数码资讯
两个AWS实例之间的Strongswan VPN隧道将无法连接
正如您将在下面看到的,我得到的错误是“写入套接字时出错：无效参数”.我在网上看了,真的找不到解决方案.我确信我的strongswan ipsec.conf配置不正确.
这是我正在使用的：
Instance #1: N.Virginia - 10.198.0.164 with public EIP 54.X.X.X Instance #2: Oregon - 10.194.0.176 with public EIP 52.Y.Y.Y
(简单)拓扑如下：
[ Instance #1 within N.Virginia VPC <-> Public internet <-> Instance #2 within Oregon VPC ]
我确认以下AWS配置是正确的：
Security groups permit all IP information is correct Src/Dest disabled on both instances ACLs permit all routes are present and correct (route to 10.x will point to that local instance in order to be routed out to the VPN tunnel)
下面是/etc/ipsec.conf(这是来自Oregon,但它在N.Virginia实例上是相同的,除了左|右值相反)：
config setup
charondebug="dmn 2, mgr 2, ike 2, chd 2, job 2, cfg 2, knl 2, net 2, enc 2, lib 2"
conn aws1oexternal-aws1nvexternal
left=52.Y.Y.Y (EIP)
leftsubnet=10.194.0.0/16
right=54.X.X.X (EIP)
rightsubnet=10.198.0.0/16
auto=start
authby=secret
type=tunnel
mobike=no
dpdaction=restart
下面是/etc/ipsec.secrets *(显然与其他实例相反)：
54.X.X.X 52.Y.Y.Y : PSK "Key_inserted_here"
下面是/etc/strongswan.conf：
charon {
load_modular = yes
plugins {
include strongswan.d/charon/*.conf
}
}
下面是/etc/sysctl.conf：
net.ipv4.ip_forward=1 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.send_redirects = 0
这是来自/ var / log / syslog的调试输出这里的问题似乎是“写入socket的错误：无效的参数;在我尝试的所有内容之后,我继续得到同样的错误：
Jun 17 17:34:48 ip-10-198-0-164 charon: 13[IKE] retransmit 5 of request with message ID 0 Jun 17 17:34:48 ip-10-198-0-164 charon: 13[NET] sending packet: from 54.X.X.X[500] to 52.Y.Y.Y[500] (1212 bytes) Jun 17 17:34:48 ip-10-198-0-164 charon: 03[JOB] next event in 75s 581ms, waiting] Jun 17 17:34:48 ip-10-198-0-164 charon: 16[NET] sending packet: from 54.X.X.X[500] to 52.Y.Y.Y[500] Jun 17 17:34:48 ip-10-198-0-164 charon: 13[MGR] checkin IKE_SA aws1vexternal-aws1oexternal[1] Jun 17 17:34:48 ip-10-198-0-164 charon: 13[MGR] check-in of IKE_SA successful. Jun 17 17:34:48 ip-10-198-0-164 charon: 16[NET] error writing to socket: Invalid argument Jun 17 17:36:04 ip-10-198-0-164 charon: 03[JOB] got event, queuing job for execution Jun 17 17:36:04 ip-10-198-0-164 charon: 03[JOB] no events, waiting Jun 17 17:36:04 ip-10-198-0-164 charon: 08[MGR] checkout IKE_SA Jun 17 17:36:04 ip-10-198-0-164 charon: 08[MGR] IKE_SA aws1vexternal-aws1oexternal[1] successfully checked out Jun 17 17:36:04 ip-10-198-0-164 charon: 08[IKE] giving up after 5 retransmits Jun 17 17:36:04 ip-10-198-0-164 charon: 08[IKE] establishing IKE_SA failed, peer not responding Jun 17 17:36:04 ip-10-198-0-164 charon: 08[MGR] checkin and destroy IKE_SA aws1vexternal-aws1oexternal[1] Jun 17 17:36:04 ip-10-198-0-164 charon: 08[IKE] IKE_SA aws1vexternal-aws1oexternal[1] state change: CONNECTING => DESTROYING Jun 17 17:36:04 ip-10-198-0-164 charon: 08[MGR] check-in and destroy of IKE_SA successful
以下是我到目前为止所尝试的内容：
1)验证第3层
2)重启机器
3)尝试添加leftid =
4)尝试做ipsec更新然后ipsec重启
5)尝试在confif设置下添加nat_traversal = yes(请注意,这应该无关紧要,因为ipsec statusall使用IKEv2验证,根据文档自动使用nat_traversal)
6)尝试省略virtual_private< - 根据AWS openswan文档使用,因此我将其包含在strongswan配置中. 7)尝试在/etc/sysctl.conf中禁用net.ipv4.conf.all.send_redirects = 0和net.ipv4.conf.all.accept_redirects = 0 8)尝试使用私有IP而不是EIP.我不再收到套接字错误,但显然两个IP无法相互通信到对等… 9)尝试将此添加到strongswan.conf：load = aes des sha1 sha2 md5 gmp random nonce hmac stroke kernel-netlink socket-default updown 10)尝试使用leftfirewall = yes,没有用 请帮忙！谢谢！ 编辑#1： 迈克尔的回答清除了原来的问题,但是我有一个与路由有关的新问题.两个VPN实例都无法互相ping通.此外,当我尝试从任一子网中的随机实例ping到另一个随机实例或远端VPN实例时,我得到以下ping响应：
root@ip-10-194-0-80:~# ping 10.198.0.164 PING 10.198.0.164 (10.198.0.164) 56(84) bytes of data. From 10.194.0.176: icmp_seq=1 Redirect Host(New nexthop: 10.194.0.176) From 10.194.0.176: icmp_seq=2 Redirect Host(New nexthop: 10.194.0.176) From 10.194.0.176: icmp_seq=3 Redirect Host(New nexthop: 10.194.0.176) From 10.194.0.176: icmp_seq=4 Redirect Host(New nexthop: 10.194.0.176)
显然这必须是两个VPN实例之间的路由问题(很可能是由于strongswan配置或实例路由表),因为Oregon子网中的10.194.0.80主机能够从Oregon VPN实例接收响应.实例上的路由表traceroute：
root@ip-10-194-0-80:~# netstat -rn Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 10.194.0.1 0.0.0.0 UG 0 0 0 eth0 10.194.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 root@ip-10-194-0-80:~# traceroute 10.198.0.164 traceroute to 10.198.0.164 (10.198.0.164), 30 hops max, 60 byte packets 1 10.194.0.176 (10.194.0.176) 0.441 ms 0.425 ms 0.409 ms^C
当我使用openswan时,它不需要我对每个实例的路由表进行任何手动修改.
这是Oregon VPN实例的路由表：
root@ip-10-194-0-176:~# netstat -rn Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 10.194.0.1 0.0.0.0 UG 0 0 0 eth0 10.194.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
我有点难过.
编辑#2：
看起来VPN实例之间的路由可能不是问题：/ var / log / syslog显示从一个VPN实例公共IP收到的数据包到另一个VPN实例
Jun 23 19:57:49 ip-10-194-0-176 charon: 10[NET] received packet: from 54.X.X.X[4500] to 10.194.0.176[4500] (76 bytes)
看起来这是与儿童安全协会有关的问题：
aws1oexternal-aws1nvexternal: child: 10.194.0.0/16 === 10.198.0.0/16 TUNNEL, dpdaction=restart Security Associations (1 up, 0 **connecting**):
在/ var / log / syslog的：
Jun 23 19:52:19 ip-10-194-0-176 charon: 02[IKE] failed to establish CHILD_SA, keeping IKE_SA Jun 23 19:52:48 ip-10-194-0-176 charon: 11[IKE] queueing CHILD_CREATE task Jun 23 19:52:48 ip-10-194-0-176 charon: 11[IKE] activating CHILD_CREATE task Jun 23 19:52:48 ip-10-194-0-176 charon: 06[IKE] establishing CHILD_SA aws1oexternal-aws1nvexternal Jun 23 19:52:48 ip-10-194-0-176 charon: 10[IKE] received FAILED_CP_REQUIRED notify, no CHILD_SA built Jun 23 19:52:48 ip-10-194-0-176 charon: 10[IKE] failed to establish CHILD_SA, keeping IKE_SA Jun 23 19:52:49 ip-10-194-0-176 charon: 14[CFG] looking for a child config for 10.194.0.0/16 === 10.198.0.0/16 Jun 23 19:52:49 ip-10-194-0-176 charon: 14[CFG] found matching child config "aws1oexternal-aws1nvexternal" with prio 10 Jun 23 19:52:49 ip-10-194-0-176 charon: 14[IKE] configuration payload negotiation failed, no CHILD_SA built Jun 23 19:52:49 ip-10-194-0-176 charon: 14[IKE] failed to establish CHILD_SA, keeping IKE_SA
***编辑#3：问题解决了(呃,实际上看到编辑#4下面……)****
问题已解决.
1)我没有正确地遵循迈克尔的配置指示.我还将权限资源和leftsourceip配置在一起,从而使两个实例都相信它们都是启动器.我确保一个是发起人,一个是请求者;这解决了IKE问题.
2)我发现我还必须明确设置esp参数.即使已经存在默认值(aes128-sha1,3des-sha1),仍然必须设置esp参数,以便实例知道使用esp OR啊(但不是两者).我最终使用了aes128-sha1-modp2048.
希望这篇文章有助于下一个linux新手设置这个！
干杯!
编辑#4：问题(没有真正)解决了
在解决与strongswan相关的单独问题时,我更改了“leftfirewall”参数,经过测试,未修复我的单独问题,然后事先恢复到orig配置(注释掉了leftfirewall).然后我注意到我现在无法ping通隧道.在疯了几个小时试图弄清楚发生了什么后,我注释掉了esp参数,看看会发生什么：我现在可以再次穿过隧道！ < - 所以,有可能有一些ipsec幽灵在我身上玩弄技巧,并且esp参数实际上并不是TS_UNACCEPTABLE错误的修复(尽管其他资源在线状态esp参数是修复... ) 编辑#5：问题完全解决了 我最终将所有内容都移到测试环境中并从头开始.我使用最新版本(5.3.2)从源代码安装,而不是使用Ubuntu repo(5.1.2)中的旧版本.这清除了我上面遇到的问题,并通过VPN隧道在多个子网之间使用netcat(很棒的工具!!)验证了第7层连接. 另外：不需要为VPC启用DNS主机名(因为我错误地被亚马逊认为),仅供参考&FYI>
希望这一切都有帮助!!!!!!
其他编辑2/11/2017：
根据JustEngland的要求,复制下面的工作配置(省略某些细节以防止以任何方式识别)：
A面：
# ipsec.conf - strongSwan IPsec configuration file # basic configuration config setup # Add connections here. conn %default ikelifetime= You choose; must match other side keylife= You choose; must match other side rekeymargin= You choose; must match other side keyingtries=1 keyexchange= You choose; must match other side authby=secret mobike=no conn side-a left=10.198.0.124 leftsubnet=10.198.0.0/16 leftid=54.y.y.y leftsourceip=10.198.0.124 right=52.x.x.x rightsubnet=10.194.0.0/16 auto=start type=tunnel # Add connections here. root@x:~# cat /etc/ipsec.secrets A.A.A.A B.B.B.B : PSK "Your Password"
B面：
# ipsec.conf - strongSwan IPsec configuration file # basic configuration config setup conn %default ikelifetime= You choose; must match other side keylife= You choose; must match other side rekeymargin= You choose; must match other side keyingtries=1 keyexchange= You choose; must match other side authby=secret mobike=no conn side-b left=10.194.0.129 leftsubnet=10.194.0.0/16 leftid=52.x.x.x right=54.y.y.y rightsubnet=10.198.0.0/16 rightsourceip=10.198.0.124 auto=start type=tunnel root@x:~# cat /etc/ipsec.secrets B.B.B.B A.A.A.A : PSK "Your Password"在VPC中,实例的公共IP地址永远不会绑定到实例的堆栈,因此您必须配置内部专用地址和外部公用地址.无效参数可能是由于尝试直接从公共IP地址获取流量而导致的,而您的实例并不知道.
left=10.10.10.10 # instance private IP of local system leftsourceip=10.10.10.10 # instance private IP of local system leftid=203.x.x.x # elastic IP of local system leftsubnet=10.x.x.x/xx rightsubnet=10.x.x.x/xx right=198.x.x.x # elastic IP of remote system