Welcome, Guest. Please login or register.

Author Topic: Anyone using mobile IPsec?  (Read 3266 times)

Lee Sharp

  • Newbie
  • *
  • Posts: 29
  • Karma: +0/-0
    • View Profile
    • SmallWall
Anyone using mobile IPsec?
« on: August 24, 2015, 03:36:12 PM »
I have had two reports of problems with mobile IPsec on SmallWall since the b567 upgrade to allow l2tp.  As we share this code exactly, I wanted to get more eyes on it.  Is anyone using mobile IPsec on t1n1wall successfully?

andywhite

  • Administrator
  • Full Member
  • *****
  • Posts: 109
  • Karma: +0/-0
    • View Profile
Re: Anyone using mobile IPsec?
« Reply #1 on: September 01, 2015, 11:09:29 AM »
what are the reports ?

Lee Sharp

  • Newbie
  • *
  • Posts: 29
  • Karma: +0/-0
    • View Profile
    • SmallWall
Re: Anyone using mobile IPsec?
« Reply #2 on: September 01, 2015, 05:40:30 PM »
You connect fine, but no traffic passes.  Discussion in these two threads;
http://smallwall.freeforums.net/thread/71/mobile-vpn-thegreenbow-smallwall
http://smallwall.freeforums.net/thread/73/m0n0wall-smallwall-migration-ipsec-issue

I am having a hard time replicating it since I do not use mobile IPsec or Windows. :)  I was trying to find out if anyone was using it successfully since the b576 patch.

andywhite

  • Administrator
  • Full Member
  • *****
  • Posts: 109
  • Karma: +0/-0
    • View Profile
Re: Anyone using mobile IPsec?
« Reply #3 on: September 02, 2015, 07:44:18 PM »
yes it is broken :(

FYI, mobile IPSEC requires aggressive mode, main mode will require ip addresses as the identifier which isn't workable for mobile IPSEC

l2tp currently breaks ipsec that is in aggressive mode, ONLY when l2tp is enabled, so with it disabled aggressive mode in mobile IPSEC should work

the spd display page has a bug

the work for l2tp patched racoon/setkey/libipsec and the kernel, so mostly like the problem is in one of those patches, which will take a good bit of digging.

Lee Sharp

  • Newbie
  • *
  • Posts: 29
  • Karma: +0/-0
    • View Profile
    • SmallWall
Re: Anyone using mobile IPsec?
« Reply #4 on: September 02, 2015, 10:41:49 PM »
Frankly, I do not see a big reason to fix.  L2tp is a functional replacement for Mobile IPsec, and it is MUCH better supported.  I just need better documentation to say that you have to choose one or the other and configure IPSEC accordingly. :(

Lee Sharp

  • Newbie
  • *
  • Posts: 29
  • Karma: +0/-0
    • View Profile
    • SmallWall
Re: Anyone using mobile IPsec?
« Reply #5 on: September 18, 2015, 03:11:44 AM »
I have a report of it failing under Aggressive as well.

http://smallwall.freeforums.net/thread/71/mobile-vpn-thegreenbow-smallwall

andywhite

  • Administrator
  • Full Member
  • *****
  • Posts: 109
  • Karma: +0/-0
    • View Profile
Re: Anyone using mobile IPsec?
« Reply #6 on: September 21, 2015, 01:09:17 PM »
to get l2tp working there are a lot of patches.

some of these patches are around NAT environments, where t1n1wall can be behind NAT, and the mobile device can also be behind NAT.  When this is detected, these patches figure out the real and NAT'd address and try to do the right thing.  However, it looks like for mobile ipsec, when racoon tries to create a dynamic policy, it is using the wrong address to create the policy.

From some basic testing today, I can see that the policy it is adding is to encrypt traffic from the client IP to the t1n1wall IP, and not from the client IP to the t1n1wall LAN subnet,  I have modified one of the patches to remove this behavior, and made a new build (b64) for testing

This needs to be tested in 4 environments

1) t1n1wall is behind NAT, and client isn't
2) t1n1wall and client are behind their own NATs
3) client is behind NAT and t1n1wall isn't
4) no NAT between client and server

L2TP should be tested as above and IPSEC tunnels should be tested as working.

Andrew

Lee Sharp

  • Newbie
  • *
  • Posts: 29
  • Karma: +0/-0
    • View Profile
    • SmallWall
Re: Anyone using mobile IPsec?
« Reply #7 on: September 21, 2015, 04:20:48 PM »
I will encourage the people with the problem on SmallWall to come over to this thread and to try your image.

Gilgamoth

  • Newbie
  • *
  • Posts: 14
  • Karma: +0/-0
    • View Profile
Re: Anyone using mobile IPsec?
« Reply #8 on: April 18, 2016, 07:47:41 PM »
Has this been tested as working yet? I've just upgraded to 1.10.2b102 and got it stable and tried mobile IPsec for the first time in a long time and it doesn't seem to be working.

andywhite

  • Administrator
  • Full Member
  • *****
  • Posts: 109
  • Karma: +0/-0
    • View Profile
Re: Anyone using mobile IPsec?
« Reply #9 on: April 24, 2016, 10:02:07 PM »
mobile ipsec (not l2tp) should work fine, the bug that caused the problem was fixed.  If it's not working for you, please post some details

Gilgamoth

  • Newbie
  • *
  • Posts: 14
  • Karma: +0/-0
    • View Profile
Re: Anyone using mobile IPsec?
« Reply #10 on: April 26, 2016, 09:28:10 AM »
Hi Andy,
My Mobile IPsec config that works under 1.8, didn't work when I moved to 1.10 (as per my bug report). I use it very rarely, so didn't spend too long testing the 1.10 problem as I was having other issues (as per bug report ;) ).