question

我试图像在Strongswan测试net2net-gw中那样重现架构，但是在NAT后面加上“ moon”和“ sun”（请参阅https://www.strongswan.org/testing/testresults/swanctl/net2net-gw/）。到目前为止，已经配置了CA，发布了证书，配置了mikrotik，我可以建立隧道并设置SA，但是我无法从另一个站点ping一个站点。卡罗尔配置：

connections {

    gw-base {
        local {
            auth = pubkey
            certs = carol.crt
            id = carol
        }
        remote {
            auth = pubkey
        }
        children {
            net {
                esp_proposals = aes128-sha1-modp2048,aes256-sha256-modp2048
            }
        }
        version = 2
        mobike = no
        proposals = aes128-sha1-modp2048,aes256-sha256-modp2048
        pools = pool-ipv4
    }

    gw-moon : connections.gw-base{
        remote {
            id = moon
        }
        children {
            net {
                local_ts  = 192.168.3.0/24
                remote_ts = 192.168.1.0/24

                updown = /usr/libexec/strongswan/_updown iptables
            }
        }
    }

    gw-sun : connections.gw-base {
        remote {
        id = sun
        }
        children {
            net {
                local_ts  = 192.168.1.0/24
                remote_ts = 192.168.3.0/24

                updown = /usr/libexec/strongswan/_updown iptables
            }
        }
    }
}

pools {
    pool-ipv4 {
        addrs = 192.168.99.0/24
    }
}

这是“月球” mikrotik配置本地子网192.168.1.0/24：

/ip ipsec mode-config
add name=ike2 responder=no
/ip ipsec policy group
add name=ike2
/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-128
add dh-group=modp2048 enc-algorithm=aes-128 name=ike2
/ip ipsec peer
add address=carol exchange-mode=ike2 name=ike2 profile=ike2
/ip ipsec proposal
add enc-algorithms=aes-128-cbc name=ike2 pfs-group=modp2048
/ip ipsec identity
add auth-method=digital-signature certificate=moon.p12_0 generate-policy=port-strict mode-config=ike2 notrack-chain=prerouting peer=ike2 policy-template-group=ike2
/ip ipsec policy
add dst-address=192.168.3.0/24 group=ike2 proposal=ike2 src-address=192.168.1.0/24 template=yes
/ip ipsec settings
set accounting=no

这是“ sun” mikrotik配置本地子网192.168.3.0/24：

/ip ipsec mode-config
add name=ike2 responder=no
/ip ipsec policy group
add name=ike2
/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-128
add dh-group=modp2048 enc-algorithm=aes-128 name=ike2
/ip ipsec peer
add address=carol exchange-mode=ike2 name=ike2 profile=ike2
/ip ipsec proposal
add enc-algorithms=aes-128-cbc name=ike2 pfs-group=modp2048
/ip ipsec identity
add auth-method=digital-signature certificate=sun.p12_0 generate-policy=port-strict mode-config=ike2 notrack-chain=prerouting peer=ike2 policy-template-group=ike2
/ip ipsec policy
add dst-address=192.168.1.0/24 group=ike2 proposal=ike2 src-address=192.168.3.0/24 template=yes
/ip ipsec settings
set accounting=no

swanctl -l的

“颂歌”输出

gw-moon: #12, ESTABLISHED, IKEv2, 278ded8c94f60a25_i dc1ea6a863cbbc3f_r*
  local  'carol' @ PUBLICIP[4500]
  remote 'moon' @ NATIP[9860] [192.168.99.1]
  AES_CBC-128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
  established 1938s ago, rekeying in 11168s
  net: #11, reqid 8, INSTALLED, TUNNEL-in-UDP, ESP:AES_CBC-128/HMAC_SHA1_96/MODP_2048
    installed 498s ago, rekeying in 2840s, expires in 3462s
    in  cb0314bb,      0 bytes,     0 packets
    out 0159b817,      0 bytes,     0 packets
    local  192.168.3.0/24
    remote 192.168.1.0/24
gw-sun: #11, ESTABLISHED, IKEv2, b972f69efe68b876_i 1c57914f302e627b_r*
  local  'carol' @ PUBLICIP[4500]
  remote 'sun' @ NATIP[4500] [192.168.99.2]
  AES_CBC-128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
  established 1962s ago, rekeying in 11975s
  net: #10, reqid 7, INSTALLED, TUNNEL-in-UDP, ESP:AES_CBC-128/HMAC_SHA1_96/MODP_2048
    installed 519s ago, rekeying in 2890s, expires in 3441s
    in  c3a515f5,      2856 bytes,    34 packets,     0s ago
    out 0b5614c6,      0 bytes,     0 packets
    local  192.168.1.0/24
    remote 192.168.3.0/24

“颂歌” iptables具有：

-A FORWARD -s 192.168.1.0/24 -d 192.168.3.0/24 -i eth0 -m policy --dir in --pol ipsec --reqid 8 --proto esp -j ACCEPT
-A FORWARD -s 192.168.3.0/24 -d 192.168.1.0/24 -o eth0 -m policy --dir out --pol ipsec --reqid 8 --proto esp -j ACCEPT
-A FORWARD -s 192.168.3.0/24 -d 192.168.1.0/24 -i eth0 -m policy --dir in --pol ipsec --reqid 7 --proto esp -j ACCEPT
-A FORWARD -s 192.168.1.0/24 -d 192.168.3.0/24 -o eth0 -m policy --dir out --pol ipsec --reqid 7 --proto esp -j ACCEPT

“ carol”具有sysctl

net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

当我从“ sun”后面的工作站192.168.3.254之一运行ping时，“ carol” tcpdump净为192.168.0.0/16：

08:46:57.820968 IP 192.168.3.254 > 192.168.1.1: ICMP echo request, id 30901, seq 357, length 64
08:46:57.821075 IP PUBLICIP > 192.168.1.1: ICMP echo request, id 30901, seq 357, length 64

PUBLICIP = carols public internet ip
NATIP = sun & moon nat ip

我尝试从“ sun” ping 192.168.1.1时，我看到该数据包计数器增加了，但没有回复，就像我从“ moon”中ping 192.168.3.1一样。但是，如果我断开“ sun”并将虚拟IP地址192.168.3.1添加到从“ moon”到192.168.3.1的carol ip addr add 192.168.3.1/24 dev eth0 ping会成功，但是奇怪的是-我无法从carol ping到“ moon” ...

谢谢您的任何建议：）

两个Mikrotik站点通过公共IP到达了Strongswan的NAT之后

0 个答案: