☰

NAT 後具有動態 IP 的路由器 (TP-Link MR200) 無法建立到 Ubuntu Strongswan 的 IPSEC VPN

tag-icon • tag-icon ipsec strongswan tp-link
NAT 後具有動態 IP 的路由器 (TP-Link MR200) 無法建立到 Ubuntu Strongswan 的 IPSEC VPN

我一直在嘗試讓它啟動並運行，並且比我預期的更進一步，但遇到了一個錯誤 received INVALID_ID_INFORMATION error notify，並且在 Strongswan 的日誌中顯示了一個非常特殊的本地 IP，該 IP 不在路由器的 LAN 上（但在是路由器的！ ）。

我的路由器 TP-Link MR200 使用行動 4G 連接，ISP/行動電信商使用 NAT（路由器的 WAN ip 是 10.。.*) 且網路上可見的遠端 IP 也是動態的。我正在嘗試為互聯網上的一台 Ubuntu 16.04 伺服器建立一個 IPSEC VPN，該伺服器具有靜態 IP 並運行 Strongswan。 TP-Link 只知道 IPSEC (...)。

TP-Link本地子網路是192.168.10.0/24 TP-Link的本地IP是192.168.10.1 伺服器的IP是1.2.3.4/24（可存取網際網路）

連結已創建，上升，然後出現上述錯誤，然後又下降。

筆記：日誌還顯示了一個我不認識的奇怪的本地IP 位址：192.168.225.100 ...這個IP 實際上似乎也是TP-Link 的，因為我可以從它的本地LAN 存取它，並且它打開相同的Web GUI ！

然後我也嘗試了rightsubnet=0.0.0.0/0...同樣的錯誤:(

下面的日誌和配置。有哪位好心人可以幫我解決這個問題嗎？

Strongswan日誌：

Sep  1 21:46:51 ubuntu charon: 00[LIB] loaded plugins: charon test-vectors unbound ldap pkcs11 aes rc2 sha1 sha2 md4 md5 rdrand random nonce x509 revocation constraints acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey dnscert ipseckey pem openssl gcrypt af-alg fips-prf gmp agent chapoly xcbc cmac hmac ctr ccm gcm ntru bliss curl soup mysql sqlite attr kernel-netlink resolve socket-default connmark farp stroke updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-pam xauth-noauth tnc-tnccs tnccs-20 tnccs-11 tnccs-dynamic dhcp whitelist lookip error-notify certexpire led radattr addrblock unity
Sep  1 21:46:51 ubuntu charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
Sep  1 21:46:51 ubuntu charon: 00[JOB] spawning 16 worker threads
Sep  1 21:46:51 ubuntu charon: 06[CFG] received stroke: add connection 'nat-t'
Sep  1 21:46:51 ubuntu charon: 06[CFG] added configuration 'nat-t'
Sep  1 21:47:05 ubuntu charon: 16[NET] received packet: from <REMOTE_IP>[37861] to 1.2.3.4[500] (104 bytes)
Sep  1 21:47:05 ubuntu charon: 16[ENC] parsed ID_PROT request 0 [ SA V ]
Sep  1 21:47:05 ubuntu charon: 16[IKE] received DPD vendor ID
Sep  1 21:47:05 ubuntu charon: 16[IKE] <REMOTE_IP> is initiating a Main Mode IKE_SA
Sep  1 21:47:05 ubuntu charon: 16[ENC] generating ID_PROT response 0 [ SA V V ]
Sep  1 21:47:05 ubuntu charon: 16[NET] sending packet: from 1.2.3.4[500] to <REMOTE_IP>[37861] (116 bytes)
Sep  1 21:47:05 ubuntu charon: 14[NET] received packet: from <REMOTE_IP>[37861] to 1.2.3.4[500] (180 bytes)
Sep  1 21:47:05 ubuntu charon: 14[ENC] parsed ID_PROT request 0 [ KE No ]
Sep  1 21:47:05 ubuntu charon: 14[ENC] generating ID_PROT response 0 [ KE No ]
Sep  1 21:47:05 ubuntu charon: 14[NET] sending packet: from 1.2.3.4[500] to <REMOTE_IP>[37861] (196 bytes)
Sep  1 21:47:05 ubuntu charon: 08[NET] received packet: from <REMOTE_IP>[37861] to 1.2.3.4[500] (76 bytes)
Sep  1 21:47:05 ubuntu charon: 08[ENC] parsed ID_PROT request 0 [ ID HASH ]
Sep  1 21:47:05 ubuntu charon: 08[CFG] looking for pre-shared key peer configs matching 1.2.3.4...<REMOTE_IP>[192.168.225.100]
Sep  1 21:47:05 ubuntu charon: 08[CFG] selected peer config "nat-t"
Sep  1 21:47:05 ubuntu charon: 08[IKE] IKE_SA nat-t[1] established between 1.2.3.4[1.2.3.4]...<REMOTE_IP>[192.168.225.100]
Sep  1 21:47:05 ubuntu charon: 08[IKE] scheduling reauthentication in 3370s
Sep  1 21:47:05 ubuntu charon: 08[IKE] maximum IKE_SA lifetime 3550s
Sep  1 21:47:05 ubuntu charon: 08[ENC] generating ID_PROT response 0 [ ID HASH ]
Sep  1 21:47:05 ubuntu charon: 08[NET] sending packet: from 1.2.3.4[500] to <REMOTE_IP>[37861] (76 bytes)
Sep  1 21:47:06 ubuntu charon: 07[NET] received packet: from <REMOTE_IP>[37861] to 1.2.3.4[500] (300 bytes)
Sep  1 21:47:06 ubuntu charon: 07[ENC] parsed QUICK_MODE request 3165384805 [ HASH SA No KE ID ID ]
Sep  1 21:47:06 ubuntu charon: 07[IKE] received 3600s lifetime, configured 1200s
Sep  1 21:47:06 ubuntu charon: 07[ENC] generating QUICK_MODE response 3165384805 [ HASH SA No KE ID ID ]
Sep  1 21:47:06 ubuntu charon: 07[NET] sending packet: from 1.2.3.4[500] to <REMOTE_IP>[37861] (316 bytes)
Sep  1 21:47:06 ubuntu charon: 06[NET] received packet: from <REMOTE_IP>[37861] to 1.2.3.4[500] (76 bytes)
Sep  1 21:47:06 ubuntu charon: 06[ENC] parsed INFORMATIONAL_V1 request 3226534685 [ HASH N(INVAL_ID) ]
Sep  1 21:47:06 ubuntu charon: 06[IKE] received INVALID_ID_INFORMATION error notify

Strongswan ipsec.conf：

config setup

conn %default
        ikelifetime=60m
        keylife=20m
        rekeymargin=3m
        keyingtries=1
        keyexchange=ike
        authby=secret

conn nat-t
        left=1.2.3.4
        leftsubnet=1.2.3.0/24
        leftfirewall=yes
        lefthostaccess=yes
        right=%any
        rightsubnet=192.168.10.0/24
        auto=add
        esp=aes128-sha1-modp1024

Strongswan 的 ipsec.secrets

1.2.3.4 : PSK "Abracadabra"

TP-Link IPSEC 配置（螢幕截圖）：

主要的 主要的

相關內容