Paste P112

Route based IPsec
ActivePublic

Authored by ae on Nov 3 2016, 5:18 PM.
1​IPsec tunnel using virtual tunnel interface with SAs installed by racoon.
2
3​[test15 src]# netstat -rnf inet
4​Routing tables
5
6​Internet:
7​Destination Gateway Flags Netif Expire
8​default 87.250.242.158 UGS ix0
9​87.250.242.128/27 link#1 U ix0
10​87.250.242.145 link#1 UHS lo0
11​127.0.0.1 link#4 UH lo0
12​192.168.0.145 link#4 UH lo0
13​[test15 src]# sysctl -a | grep forwarding
14​net.inet.ip.forwarding: 1
15​net.inet.ip.fastforwarding: 0
16​net.inet6.ip6.forwarding: 1
17​net.inet6.ip6.fastforwarding: 0
18​[test15 src]# kldstat
19​Id Refs Address Size Name
20​ 1 17 0xffffffff80200000 1a6e3d0 kernel
21​ 2 1 0xffffffff81c70000 2f4e90 zfs.ko
22​ 3 2 0xffffffff81f65000 ac78 opensolaris.ko
23​ 4 1 0xffffffff82011000 3625 ums.ko
24​ 5 1 0xffffffff82015000 31df cpuctl.ko
25​ 6 1 0xffffffff82019000 1a98 if_ipsec.ko
26​[test15 src]# setkey -D
27​No SAD entries.
28​[test15 src]# setkey -DP
29​No SPD entries.
30​[test15 src]# ifconfig ipsec0 create
31​[test15 src]# ifconfig ipsec0 inet tunnel 87.250.242.145 87.250.242.144
32​[test15 src]# ifconfig ipsec0 inet 10.0.0.145/32 10.0.0.144
33​[test15 src]# route add 172.16.0.0/16 10.0.0.144
34​add net 172.16.0.0: gateway 10.0.0.144 fib 0
35​[test15 src]# ifconfig ipsec0
36​ipsec0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1400
37​ tunnel inet 87.250.242.145 --> 87.250.242.144
38​ inet 10.0.0.145 --> 10.0.0.144 netmask 0xffffffff
39​ inet6 fe80::225:90ff:fef9:3c92%ipsec0 prefixlen 64 scopeid 0x5
40​ nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
41​ reqid: 16388
42​ groups: ipsec
43​[test15 src]# setkey -D
44​No SAD entries.
45​[test15 src]# setkey -DP
46​0.0.0.0/0[any] 0.0.0.0/0[any] any
47​ in ipsec
48​ esp/tunnel/87.250.242.144-87.250.242.145/unique#16388
49​ spid=13 seq=3 pid=1418
50​ refcnt=1
51​::/0[any] ::/0[any] any
52​ in ipsec
53​ esp/tunnel/87.250.242.144-87.250.242.145/unique#16388
54​ spid=15 seq=2 pid=1418
55​ refcnt=1
56​0.0.0.0/0[any] 0.0.0.0/0[any] any
57​ out ipsec
58​ esp/tunnel/87.250.242.145-87.250.242.144/unique#16388
59​ spid=14 seq=1 pid=1418
60​ refcnt=1
61​::/0[any] ::/0[any] any
62​ out ipsec
63​ esp/tunnel/87.250.242.145-87.250.242.144/unique#16388
64​ spid=16 seq=0 pid=1418
65​ refcnt=1
66​[test15 src]# setkey -DPF
67​[test15 src]# setkey -DP
68​0.0.0.0/0[any] 0.0.0.0/0[any] any
69​ in ipsec
70​ esp/tunnel/87.250.242.144-87.250.242.145/unique#16388
71​ spid=13 seq=3 pid=1420
72​ refcnt=1
73​::/0[any] ::/0[any] any
74​ in ipsec
75​ esp/tunnel/87.250.242.144-87.250.242.145/unique#16388
76​ spid=15 seq=2 pid=1420
77​ refcnt=1
78​0.0.0.0/0[any] 0.0.0.0/0[any] any
79​ out ipsec
80​ esp/tunnel/87.250.242.145-87.250.242.144/unique#16388
81​ spid=14 seq=1 pid=1420
82​ refcnt=1
83​::/0[any] ::/0[any] any
84​ out ipsec
85​ esp/tunnel/87.250.242.145-87.250.242.144/unique#16388
86​ spid=16 seq=0 pid=1420
87​ refcnt=1
88​[test15 src]# racoon
89
90​-----------
91
92​[test25 src]# netstat -rnf inet
93​Routing tables
94
95​Internet:
96​Destination Gateway Flags Netif Expire
97​default 87.250.242.158 UGS igb0
98​87.250.242.128/27 link#1 U igb0
99​87.250.242.144 link#1 UHS lo0
100​127.0.0.1 link#6 UH lo0
101​172.16.0.145 link#6 UH lo0
102​[test25 src]# sysctl -a | grep forwarding
103​net.inet.ip.forwarding: 1
104​net.inet.ip.fastforwarding: 0
105​net.inet6.ip6.forwarding: 1
106​net.inet6.ip6.fastforwarding: 0
107​[test25 src]# kldstat
108​Id Refs Address Size Name
109​ 1 20 0xffffffff80200000 1a6e3d0 kernel
110​ 2 1 0xffffffff81c70000 2f4e90 zfs.ko
111​ 3 2 0xffffffff81f65000 ac78 opensolaris.ko
112​ 4 1 0xffffffff82011000 3625 ums.ko
113​ 5 1 0xffffffff82015000 2b8e uhid.ko
114​ 6 1 0xffffffff82018000 31df cpuctl.ko
115​ 7 1 0xffffffff8201c000 1a98 if_ipsec.ko
116​[test25 src]# setkey -D
117​No SAD entries.
118​[test25 src]# setkey -DP
119​No SPD entries.
120​[test25 src]# ifconfig ipsec0 create
121​[test25 src]# ifconfig ipsec0 inet tunnel 87.250.242.144 87.250.242.145
122​[test25 src]# ifconfig ipsec0 inet 10.0.0.144/32 10.0.0.145
123​[test25 src]# route add 192.168.0.0/24 10.0.0.145
124​add net 192.168.0.0: gateway 10.0.0.145 fib 0
125​[test25 src]# ifconfig ipsec0
126​ipsec0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1400
127​ tunnel inet 87.250.242.144 --> 87.250.242.145
128​ inet 10.0.0.144 --> 10.0.0.145 netmask 0xffffffff
129​ inet6 fe80::225:90ff:fe92:8548%ipsec0 prefixlen 64 scopeid 0x7
130​ nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
131​ reqid: 16386
132​ groups: ipsec
133​[test25 src]# setkey -D
134​No SAD entries.
135​[test25 src]# setkey -DP
136​0.0.0.0/0[any] 0.0.0.0/0[any] any
137​ in ipsec
138​ esp/tunnel/87.250.242.145-87.250.242.144/unique#16386
139​ spid=5 seq=3 pid=1404
140​ refcnt=1
141​::/0[any] ::/0[any] any
142​ in ipsec
143​ esp/tunnel/87.250.242.145-87.250.242.144/unique#16386
144​ spid=7 seq=2 pid=1404
145​ refcnt=1
146​0.0.0.0/0[any] 0.0.0.0/0[any] any
147​ out ipsec
148​ esp/tunnel/87.250.242.144-87.250.242.145/unique#16386
149​ spid=6 seq=1 pid=1404
150​ refcnt=1
151​::/0[any] ::/0[any] any
152​ out ipsec
153​ esp/tunnel/87.250.242.144-87.250.242.145/unique#16386
154​ spid=8 seq=0 pid=1404
155​ refcnt=1
156​[test25 src]# racoon
157
158​-------------
159
160​[test15 src]# ping -c1 10.0.0.144
161​PING 10.0.0.144 (10.0.0.144): 56 data bytes
162
163​--- 10.0.0.144 ping statistics ---
164​1 packets transmitted, 0 packets received, 100.0% packet loss
165​[test15 src]# ping -c1 10.0.0.144
166​PING 10.0.0.144 (10.0.0.144): 56 data bytes
167​64 bytes from 10.0.0.144: icmp_seq=0 ttl=64 time=0.506 ms
168
169​--- 10.0.0.144 ping statistics ---
170​1 packets transmitted, 1 packets received, 0.0% packet loss
171​round-trip min/avg/max/stddev = 0.506/0.506/0.506/0.000 ms
172
173​[test15 src]# ping -c1 172.16.0.145
174​PING 172.16.0.145 (172.16.0.145): 56 data bytes
175​64 bytes from 172.16.0.145: icmp_seq=0 ttl=64 time=0.423 ms
176
177​--- 172.16.0.145 ping statistics ---
178​1 packets transmitted, 1 packets received, 0.0% packet loss
179​round-trip min/avg/max/stddev = 0.423/0.423/0.423/0.000 ms
180
181​--------------
182
183​[test15 butcher]# tcpdump -ni ix0 esp
184​tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
185​listening on ix0, link-type EN10MB (Ethernet), capture size 262144 bytes
186​17:13:48.830044 IP 87.250.242.145 > 87.250.242.144: ESP(spi=0x0befd947,seq=0x1), length 132
187​17:13:48.830388 IP 87.250.242.144 > 87.250.242.145: ESP(spi=0x080b560c,seq=0x1), length 132
188​17:16:11.563357 IP 87.250.242.145 > 87.250.242.144: ESP(spi=0x0befd947,seq=0x3), length 132
189​17:16:11.563623 IP 87.250.242.144 > 87.250.242.145: ESP(spi=0x080b560c,seq=0x2), length 132
190
191​--------------
192
193​[test15 butcher]# tcpdump -ni ipsec0
194​tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
195​listening on ipsec0, link-type NULL (BSD loopback), capture size 262144 bytes
196​17:13:22.880665 IP 10.0.0.145 > 10.0.0.144: ICMP echo request, id 40197, seq 0, length 64
197​17:13:48.829976 IP 10.0.0.145 > 10.0.0.144: ICMP echo request, id 40709, seq 0, length 64
198​17:13:48.830421 IP 10.0.0.144 > 10.0.0.145: ICMP echo reply, id 40709, seq 0, length 64
199​17:16:11.563292 IP 10.0.0.145 > 172.16.0.145: ICMP echo request, id 42501, seq 0, length 64
200​17:16:11.563647 IP 172.16.0.145 > 10.0.0.145: ICMP echo reply, id 42501, seq 0, length 64
201
202​---------------
203
204​[test15 src]# setkey -D
205​87.250.242.145 87.250.242.144
206​ esp mode=tunnel spi=200268103(0x0befd947) reqid=16388(0x00004004)
207​ E: rijndael-cbc d150a373 e2ff25ec 13e59840 90c424d2
208​ A: hmac-sha1 4d2704f5 36a44c97 1a234998 1bfd403a e0c1cffb
209​ seq=0x00000001 replay=4 flags=0x00000000 state=mature
210​ created: Nov 3 17:13:23 2016 current: Nov 3 17:15:14 2016
211​ diff: 111(s) hard: 28800(s) soft: 23040(s)
212​ last: Nov 3 17:13:48 2016 hard: 0(s) soft: 0(s)
213​ current: 152(bytes) hard: 0(bytes) soft: 0(bytes)
214​ allocated: 1 hard: 0 soft: 0
215​ sadb_seq=1 pid=1443 refcnt=1
216​87.250.242.144 87.250.242.145
217​ esp mode=tunnel spi=134960652(0x080b560c) reqid=16388(0x00004004)
218​ E: rijndael-cbc e7c9aa53 18ef46d9 b222111d a813af56
219​ A: hmac-sha1 007f5908 755f4b88 e62c9de5 70122ebe 550d361d
220​ seq=0x00000001 replay=4 flags=0x00000000 state=mature
221​ created: Nov 3 17:13:23 2016 current: Nov 3 17:15:14 2016
222​ diff: 111(s) hard: 28800(s) soft: 23040(s)
223​ last: Nov 3 17:13:48 2016 hard: 0(s) soft: 0(s)
224​ current: 84(bytes) hard: 0(bytes) soft: 0(bytes)
225​ allocated: 1 hard: 0 soft: 0
226​ sadb_seq=0 pid=1443 refcnt=1
227
228​-----------
229
230​IPsec tunnel using virtual tunnel interface with manually installed SAs.
231
232​[test15 butcher]# ifconfig ipsec0 create reqid 100
233​[test15 butcher]# ifconfig ipsec0 inet tunnel 87.250.242.145 87.250.242.144 up
234​[test15 butcher]# ifconfig ipsec0 inet 10.0.0.145/32 10.0.0.144
235​[test15 butcher]# route add 172.16.0.0/16 10.0.0.144
236​add net 172.16.0.0: gateway 10.0.0.144 fib 0
237​# setkey -c
238​add 87.250.242.145 87.250.242.144 esp 1000 -m tunnel -u 100 -E rijndael-cbc "1111111111111111";
239​add 87.250.242.144 87.250.242.145 esp 2000 -m tunnel -u 100 -E rijndael-cbc "2222222222222222";
240​^D
241​[test15 butcher]# setkey -DP
242​0.0.0.0/0[any] 0.0.0.0/0[any] any
243​ in ipsec
244​ esp/tunnel/87.250.242.144-87.250.242.145/unique:100
245​ spid=5 seq=3 pid=5682
246​ refcnt=1
247​::/0[any] ::/0[any] any
248​ in ipsec
249​ esp/tunnel/87.250.242.144-87.250.242.145/unique:100
250​ spid=7 seq=2 pid=5682
251​ refcnt=1
252​0.0.0.0/0[any] 0.0.0.0/0[any] any
253​ out ipsec
254​ esp/tunnel/87.250.242.145-87.250.242.144/unique:100
255​ spid=6 seq=1 pid=5682
256​ refcnt=1
257​::/0[any] ::/0[any] any
258​ out ipsec
259​ esp/tunnel/87.250.242.145-87.250.242.144/unique:100
260​ spid=8 seq=0 pid=5682
261​ refcnt=1
262​[test15 butcher]# setkey -D
263​87.250.242.144 87.250.242.145
264​ esp mode=tunnel spi=2000(0x000007d0) reqid=100(0x00000064)
265​ E: rijndael-cbc 32323232 32323232 32323232 32323232
266​ seq=0x00000000 replay=0 flags=0x00000040 state=mature
267​ created: Nov 5 07:48:20 2016 current: Nov 5 07:48:58 2016
268​ diff: 38(s) hard: 0(s) soft: 0(s)
269​ last: hard: 0(s) soft: 0(s)
270​ current: 0(bytes) hard: 0(bytes) soft: 0(bytes)
271​ allocated: 0 hard: 0 soft: 0
272​ sadb_seq=1 pid=5683 refcnt=1
273​87.250.242.145 87.250.242.144
274​ esp mode=tunnel spi=1000(0x000003e8) reqid=100(0x00000064)
275​ E: rijndael-cbc 31313131 31313131 31313131 31313131
276​ seq=0x00000000 replay=0 flags=0x00000040 state=mature
277​ created: Nov 5 07:48:11 2016 current: Nov 5 07:48:58 2016
278​ diff: 47(s) hard: 0(s) soft: 0(s)
279​ last: hard: 0(s) soft: 0(s)
280​ current: 0(bytes) hard: 0(bytes) soft: 0(bytes)
281​ allocated: 0 hard: 0 soft: 0
282​ sadb_seq=0 pid=5683 refcnt=1
283
284​[test15 butcher]# ping -c1 10.0.0.144
285​PING 10.0.0.144 (10.0.0.144): 56 data bytes
286​64 bytes from 10.0.0.144: icmp_seq=0 ttl=64 time=0.632 ms
287
288​--- 10.0.0.144 ping statistics ---
289​1 packets transmitted, 1 packets received, 0.0% packet loss
290​round-trip min/avg/max/stddev = 0.632/0.632/0.632/0.000 ms
291​[test15 butcher]# ping -c1 172.16.0.145
292​PING 172.16.0.145 (172.16.0.145): 56 data bytes
293​64 bytes from 172.16.0.145: icmp_seq=0 ttl=64 time=0.427 ms
294
295​--- 172.16.0.145 ping statistics ---
296​1 packets transmitted, 1 packets received, 0.0% packet loss
297​round-trip min/avg/max/stddev = 0.427/0.427/0.427/0.000 ms
298
299​--------
300
301​[test25 butcher]# ifconfig ipsec0 create reqid 100
302​[test25 butcher]# ifconfig ipsec0 inet tunnel 87.250.242.144 87.250.242.145 up
303​[test25 butcher]# ifconfig ipsec0 inet 10.0.0.144/32 10.0.0.145
304​[test25 butcher]# setkey -c
305​add 87.250.242.145 87.250.242.144 esp 1000 -m tunnel -u 100 -E rijndael-cbc "1111111111111111";
306​add 87.250.242.144 87.250.242.145 esp 2000 -m tunnel -u 100 -E rijndael-cbc "2222222222222222";
307​^D
308​[test25 butcher]# setkey -D
309​87.250.242.144 87.250.242.145
310​ esp mode=tunnel spi=2000(0x000007d0) reqid=100(0x00000064)
311​ E: rijndael-cbc 32323232 32323232 32323232 32323232
312​ seq=0x00000000 replay=0 flags=0x00000040 state=mature
313​ created: Nov 5 12:03:02 2016 current: Nov 5 12:03:21 2016
314​ diff: 19(s) hard: 0(s) soft: 0(s)
315​ last: hard: 0(s) soft: 0(s)
316​ current: 0(bytes) hard: 0(bytes) soft: 0(bytes)
317​ allocated: 0 hard: 0 soft: 0
318​ sadb_seq=1 pid=6105 refcnt=1
319​87.250.242.145 87.250.242.144
320​ esp mode=tunnel spi=1000(0x000003e8) reqid=100(0x00000064)
321​ E: rijndael-cbc 31313131 31313131 31313131 31313131
322​ seq=0x00000000 replay=0 flags=0x00000040 state=mature
323​ created: Nov 5 12:03:02 2016 current: Nov 5 12:03:21 2016
324​ diff: 19(s) hard: 0(s) soft: 0(s)
325​ last: hard: 0(s) soft: 0(s)
326​ current: 0(bytes) hard: 0(bytes) soft: 0(bytes)
327​ allocated: 0 hard: 0 soft: 0
328​ sadb_seq=0 pid=6105 refcnt=1
329​[test25 butcher]# setkey -DP
330​0.0.0.0/0[any] 0.0.0.0/0[any] any
331​ in ipsec
332​ esp/tunnel/87.250.242.145-87.250.242.144/unique:100
333​ spid=9 seq=3 pid=6106
334​ refcnt=1
335​::/0[any] ::/0[any] any
336​ in ipsec
337​ esp/tunnel/87.250.242.145-87.250.242.144/unique:100
338​ spid=11 seq=2 pid=6106
339​ refcnt=1
340​0.0.0.0/0[any] 0.0.0.0/0[any] any
341​ out ipsec
342​ esp/tunnel/87.250.242.144-87.250.242.145/unique:100
343​ spid=10 seq=1 pid=6106
344​ refcnt=1
345​::/0[any] ::/0[any] any
346​ out ipsec
347​ esp/tunnel/87.250.242.144-87.250.242.145/unique:100
348​ spid=12 seq=0 pid=6106
349​ refcnt=1
350
351​[test25 butcher]# tcpdump -ni ipsec0
352​tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
353​listening on ipsec0, link-type NULL (BSD loopback), capture size 262144 bytes
354​12:04:30.092828 IP 10.0.0.145 > 10.0.0.144: ICMP echo request, id 14358, seq 0, length 64
355​12:04:30.092885 IP 10.0.0.144 > 10.0.0.145: ICMP echo reply, id 14358, seq 0, length 64
356​12:05:09.869815 IP 10.0.0.145 > 172.16.0.145: ICMP echo request, id 15126, seq 0, length 64
357​12:05:09.869907 IP 172.16.0.145 > 10.0.0.145: ICMP echo reply, id 15126, seq 0, length 64
358
359​[test25 butcher]# tcpdump -ni igb0 host 87.250.242.145
360​tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
361​listening on igb0, link-type EN10MB (Ethernet), capture size 262144 bytes
362​12:04:30.092608 ARP, Request who-has 87.250.242.144 tell 87.250.242.145, length 46
363​12:04:30.092621 ARP, Reply 87.250.242.144 is-at 00:25:90:92:85:48, length 28
364​12:04:30.092807 IP 87.250.242.145 > 87.250.242.144: ESP(spi=0x000003e8,seq=0x1), length 120
365​12:04:30.092911 IP 87.250.242.144 > 87.250.242.145: ESP(spi=0x000007d0,seq=0x1), length 120
366​12:05:09.869789 IP 87.250.242.145 > 87.250.242.144: ESP(spi=0x000003e8,seq=0x2), length 120
367​12:05:09.869923 IP 87.250.242.144 > 87.250.242.145: ESP(spi=0x000007d0,seq=0x2), length 120
368
369​------
370
ae created this paste.Nov 3 2016, 5:18 PM
ae created this object in space S1 Global.
ae edited the content of this paste. (Show Details)Nov 5 2016, 7:54 AM