Hello Peter, UDP is a stateless (connectionless) protocol so that there is a message from another IP logged does not mean it's a reply. Check if you still get these requests even if you don't initiate an IKE_SA.
Kind regards Noel Am 02.01.20 um 17:18 schrieb Peter Andersson: > Hi! > > I'm having trouble getting the strongSwan server to work. I'm trying to > connect to a remote VPN server and I get replies from an entirely different > server from a different company. > The log looks like this: > > Jan 2 16:59:21 Server charon: 08[NET] sending packet: from > 46.246.XXX.XXX[500] to 62.181.XXX.XXX[500] (1036 bytes) > Jan 2 16:59:25 Server charon: 09[IKE] retransmit 1 of request with message > ID 0 > Jan 2 16:37:43 Server charon: 09[NET] sending packet: from > 46.246.XXX.XXX[500] to 62.181.XXX.XXX[500] (1036 bytes) > Jan 2 16:37:46 Server charon: 10[NET] received packet: from > 80.72.XXX.XXX[500] to 46.246.XXX.XXX[500] (284 bytes) > > Our ISP only delivers internet connections, no firewalls, vpn services or > something similar. > And all our firewall does is to allow connections on UDP port 500 from > 62.181.XXX.XXX. It has no port forwarding or anything special. > I'm at a total loss here as we have never had any contact with the company > with the 80.72.XXX.XXX address. > We did have a hardware firewall (Sonicwall) that was working just fine with > the same settings. > > I would be extremely grateful if any of you experts could help me find a > solution or point me in the right direction. > > Thanks! > > /Peter > > > This is my config: > > config setup > charondebug="cfg 2" > strictcrlpolicy=no > > conn VPN > authby=secret > left=46.246.XXX.XXX > leftsubnet=1.1.1.0/24 > leftfirewall=yes > right=62.181.XXX.XXX > rightsubnet=1.1.10.200/32 > ike=aes128-sha1-modp1024 > esp=aes128-sha1 > keyexchange=ike > keyingtries=0 > ikelifetime=12h > lifetime=6h > dpddelay=30 > dpdtimeout=120 > dpdaction=restart > auto=start > type=tunnel > > ipsec.secrets; > 46.246.XXX.XXX 62.181.XXX.XXX : PSK 'ABCDEFGH' > > strongswan.conf: > charon { > load_modular = yes > plugins { > include strongswan.d/charon/*.conf > } > } > include strongswan.d/*.conf > > And the log: > > Jan 2 17:11:07 Server charon: 00[DMN] Starting IKE charon daemon (strongSwan > 5.7.2, Linux 5.3.0-24-generic, x86_64) > Jan 2 17:11:07 Server charon: 00[CFG] loading ca certificates from > '/etc/ipsec.d/cacerts' > Jan 2 17:11:07 Server charon: 00[CFG] loading aa certificates from > '/etc/ipsec.d/aacerts' > Jan 2 17:11:07 Server charon: 00[CFG] loading ocsp signer certificates from > '/etc/ipsec.d/ocspcerts' > Jan 2 17:11:07 Server charon: 00[CFG] loading attribute certificates from > '/etc/ipsec.d/acerts' > Jan 2 17:11:07 Server charon: 00[CFG] loading crls from '/etc/ipsec.d/crls' > Jan 2 17:11:07 Server charon: 00[CFG] loading secrets from > '/etc/ipsec.secrets' > Jan 2 17:11:07 Server charon: 00[CFG] loaded IKE secret for 46.246.XXX.XXX > 62.181.XXX.XXX > Jan 2 17:11:07 Server charon: 00[LIB] loaded plugins: charon aesni aes rc2 > sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 > pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac > gcm attr kernel-netlink resolve socket-default connmark stroke updown > eap-mschapv2 xauth-generic counters > Jan 2 17:11:07 Server charon: 00[LIB] dropped capabilities, running as uid > 0, gid 0 > Jan 2 17:11:07 Server charon: 00[JOB] spawning 16 worker threads > Jan 2 17:11:07 Server charon: 05[CFG] received stroke: add connection 'VPN' > Jan 2 17:11:07 Server charon: 05[CFG] conn VPN > Jan 2 17:11:07 Server charon: 05[CFG] left=46.246.XXX.XXX > Jan 2 17:11:07 Server charon: 05[CFG] leftsubnet=1.1.1.0/24 > Jan 2 17:11:07 Server charon: 05[CFG] leftauth=psk > Jan 2 17:11:07 Server charon: 05[CFG] leftupdown=ipsec _updown iptables > Jan 2 17:11:07 Server charon: 05[CFG] right=62.181.XXX.XXX > Jan 2 17:11:07 Server charon: 05[CFG] rightsubnet=1.1.10.200/32 > Jan 2 17:11:07 Server charon: 05[CFG] rightauth=psk > Jan 2 17:11:07 Server charon: 05[CFG] ike=aes128-sha1-modp1024 > Jan 2 17:11:07 Server charon: 05[CFG] esp=aes128-sha1 > Jan 2 17:11:07 Server charon: 05[CFG] dpddelay=30 > Jan 2 17:11:07 Server charon: 05[CFG] dpdtimeout=120 > Jan 2 17:11:07 Server charon: 05[CFG] dpdaction=3 > Jan 2 17:11:07 Server charon: 05[CFG] sha256_96=no > Jan 2 17:11:07 Server charon: 05[CFG] mediation=no > Jan 2 17:11:07 Server charon: 05[CFG] added configuration 'VPN' > Jan 2 17:11:07 Server charon: 08[CFG] received stroke: initiate 'VPN' > Jan 2 17:11:07 Server charon: 08[IKE] initiating IKE_SA VPN[1] to > 62.181.XXX.XXX > Jan 2 17:11:07 Server charon: 08[CFG] configured proposals: > IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, > IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/HMAC_SHA1_96/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/CURVE_448/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048, > IKE:AES_CCM_16_128/AES_CCM_16_192/AES_CCM_16_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/AES_CCM_8_128/AES_CCM_8_192/AES_CCM_8_256/AES_CCM_12_128/AES_CCM_12_192/AES_CCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/CURVE_448/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048 > Jan 2 17:11:07 Server charon: 08[CFG] sending supported signature hash > algorithms: sha256 sha384 sha512 identity > Jan 2 17:11:07 Server charon: 08[ENC] generating IKE_SA_INIT request 0 [ SA > KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ] > Jan 2 17:11:07 Server charon: 08[NET] sending packet: from > 46.246.XXX.XXX[500] to 62.181.XXX.XXX[500] (1036 bytes) > Jan 2 17:11:09 Server charon: 09[NET] received packet: from > 80.72.XXX.XXX[500] to 46.246.XXX.XXX[500] (284 bytes) > Jan 2 17:11:09 Server charon: 09[ENC] parsed ID_PROT request 0 [ SA V V V V > V V V V V V ] > Jan 2 17:11:09 Server charon: 09[CFG] looking for an IKEv1 config for > 46.246.XXX.XXX...80.72.XXX.XXX > Jan 2 17:11:09 Server charon: 09[IKE] no IKE config found for > 46.246.XXX.XXX...80.72.XXX.XXX, sending NO_PROPOSAL_CHOSEN > Jan 2 17:11:09 Server charon: 09[ENC] generating INFORMATIONAL_V1 request > 2752600603 [ N(NO_PROP) ] > Jan 2 17:11:09 Server charon: 09[NET] sending packet: from > 46.246.XXX.XXX[500] to 80.72.XXX.XXX[500] (40 bytes) > Jan 2 17:11:11 Server charon: 10[IKE] retransmit 1 of request with message > ID 0 > Jan 2 17:11:11 Server charon: 10[NET] sending packet: from > 46.246.XXX.XXX[500] to 62.181.XXX.XXX[500] (1036 bytes) > Jan 2 17:11:18 Server charon: 12[IKE] retransmit 2 of request with message > ID 0 > Jan 2 17:11:18 Server charon: 12[NET] sending packet: from > 46.246.XXX.XXX[500] to 62.181.XXX.XXX[500] (1036 bytes) > Jan 2 17:11:21 Server charon: 11[NET] received packet: from > 80.72.XXX.XXX[500] to 46.246.XXX.XXX[500] (284 bytes) > Jan 2 17:11:21 Server charon: 11[ENC] parsed ID_PROT request 0 [ SA V V V V > V V V V V V ] > Jan 2 17:11:21 Server charon: 11[CFG] looking for an IKEv1 config for > 46.246.XXX.XXX...80.72.XXX.XXX > Jan 2 17:11:21 Server charon: 11[IKE] no IKE config found for > 46.246.XXX.XXX...80.72.XXX.XXX, sending NO_PROPOSAL_CHOSEN > Jan 2 17:11:21 Server charon: 11[ENC] generating INFORMATIONAL_V1 request > 2913320541 [ N(NO_PROP) ] > Jan 2 17:11:21 Server charon: 11[NET] sending packet: from > 46.246.XXX.XXX[500] to 80.72.XXX.XXX[500] (40 bytes) > Jan 2 17:11:31 Server charon: 13[IKE] retransmit 3 of request with message > ID 0 > Jan 2 17:11:31 Server charon: 13[NET] sending packet: from > 46.246.XXX.XXX[500] to 62.181.XXX.XXX[500] (1036 bytes) > Jan 2 17:11:32 Server charon: 00[DMN] signal of type SIGINT received. > Shutting down
signature.asc
Description: OpenPGP digital signature