[Suche] Empfehlung für Router mit Kabel Deutschland unter openWRT

kls · 3. Dezember 2015

Da haben sich unsere Postings wohl überschnitten.

Ich habe die /etc/config/ipsec aus Posting100 in Verwendung.

Das mit INPUT und FORWARD habe ich nach deinem Hinweis in Posting 177 geändert.

Ergebnisse siehe Posting 180.

Sieht aus als kämen wir durchaus voran :-).
Ich werde allerdings Freitag und Samstag nichts testen können. Melde mich ggf. am Sonntag wieder.

Klaus

ATD · 3. Dezember 2015

Zitat von kls

Bleiben also nur noch die beiden Fehler bei 9 und 10, für die ich aber keine Erklärung finde.

Hm, welche sind sie denn ?

Albert

ATD · 3. Dezember 2015

Zitat von kls

Bleiben also nur noch die beiden Fehler bei 9 und 10, für die ich aber keine Erklärung finde.

Ach, "iptables -A zone_vpn_ACCEPT ...". Sie muss existieren bevor Bedingungen daran geknüpft werden.

Code

iptables -N zone_vpn_ACCEPT

Also entweder über die Console einmalig, oder wenn nicht persistent, dann am Anfang des Scriptes einbauen.

Albert

ATD · 3. Dezember 2015

Zitat von kls

Sieht aus als kämen wir durchaus voran :-).

Was sonst?

Zitat von kls

Ich werde allerdings Freitag und Samstag nichts testen können. Melde mich ggf. am Sonntag wieder.

Klaus, lasse Dir Zeit. Das kommt mir durchaus gelegen.

Albert

kls · 4. Dezember 2015

Hab es schnell noch ausprobiert:

/etc/ipsec/firewall.sh

Code

#/etc/ipsec/firewall.sh


#!/bin/sh
#/etc/ipsec/firewall.sh - version 2


iptables -N zone_vpn_ACCEPT
 
echo "  1" ". /lib/functions.sh"
. /lib/functions.sh
 
GetZone() {
echo "  2" "  config_get zone "$1" zone vpn"
  config_get zone "$1" zone vpn
}
 
GetTunnel() {
echo "  3" "  local remote_subnet"
  local remote_subnet
echo "  4" "  local local_subnet"
  local local_subnet
echo "  5" "  local local_nat"
  local local_nat
 
echo "  6" "  config_get remote_subnet "$1" remote_subnet"
  config_get remote_subnet "$1" remote_subnet
echo "  7" "  config_get local_subnet  "$1" local_subnet"
  config_get local_subnet  "$1" local_subnet
echo "  8" "  config_get local_nat     "$1" local_nat """
  config_get local_nat     "$1" local_nat ""
echo "  9" "  iptables -A zone_${zone}_ACCEPT -d $remote_subnet -j ACCEPT"
  iptables -A zone_${zone}_ACCEPT -d $remote_subnet -j ACCEPT
echo " 10" "  iptables -A zone_${zone}_ACCEPT -s $remote_subnet -j ACCEPT"
  iptables -A zone_${zone}_ACCEPT -s $remote_subnet -j ACCEPT
echo " 11" "  iptables -A zone_${zone}_REJECT -d $remote_subnet -j reject"
  iptables -A zone_${zone}_REJECT -d $remote_subnet -j reject
echo " 12" "  iptables -A zone_${zone}_REJECT -s $remote_subnet -j reject"
  iptables -A zone_${zone}_REJECT -s $remote_subnet -j reject
echo " 13" "  iptables -A zone_${zone}_INPUT -s $remote_subnet -j zone_${zone}"
  iptables -A zone_${zone}_INPUT -s $remote_subnet -j zone_${zone}
echo " 14" "  iptables -A zone_${zone}_FORWARD -s $remote_subnet -j zone_${zone}_forward"
  iptables -A zone_${zone}_FORWARD -s $remote_subnet -j zone_${zone}_forward
 
echo " 15" "  if [ "$local_nat" == "" ]; then"
  if [ "$local_nat" == "" ]; then
echo " 16" "    iptables -t nat -A zone_${zone}_nat -d $remote_subnet -j ACCEPT"
    iptables -t nat -A zone_${zone}_nat -d $remote_subnet -j ACCEPT
  else
echo " 17" "    iptables -t nat -A zone_${zone}_nat -d $remote_subnet -s $local_subnet -j NETMAP --to $local_nat"
    iptables -t nat -A zone_${zone}_nat -d $remote_subnet -s $local_subnet -j NETMAP --to $local_nat
echo " 18" "    iptables -t nat -A prerouting_${zone} -s $remote_subnet -d $local_nat -j NETMAP --to $local_subnet"
    iptables -t nat -A prerouting_${zone} -s $remote_subnet -d $local_nat -j NETMAP --to $local_subnet
  fi
}
 
GetRemote() {
echo " 19" "  local enabled"
  local enabled
echo " 20" "  local gateway"
  local gateway
 
echo " 21" "  config_get_bool enabled "$1" enabled 0"
  config_get_bool enabled "$1" enabled 0
echo " 22" "  config_get      gateway "$1" gateway"
  config_get      gateway "$1" gateway
echo " 23" "  [[ "$enabled" == "0" ]] && return"
  [[ "$enabled" == "0" ]] && return
 
echo " 24" "  config_list_foreach "$1" tunnel GetTunnel"
  config_list_foreach "$1" tunnel GetTunnel
}
 
GetDevice() {
echo " 25" "  . /lib/functions/network.sh"
  . /lib/functions/network.sh
echo " 26" "  local interface="$1""
  local interface="$1"
echo " 27" "  network_get_device listen "$interface""
  network_get_device listen "$interface"
  # open IPsec endpoint
echo " 28" "  if [ "$listen" == "" ]; then"
  if [ "$listen" == "" ]; then
echo " 29" "    iptables -A zone_${zone}_gateway -p esp -j ACCEPT"
    iptables -A zone_${zone}_gateway -p esp -j ACCEPT
echo " 30" "    iptables -A zone_${zone}_gateway -p udp --dport 500 -j ACCEPT"
    iptables -A zone_${zone}_gateway -p udp --dport 500 -j ACCEPT
echo " 31" "    iptables -A zone_${zone}_gateway -p udp --dport 4500 -j ACCEPT"
    iptables -A zone_${zone}_gateway -p udp --dport 4500 -j ACCEPT
echo " 32" "    if [ $has_ip6tables -eq 1 ]; then"
    if [ $has_ip6tables -eq 1 ]; then
echo " 33" "      ip6tables -A zone_${zone}_gateway -p esp -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -p esp -j ACCEPT
echo " 34" "      ip6tables -A zone_${zone}_gateway -p udp --dport 500 -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -p udp --dport 500 -j ACCEPT
echo " 35" "      ip6tables -A zone_${zone}_gateway -p udp --dport 4500 -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -p udp --dport 4500 -j ACCEPT
    fi
  else
echo " 36" "    iptables -A zone_${zone}_gateway -i $listen -p esp -j ACCEPT"
    iptables -A zone_${zone}_gateway -i $listen -p esp -j ACCEPT
echo " 37" "    iptables -A zone_${zone}_gateway -i $listen -p udp --dport 500 -j ACCEPT"
    iptables -A zone_${zone}_gateway -i $listen -p udp --dport 500 -j ACCEPT
echo " 38" "    iptables -A zone_${zone}_gateway -i $listen -p udp --dport 4500 -j ACCEPT"
    iptables -A zone_${zone}_gateway -i $listen -p udp --dport 4500 -j ACCEPT
echo " 39" "    if [ $has_ip6tables -eq 1 ]; then"
    if [ $has_ip6tables -eq 1 ]; then
echo " 40" "      ip6tables -A zone_${zone}_gateway -i $listen -p esp -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -i $listen -p esp -j ACCEPT
echo " 41" "      ip6tables -A zone_${zone}_gateway -i $listen -p udp --dport 500 -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -i $listen -p udp --dport 500 -j ACCEPT
echo " 42" "      ip6tables -A zone_${zone}_gateway -i $listen -p udp --dport 4500 -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -i $listen -p udp --dport 4500 -j ACCEPT
    fi
  fi
 
}
 
GetInterface() {
echo " 43" "  config_list_foreach "$1" listen GetDevice"
  config_list_foreach "$1" listen GetDevice
}
 
echo " 44" "zone=vpn"
zone=vpn
echo " 45" "config_load ipsec"
config_load ipsec
echo " 46" "config_foreach GetZone ipsec"
config_foreach GetZone ipsec
 
echo " 47" "if [ -x /usr/sbin/ip6tables ]; then"
if [ -x /usr/sbin/ip6tables ]; then
echo " 48" "  has_ip6tables=1"
  has_ip6tables=1
else
echo " 49" "  has_ip6tables=0"
  has_ip6tables=0
fi
 
echo " 50" "iptables -F zone_${zone}_ACCEPT"
iptables -F zone_${zone}_ACCEPT
echo " 51" "if [ $has_ip6tables -eq 1 ]; then"
if [ $has_ip6tables -eq 1 ]; then
echo " 52" "  ip6tables -F zone_${zone}_ACCEPT"
  ip6tables -F zone_${zone}_ACCEPT
fi
 
echo " 53" "iptables -N zone_${zone}_gateway"
iptables -N zone_${zone}_gateway
echo " 54" "iptables -I INPUT -j zone_${zone}_gateway"
iptables -I INPUT -j zone_${zone}_gateway
echo " 55" "if [ $has_ip6tables -eq 1 ]; then"
if [ $has_ip6tables -eq 1 ]; then
echo " 56" "  ip6tables -N zone_${zone}_gateway"
  ip6tables -N zone_${zone}_gateway
echo " 57" "  ip6tables -I INPUT -j zone_${zone}_gateway"
  ip6tables -I INPUT -j zone_${zone}_gateway
fi
echo " 58" "config_foreach GetInterface ipsec"
config_foreach GetInterface ipsec
 
echo " 59" "iptables -t nat -F zone_${zone}_nat"
iptables -t nat -F zone_${zone}_nat
echo " 60" "iptables -t nat -I POSTROUTING 2 -j zone_${zone}_nat"
iptables -t nat -I POSTROUTING 2 -j zone_${zone}_nat
echo " 61" "iptables -t nat -I PREROUTING 2 -j zone_${zone}_prerouting"
iptables -t nat -I PREROUTING 2 -j zone_${zone}_prerouting
 
# sort VPN rules to top of forward zones and insert VPN reject marker afterwards
echo " 62" "ForwardZones=`iptables -S | awk '/.N.*zone.*_forward/{print $2}' | grep -v ${zone}`"
ForwardZones=`iptables -S | awk '/.N.*zone.*_forward/{print $2}' | grep -v ${zone}`
echo " 63" "for ForwardZone in $ForwardZones ; do"
for ForwardZone in $ForwardZones ; do
echo " 64" "  echo "iptables -F $ForwardZone" > /tmp/fwrebuild"
  echo "iptables -F $ForwardZone" > /tmp/fwrebuild
echo " 65" "  iptables -S $ForwardZone | grep zone_${zone}_ACCEPT | grep -v "^-N" | awk '{ print "iptables " $0}' >> /tmp/fwrebuild"
  iptables -S $ForwardZone | grep zone_${zone}_ACCEPT | grep -v "^-N" | awk '{ print "iptables " $0}' >> /tmp/fwrebuild
echo " 66" "  echo "iptables -A $ForwardZone -j zone_${zone}_REJECT" >> /tmp/fwrebuild"
  echo "iptables -A $ForwardZone -j zone_${zone}_REJECT" >> /tmp/fwrebuild
echo " 67" "  iptables -S $ForwardZone | grep -v zone_${zone}_ACCEPT | grep -v "^-N" | awk '{ print "iptables " $0}' >> /tmp/fwrebuild"
  iptables -S $ForwardZone | grep -v zone_${zone}_ACCEPT | grep -v "^-N" | awk '{ print "iptables " $0}' >> /tmp/fwrebuild
 
echo " 68" "  chmod +x /tmp/fwrebuild"
  chmod +x /tmp/fwrebuild
echo " 69" "  /tmp/fwrebuild"
  /tmp/fwrebuild
echo " 70" "  rm /tmp/fwrebuild"
  rm /tmp/fwrebuild
done
 
# link zone_vpn via zone_vpn_INPUT
echo " 71" "iptables -N zone_${zone}_INPUT"
iptables -N zone_${zone}_INPUT
echo " 72" "iptables -I INPUT -j zone_${zone}_INPUT"
iptables -I INPUT -j zone_${zone}_INPUT
 
# link zone_vpn_forward via zone_vpn_FORWARD
echo " 73" "iptables -N zone_${zone}_FORWARD"
iptables -N zone_${zone}_FORWARD
echo " 74" "iptables -I FORWARD -j zone_${zone}_FORWARD"
iptables -I FORWARD -j zone_${zone}_FORWARD
 
echo " 75" "config_foreach GetRemote remote"
config_foreach GetRemote remote

Alles anzeigen

Damit sieht der Output so aus:

/etc/init.d/firewall restart

Code

Warning: Section @zone[2] (vpn) has no device, network, subnet or extra options
does not specify a protocol, assuming TCP+UDP
Warning: Section @zone[2] (vpn) has no device, network, subnet or extra options
 * Flushing IPv4 filter table
 * Flushing IPv4 nat table
 * Flushing IPv4 mangle table
 * Flushing IPv4 raw table
 * Flushing IPv6 filter table
 * Flushing IPv6 mangle table
 * Flushing IPv6 raw table
 * Flushing conntrack table ...
 * Populating IPv4 filter table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
   * Rule 'Allow-DHCP-Renew'
   * Rule 'Allow-Ping'
   * Rule 'Allow-IGMP'
   * Rule 'Allow-esp'
   * Rule 'Allow-UDP-500'
   * Rule 'Allow-forward_to_vpn'
   * Forward 'lan' -> 'wan'
 * Populating IPv4 nat table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv4 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv4 raw table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv6 filter table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
   * Rule 'Allow-DHCPv6'
   * Rule 'Allow-MLD'
   * Rule 'Allow-ICMPv6-Input'
   * Rule 'Allow-ICMPv6-Forward'
   * Forward 'lan' -> 'wan'
 * Populating IPv6 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv6 raw table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Set tcp_ecn to off
 * Set tcp_syncookies to on
 * Set tcp_window_scaling to on
 * Running script '/etc/firewall.user'
  1 . /lib/functions.sh
 44 zone=vpn
 45 config_load ipsec
 46 config_foreach GetZone ipsec
  2   config_get zone "cfg026e19" zone vpn
 47 if [ -x /usr/sbin/ip6tables ]; then
 48   has_ip6tables=1
 50 iptables -F zone_vpn_ACCEPT
 51 if [ 1 -eq 1 ]; then
 52   ip6tables -F zone_vpn_ACCEPT
ip6tables: No chain/target/match by that name.
 53 iptables -N zone_vpn_gateway
 54 iptables -I INPUT -j zone_vpn_gateway
 55 if [ 1 -eq 1 ]; then
 56   ip6tables -N zone_vpn_gateway
 57   ip6tables -I INPUT -j zone_vpn_gateway
 58 config_foreach GetInterface ipsec
 43   config_list_foreach "cfg026e19" listen GetDevice
 25   . /lib/functions/network.sh
 26   local interface=""
 27   network_get_device listen ""
 28   if [ "" == "" ]; then
 29     iptables -A zone_vpn_gateway -p esp -j ACCEPT
 30     iptables -A zone_vpn_gateway -p udp --dport 500 -j ACCEPT
 31     iptables -A zone_vpn_gateway -p udp --dport 4500 -j ACCEPT
 32     if [ 1 -eq 1 ]; then
 33       ip6tables -A zone_vpn_gateway -p esp -j ACCEPT
 34       ip6tables -A zone_vpn_gateway -p udp --dport 500 -j ACCEPT
 35       ip6tables -A zone_vpn_gateway -p udp --dport 4500 -j ACCEPT
 59 iptables -t nat -F zone_vpn_nat
 60 iptables -t nat -I POSTROUTING 2 -j zone_vpn_nat
 61 iptables -t nat -I PREROUTING 2 -j zone_vpn_prerouting
 62 ForwardZones=zone_lan_forward
zone_wan_forward
 63 for ForwardZone in zone_lan_forward
zone_wan_forward ; do
 64   echo "iptables -F zone_lan_forward" > /tmp/fwrebuild
 65   iptables -S zone_lan_forward | grep zone_vpn_ACCEPT | grep -v "^-N" | awk '{ print "iptables " /etc/ipsec/firewall.sh}' >> /tmp/fwrebuild
 66   echo "iptables -A zone_lan_forward -j zone_vpn_REJECT" >> /tmp/fwrebuild
 67   iptables -S zone_lan_forward | grep -v zone_vpn_ACCEPT | grep -v "^-N" | awk '{ print "iptables " /etc/ipsec/firewall.sh}' >> /tmp/fwrebuild
 68   chmod +x /tmp/fwrebuild
 69   /tmp/fwrebuild
 70   rm /tmp/fwrebuild
 64   echo "iptables -F zone_wan_forward" > /tmp/fwrebuild
 65   iptables -S zone_wan_forward | grep zone_vpn_ACCEPT | grep -v "^-N" | awk '{ print "iptables " /etc/ipsec/firewall.sh}' >> /tmp/fwrebuild
 66   echo "iptables -A zone_wan_forward -j zone_vpn_REJECT" >> /tmp/fwrebuild
 67   iptables -S zone_wan_forward | grep -v zone_vpn_ACCEPT | grep -v "^-N" | awk '{ print "iptables " /etc/ipsec/firewall.sh}' >> /tmp/fwrebuild
 68   chmod +x /tmp/fwrebuild
 69   /tmp/fwrebuild
 70   rm /tmp/fwrebuild
 71 iptables -N zone_vpn_INPUT
 72 iptables -I INPUT -j zone_vpn_INPUT
 73 iptables -N zone_vpn_FORWARD
 74 iptables -I FORWARD -j zone_vpn_FORWARD
 75 config_foreach GetRemote remote
 19   local enabled
 20   local gateway
 21   config_get_bool enabled "racoon" enabled 0
 22   config_get      gateway "racoon" gateway
 23   [[ "1" == "0" ]] && return
 24   config_list_foreach "racoon" tunnel GetTunnel
  3   local remote_subnet
  4   local local_subnet
  5   local local_nat
  6   config_get remote_subnet "racoon_lan" remote_subnet
  7   config_get local_subnet  "racoon_lan" local_subnet
  8   config_get local_nat     "racoon_lan" local_nat ""
  9   iptables -A zone_vpn_ACCEPT -d 88.198.76.220/32 -j ACCEPT
 10   iptables -A zone_vpn_ACCEPT -s 88.198.76.220/32 -j ACCEPT
 11   iptables -A zone_vpn_REJECT -d 88.198.76.220/32 -j reject
 12   iptables -A zone_vpn_REJECT -s 88.198.76.220/32 -j reject
 13   iptables -A zone_vpn_INPUT -s 88.198.76.220/32 -j zone_vpn
 14   iptables -A zone_vpn_FORWARD -s 88.198.76.220/32 -j zone_vpn_forward
 15   if [ "" == "" ]; then
 16     iptables -t nat -A zone_vpn_nat -d 88.198.76.220/32 -j ACCEPT

Alles anzeigen

Wenn ich dann aber ipsec starte bekomme ich nach wie vor keine Verbindung zu racoon.

Hier noch der Output von iptables-save, vielleicht kannst du daran ja noch was erkennen:

iptables-save

Code

# Generated by iptables-save v1.4.21 on Fri Dec  4 09:40:20 2015
*nat
:PREROUTING ACCEPT [2:389]
:INPUT ACCEPT [1:328]
:OUTPUT ACCEPT [1:116]
:POSTROUTING ACCEPT [1:116]
:delegate_postrouting - [0:0]
:delegate_prerouting - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_vpn_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_vpn_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_vpn_nat - [0:0]
:zone_vpn_postrouting - [0:0]
:zone_vpn_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -j delegate_prerouting
-A PREROUTING -j zone_vpn_prerouting
-A POSTROUTING -j delegate_postrouting
-A POSTROUTING -j zone_vpn_nat
-A delegate_postrouting -m comment --comment "user chain for postrouting" -j postrouting_rule
-A delegate_postrouting -o br-lan -j zone_lan_postrouting
-A delegate_postrouting -o eth0 -j zone_wan_postrouting
-A delegate_prerouting -m comment --comment "user chain for prerouting" -j prerouting_rule
-A delegate_prerouting -i br-lan -j zone_lan_prerouting
-A delegate_prerouting -i eth0 -j zone_wan_prerouting
-A zone_lan_postrouting -m comment --comment "user chain for postrouting" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "user chain for prerouting" -j prerouting_lan_rule
-A zone_vpn_nat -d 88.198.76.220/32 -j ACCEPT
-A zone_vpn_postrouting -m comment --comment "user chain for postrouting" -j postrouting_vpn_rule
-A zone_vpn_prerouting -m comment --comment "user chain for prerouting" -j prerouting_vpn_rule
-A zone_wan_postrouting -m comment --comment "user chain for postrouting" -j postrouting_wan_rule
-A zone_wan_postrouting -j MASQUERADE
-A zone_wan_prerouting -m comment --comment "user chain for prerouting" -j prerouting_wan_rule
COMMIT
# Completed on Fri Dec  4 09:40:20 2015
# Generated by iptables-save v1.4.21 on Fri Dec  4 09:40:20 2015
*raw
:PREROUTING ACCEPT [134:8377]
:OUTPUT ACCEPT [113:16040]
:delegate_notrack - [0:0]
:zone_vpn_notrack - [0:0]
-A PREROUTING -j delegate_notrack
-A zone_vpn_notrack -j CT --notrack
COMMIT
# Completed on Fri Dec  4 09:40:20 2015
# Generated by iptables-save v1.4.21 on Fri Dec  4 09:40:20 2015
*mangle
:PREROUTING ACCEPT [136:8481]
:INPUT ACCEPT [136:8481]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [115:17080]
:POSTROUTING ACCEPT [115:17080]
:fwmark - [0:0]
:mssfix - [0:0]
-A PREROUTING -j fwmark
-A FORWARD -j mssfix
-A mssfix -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "wan (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Fri Dec  4 09:40:20 2015
# Generated by iptables-save v1.4.21 on Fri Dec  4 09:40:20 2015
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:delegate_forward - [0:0]
:delegate_input - [0:0]
:delegate_output - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_dest_REJECT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn - [0:0]
:zone_vpn_ACCEPT - [0:0]
:zone_vpn_FORWARD - [0:0]
:zone_vpn_INPUT - [0:0]
:zone_vpn_REJECT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_dest_REJECT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_gateway - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_REJECT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -j zone_vpn_INPUT
-A INPUT -j zone_vpn_gateway
-A INPUT -j delegate_input
-A FORWARD -j zone_vpn_FORWARD
-A FORWARD -j delegate_forward
-A OUTPUT -j delegate_output
-A delegate_forward -m comment --comment "user chain for forwarding" -j forwarding_rule
-A delegate_forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_forward -i br-lan -j zone_lan_forward
-A delegate_forward -i eth0 -j zone_wan_forward
-A delegate_forward -j reject
-A delegate_input -i lo -j ACCEPT
-A delegate_input -m comment --comment "user chain for input" -j input_rule
-A delegate_input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_input -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn_flood
-A delegate_input -i br-lan -j zone_lan_input
-A delegate_input -i eth0 -j zone_wan_input
-A delegate_input -j reject
-A delegate_output -o lo -j ACCEPT
-A delegate_output -m comment --comment "user chain for output" -j output_rule
-A delegate_output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_output -o br-lan -j zone_lan_output
-A delegate_output -o eth0 -j zone_wan_output
-A delegate_output -j reject
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -j RETURN
-A syn_flood -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -j ACCEPT
-A zone_lan_dest_REJECT -o br-lan -j reject
-A zone_lan_forward -j zone_vpn_REJECT
-A zone_lan_forward -m comment --comment "user chain for forwarding" -j forwarding_lan_rule
-A zone_lan_forward -d 88.198.76.220/32 -p tcp -m comment --comment Allow-forward_to_vpn -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -d 88.198.76.220/32 -p udp -m comment --comment Allow-forward_to_vpn -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -m comment --comment "forwarding lan -> wan" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_lan_forward -j zone_lan_dest_REJECT
-A zone_lan_input -m comment --comment "user chain for input" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_lan_input -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "user chain for output" -j output_lan_rule
-A zone_lan_output -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -j ACCEPT
-A zone_vpn_ACCEPT -d 88.198.76.220/32 -j ACCEPT
-A zone_vpn_ACCEPT -s 88.198.76.220/32 -j ACCEPT
-A zone_vpn_FORWARD -s 88.198.76.220/32 -j zone_vpn_forward
-A zone_vpn_INPUT -s 88.198.76.220/32 -j zone_vpn
-A zone_vpn_REJECT -d 88.198.76.220/32 -j reject
-A zone_vpn_REJECT -s 88.198.76.220/32 -j reject
-A zone_vpn_forward -m comment --comment "user chain for forwarding" -j forwarding_vpn_rule
-A zone_vpn_forward -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_vpn_forward -j zone_vpn_dest_REJECT
-A zone_vpn_gateway -p esp -j ACCEPT
-A zone_vpn_gateway -p udp -m udp --dport 500 -j ACCEPT
-A zone_vpn_gateway -p udp -m udp --dport 4500 -j ACCEPT
-A zone_vpn_input -m comment --comment "user chain for input" -j input_vpn_rule
-A zone_vpn_input -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_vpn_input -j zone_vpn_src_REJECT
-A zone_vpn_output -m comment --comment "user chain for output" -j output_vpn_rule
-A zone_vpn_output -j zone_vpn_dest_ACCEPT
-A zone_wan_dest_ACCEPT -o eth0 -j ACCEPT
-A zone_wan_dest_REJECT -o eth0 -j reject
-A zone_wan_forward -j zone_vpn_REJECT
-A zone_wan_forward -m comment --comment "user chain for forwarding" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment Allow-esp -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment Allow-UDP-500 -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_wan_forward -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "user chain for input" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment Allow-DHCP-Renew -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment Allow-Ping -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment Allow-IGMP -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_wan_input -j zone_wan_src_REJECT
-A zone_wan_output -m comment --comment "user chain for output" -j output_wan_rule
-A zone_wan_output -j zone_wan_dest_ACCEPT
-A zone_wan_src_REJECT -i eth0 -j reject
COMMIT
# Completed on Fri Dec  4 09:40:20 2015

Alles anzeigen

Klaus

ATD · 4. Dezember 2015

Eine Fehlermeldung haben wir noch bei "52 ip6tables -F zone_vpn_ACCEPT". Das kannst Du mit ip6tables -N zone_vpn_ACCEPT aus der Post 174 bereinigen.

Eine kurze Inspektion zeigt aber logische Fehler (Reihenfolge / Zuordnung), auch wenn wir nahezu null Fehlermeldungen mehr bekommen. Daran müssen wir noch arbeiten. ;.)

Hilfreich wäre, wenn Du die aktuelle /etc/config/firewall und /etc/firewall.user zeigen würdest. Wenn ich sie in der VM einbaue, dann könnte ich mit LuCI die Abarbeitungsreihenfolge besser betrachten.

Es eilt nicht!

Albert

kls · 5. Dezember 2015

Die Fehlermeldung bzgl. IPv6 können wir wohl vernachlässigen, da ich nur IPv4 mache.
Werde die Zeile aber noch einbauen.

/etc/config/firewall

Code

#/etc/config/firewall
config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-esp'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-UDP-500'
        option src 'wan'
        option dest 'lan'
        option proto 'udp'
        option dest_port '500'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-forward_to_vpn'
        option enabled '1'
        option src 'lan'
        option dest 'vpn'
        option dest_ip '88.198.76.220/32'
        option family 'ipv4'
        option target 'ACCEPT'


config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'REJECT'
        option forward 'REJECT'


config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'


config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'


config zone
        option name 'vpn'
        option network ' '
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'


config forwarding
        option src 'lan'
        option dest 'wan'


config include
        option path '/etc/firewall.user'
        option reload 1

Alles anzeigen

/etc/firewall.user

Klaus

kls · 6. Dezember 2015

Ich habe das Script jetzt so geändert, daß die fehlende IPv6-Zone angelegt wird und daß am Schluß die temporären Files nicht gelöscht werden, damit man mal sehen kann, was da eigentlich genau gemacht wird:

/etc/ipsec/firewall.sh

Code

#/etc/ipsec/firewall.sh


#!/bin/sh
#/etc/ipsec/firewall.sh - version 2
 
echo "  1" ". /lib/functions.sh"
. /lib/functions.sh


echo "  2" "iptables -N zone_vpn_ACCEPT"
iptables -N zone_vpn_ACCEPT
echo "  3" "ip6tables -N zone_vpn_ACCEPT"
ip6tables -N zone_vpn_ACCEPT


GetZone() {
echo "  4" "  config_get zone "$1" zone vpn"
  config_get zone "$1" zone vpn
}
 
GetTunnel() {
echo "  5" "  local remote_subnet"
  local remote_subnet
echo "  6" "  local local_subnet"
  local local_subnet
echo "  7" "  local local_nat"
  local local_nat
 
echo "  8" "  config_get remote_subnet "$1" remote_subnet"
  config_get remote_subnet "$1" remote_subnet
echo "  9" "  config_get local_subnet  "$1" local_subnet"
  config_get local_subnet  "$1" local_subnet
echo " 10" "  config_get local_nat     "$1" local_nat """
  config_get local_nat     "$1" local_nat ""
echo " 11" "  iptables -A zone_${zone}_ACCEPT -d $remote_subnet -j ACCEPT"
  iptables -A zone_${zone}_ACCEPT -d $remote_subnet -j ACCEPT
echo " 12" "  iptables -A zone_${zone}_ACCEPT -s $remote_subnet -j ACCEPT"
  iptables -A zone_${zone}_ACCEPT -s $remote_subnet -j ACCEPT
echo " 13" "  iptables -A zone_${zone}_REJECT -d $remote_subnet -j reject"
  iptables -A zone_${zone}_REJECT -d $remote_subnet -j reject
echo " 14" "  iptables -A zone_${zone}_REJECT -s $remote_subnet -j reject"
  iptables -A zone_${zone}_REJECT -s $remote_subnet -j reject
echo " 15" "  iptables -A zone_${zone}_INPUT -s $remote_subnet -j zone_${zone}"
  iptables -A zone_${zone}_INPUT -s $remote_subnet -j zone_${zone}
echo " 16" "  iptables -A zone_${zone}_FORWARD -s $remote_subnet -j zone_${zone}_forward"
  iptables -A zone_${zone}_FORWARD -s $remote_subnet -j zone_${zone}_forward
 
echo " 17" "  if [ "$local_nat" == "" ]; then"
  if [ "$local_nat" == "" ]; then
echo " 18" "    iptables -t nat -A zone_${zone}_nat -d $remote_subnet -j ACCEPT"
    iptables -t nat -A zone_${zone}_nat -d $remote_subnet -j ACCEPT
  else
echo " 19" "    iptables -t nat -A zone_${zone}_nat -d $remote_subnet -s $local_subnet -j NETMAP --to $local_nat"
    iptables -t nat -A zone_${zone}_nat -d $remote_subnet -s $local_subnet -j NETMAP --to $local_nat
echo " 20" "    iptables -t nat -A prerouting_${zone} -s $remote_subnet -d $local_nat -j NETMAP --to $local_subnet"
    iptables -t nat -A prerouting_${zone} -s $remote_subnet -d $local_nat -j NETMAP --to $local_subnet
  fi
}
 
GetRemote() {
echo " 21" "  local enabled"
  local enabled
echo " 22" "  local gateway"
  local gateway
 
echo " 23" "  config_get_bool enabled "$1" enabled 0"
  config_get_bool enabled "$1" enabled 0
echo " 24" "  config_get      gateway "$1" gateway"
  config_get      gateway "$1" gateway
echo " 25" "  [[ "$enabled" == "0" ]] && return"
  [[ "$enabled" == "0" ]] && return
 
echo " 26" "  config_list_foreach "$1" tunnel GetTunnel"
  config_list_foreach "$1" tunnel GetTunnel
}
 
GetDevice() {
echo " 27" "  . /lib/functions/network.sh"
  . /lib/functions/network.sh
echo " 28" "  local interface="$1""
  local interface="$1"
echo " 29" "  network_get_device listen "$interface""
  network_get_device listen "$interface"
  # open IPsec endpoint
echo " 30" "  if [ "$listen" == "" ]; then"
  if [ "$listen" == "" ]; then
echo " 31" "    iptables -A zone_${zone}_gateway -p esp -j ACCEPT"
    iptables -A zone_${zone}_gateway -p esp -j ACCEPT
echo " 32" "    iptables -A zone_${zone}_gateway -p udp --dport 500 -j ACCEPT"
    iptables -A zone_${zone}_gateway -p udp --dport 500 -j ACCEPT
echo " 33" "    iptables -A zone_${zone}_gateway -p udp --dport 4500 -j ACCEPT"
    iptables -A zone_${zone}_gateway -p udp --dport 4500 -j ACCEPT
echo " 34" "    if [ $has_ip6tables -eq 1 ]; then"
    if [ $has_ip6tables -eq 1 ]; then
echo " 35" "      ip6tables -A zone_${zone}_gateway -p esp -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -p esp -j ACCEPT
echo " 36" "      ip6tables -A zone_${zone}_gateway -p udp --dport 500 -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -p udp --dport 500 -j ACCEPT
echo " 37" "      ip6tables -A zone_${zone}_gateway -p udp --dport 4500 -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -p udp --dport 4500 -j ACCEPT
    fi
  else
echo " 38" "    iptables -A zone_${zone}_gateway -i $listen -p esp -j ACCEPT"
    iptables -A zone_${zone}_gateway -i $listen -p esp -j ACCEPT
echo " 39" "    iptables -A zone_${zone}_gateway -i $listen -p udp --dport 500 -j ACCEPT"
    iptables -A zone_${zone}_gateway -i $listen -p udp --dport 500 -j ACCEPT
echo " 40" "    iptables -A zone_${zone}_gateway -i $listen -p udp --dport 4500 -j ACCEPT"
    iptables -A zone_${zone}_gateway -i $listen -p udp --dport 4500 -j ACCEPT
echo " 41" "    if [ $has_ip6tables -eq 1 ]; then"
    if [ $has_ip6tables -eq 1 ]; then
echo " 42" "      ip6tables -A zone_${zone}_gateway -i $listen -p esp -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -i $listen -p esp -j ACCEPT
echo " 43" "      ip6tables -A zone_${zone}_gateway -i $listen -p udp --dport 500 -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -i $listen -p udp --dport 500 -j ACCEPT
echo " 44" "      ip6tables -A zone_${zone}_gateway -i $listen -p udp --dport 4500 -j ACCEPT"
      ip6tables -A zone_${zone}_gateway -i $listen -p udp --dport 4500 -j ACCEPT
    fi
  fi
 
}
 
GetInterface() {
echo " 45" "  config_list_foreach "$1" listen GetDevice"
  config_list_foreach "$1" listen GetDevice
}
 
echo " 46" "zone=vpn"
zone=vpn
echo " 47" "config_load ipsec"
config_load ipsec
echo " 48" "config_foreach GetZone ipsec"
config_foreach GetZone ipsec
 
echo " 49" "if [ -x /usr/sbin/ip6tables ]; then"
if [ -x /usr/sbin/ip6tables ]; then
echo " 50" "  has_ip6tables=1"
  has_ip6tables=1
else
echo " 51" "  has_ip6tables=0"
  has_ip6tables=0
fi
 
echo " 52" "iptables -F zone_${zone}_ACCEPT"
iptables -F zone_${zone}_ACCEPT
echo " 53" "if [ $has_ip6tables -eq 1 ]; then"
if [ $has_ip6tables -eq 1 ]; then
echo " 54" "  ip6tables -F zone_${zone}_ACCEPT"
  ip6tables -F zone_${zone}_ACCEPT
fi
 
echo " 55" "iptables -N zone_${zone}_gateway"
iptables -N zone_${zone}_gateway
echo " 56" "iptables -I INPUT -j zone_${zone}_gateway"
iptables -I INPUT -j zone_${zone}_gateway
echo " 57" "if [ $has_ip6tables -eq 1 ]; then"
if [ $has_ip6tables -eq 1 ]; then
echo " 58" "  ip6tables -N zone_${zone}_gateway"
  ip6tables -N zone_${zone}_gateway
echo " 59" "  ip6tables -I INPUT -j zone_${zone}_gateway"
  ip6tables -I INPUT -j zone_${zone}_gateway
fi
echo " 60" "config_foreach GetInterface ipsec"
config_foreach GetInterface ipsec
 
echo " 61" "iptables -t nat -F zone_${zone}_nat"
iptables -t nat -F zone_${zone}_nat
echo " 62" "iptables -t nat -I POSTROUTING 2 -j zone_${zone}_nat"
iptables -t nat -I POSTROUTING 2 -j zone_${zone}_nat
echo " 63" "iptables -t nat -I PREROUTING 2 -j zone_${zone}_prerouting"
iptables -t nat -I PREROUTING 2 -j zone_${zone}_prerouting
 
# sort VPN rules to top of forward zones and insert VPN reject marker afterwards
echo " 64" "ForwardZones=`iptables -S | awk '/.N.*zone.*_forward/{print $2}' | grep -v ${zone}`"
ForwardZones=`iptables -S | awk '/.N.*zone.*_forward/{print $2}' | grep -v ${zone}`
echo " 65" "for ForwardZone in $ForwardZones ; do"
for ForwardZone in $ForwardZones ; do
echo " 66" "  echo "iptables -F $ForwardZone" > /tmp/fwrebuild.$ForwardZone"
  echo "iptables -F $ForwardZone" > /tmp/fwrebuild.$ForwardZone
echo " 67" "  iptables -S $ForwardZone | grep zone_${zone}_ACCEPT | grep -v "^-N" | awk '{ print "iptables " $0}' >> /tmp/fwrebuild.$ForwardZone"
  iptables -S $ForwardZone | grep zone_${zone}_ACCEPT | grep -v "^-N" | awk '{ print "iptables " $0}' >> /tmp/fwrebuild.$ForwardZone
echo " 68" "  echo "iptables -A $ForwardZone -j zone_${zone}_REJECT" >> /tmp/fwrebuild.$ForwardZone"
  echo "iptables -A $ForwardZone -j zone_${zone}_REJECT" >> /tmp/fwrebuild.$ForwardZone
echo " 69" "  iptables -S $ForwardZone | grep -v zone_${zone}_ACCEPT | grep -v "^-N" | awk '{ print "iptables " $0}' >> /tmp/fwrebuild.$ForwardZone"
  iptables -S $ForwardZone | grep -v zone_${zone}_ACCEPT | grep -v "^-N" | awk '{ print "iptables " $0}' >> /tmp/fwrebuild.$ForwardZone
echo " 70" "  chmod +x /tmp/fwrebuild.$ForwardZone"
  chmod +x /tmp/fwrebuild.$ForwardZone
echo " 71" "  /tmp/fwrebuild.$ForwardZone"
  /tmp/fwrebuild.$ForwardZone
#echo " 72" "  rm /tmp/fwrebuild.$ForwardZone"
#  rm /tmp/fwrebuild.$ForwardZone
done
 
# link zone_vpn via zone_vpn_INPUT
echo " 73" "iptables -N zone_${zone}_INPUT"
iptables -N zone_${zone}_INPUT
echo " 74" "iptables -I INPUT -j zone_${zone}_INPUT"
iptables -I INPUT -j zone_${zone}_INPUT
 
# link zone_vpn_forward via zone_vpn_FORWARD
echo " 75" "iptables -N zone_${zone}_FORWARD"
iptables -N zone_${zone}_FORWARD
echo " 76" "iptables -I FORWARD -j zone_${zone}_FORWARD"
iptables -I FORWARD -j zone_${zone}_FORWARD
 
echo " 77" "config_foreach GetRemote remote"
config_foreach GetRemote remote

Alles anzeigen

Der Output sieht damit so aus:

/etc/init.d/firewall restart

Code

Warning: Section @zone[2] (vpn) has no device, network, subnet or extra options
does not specify a protocol, assuming TCP+UDP
Warning: Section @zone[2] (vpn) has no device, network, subnet or extra options
 * Flushing IPv4 filter table
 * Flushing IPv4 nat table
 * Flushing IPv4 mangle table
 * Flushing IPv4 raw table
 * Flushing IPv6 filter table
 * Flushing IPv6 mangle table
 * Flushing IPv6 raw table
 * Flushing conntrack table ...
 * Populating IPv4 filter table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
   * Rule 'Allow-DHCP-Renew'
   * Rule 'Allow-Ping'
   * Rule 'Allow-IGMP'
   * Rule 'Allow-esp'
   * Rule 'Allow-UDP-500'
   * Rule 'Allow-forward_to_vpn'
   * Forward 'lan' -> 'wan'
 * Populating IPv4 nat table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv4 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv4 raw table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv6 filter table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
   * Rule 'Allow-DHCPv6'
   * Rule 'Allow-MLD'
   * Rule 'Allow-ICMPv6-Input'
   * Rule 'Allow-ICMPv6-Forward'
   * Forward 'lan' -> 'wan'
 * Populating IPv6 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv6 raw table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Set tcp_ecn to off
 * Set tcp_syncookies to on
 * Set tcp_window_scaling to on
 * Running script '/etc/firewall.user'
/bin/sh: /etc/firewall.user: line 4: /etc/ipsec/firewall.sh: Permission denied
   ! Failed with exit code 2
root@OpenWrt:/etc# chmod +x /etc/ipsec/firewall.sh
root@OpenWrt:/etc# cp firewall.user.013 firewall.user; /etc/init.d/firewall restart
Warning: Section @zone[2] (vpn) has no device, network, subnet or extra options
does not specify a protocol, assuming TCP+UDP
Warning: Section @zone[2] (vpn) has no device, network, subnet or extra options
 * Flushing IPv4 filter table
 * Flushing IPv4 nat table
 * Flushing IPv4 mangle table
 * Flushing IPv4 raw table
 * Flushing IPv6 filter table
 * Flushing IPv6 mangle table
 * Flushing IPv6 raw table
 * Flushing conntrack table ...
 * Populating IPv4 filter table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
   * Rule 'Allow-DHCP-Renew'
   * Rule 'Allow-Ping'
   * Rule 'Allow-IGMP'
   * Rule 'Allow-esp'
   * Rule 'Allow-UDP-500'
   * Rule 'Allow-forward_to_vpn'
   * Forward 'lan' -> 'wan'
 * Populating IPv4 nat table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv4 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv4 raw table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv6 filter table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
   * Rule 'Allow-DHCPv6'
   * Rule 'Allow-MLD'
   * Rule 'Allow-ICMPv6-Input'
   * Rule 'Allow-ICMPv6-Forward'
   * Forward 'lan' -> 'wan'
 * Populating IPv6 mangle table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Populating IPv6 raw table
   * Zone 'lan'
   * Zone 'wan'
   * Zone 'vpn'
 * Set tcp_ecn to off
 * Set tcp_syncookies to on
 * Set tcp_window_scaling to on
 * Running script '/etc/firewall.user'
  1 . /lib/functions.sh
  2 iptables -N zone_vpn_ACCEPT
  3 ip6tables -N zone_vpn_ACCEPT
 46 zone=vpn
 47 config_load ipsec
 48 config_foreach GetZone ipsec
  4   config_get zone "cfg026e19" zone vpn
 49 if [ -x /usr/sbin/ip6tables ]; then
 50   has_ip6tables=1
 52 iptables -F zone_vpn_ACCEPT
 53 if [ 1 -eq 1 ]; then
 54   ip6tables -F zone_vpn_ACCEPT
 55 iptables -N zone_vpn_gateway
 56 iptables -I INPUT -j zone_vpn_gateway
 57 if [ 1 -eq 1 ]; then
 58   ip6tables -N zone_vpn_gateway
 59   ip6tables -I INPUT -j zone_vpn_gateway
 60 config_foreach GetInterface ipsec
 45   config_list_foreach "cfg026e19" listen GetDevice
 27   . /lib/functions/network.sh
 28   local interface=""
 29   network_get_device listen ""
 30   if [ "" == "" ]; then
 31     iptables -A zone_vpn_gateway -p esp -j ACCEPT
 32     iptables -A zone_vpn_gateway -p udp --dport 500 -j ACCEPT
 33     iptables -A zone_vpn_gateway -p udp --dport 4500 -j ACCEPT
 34     if [ 1 -eq 1 ]; then
 35       ip6tables -A zone_vpn_gateway -p esp -j ACCEPT
 36       ip6tables -A zone_vpn_gateway -p udp --dport 500 -j ACCEPT
 37       ip6tables -A zone_vpn_gateway -p udp --dport 4500 -j ACCEPT
 61 iptables -t nat -F zone_vpn_nat
 62 iptables -t nat -I POSTROUTING 2 -j zone_vpn_nat
 63 iptables -t nat -I PREROUTING 2 -j zone_vpn_prerouting
 64 ForwardZones=zone_lan_forward
zone_wan_forward
 65 for ForwardZone in zone_lan_forward
zone_wan_forward ; do
 66   echo "iptables -F zone_lan_forward" > /tmp/fwrebuild.zone_lan_forward
 67   iptables -S zone_lan_forward | grep zone_vpn_ACCEPT | grep -v "^-N" | awk '{ print "iptables " /etc/ipsec/firewall.sh}' >> /tmp/fwrebuild.zone_lan_forward
 68   echo "iptables -A zone_lan_forward -j zone_vpn_REJECT" >> /tmp/fwrebuild.zone_lan_forward
 69   iptables -S zone_lan_forward | grep -v zone_vpn_ACCEPT | grep -v "^-N" | awk '{ print "iptables " /etc/ipsec/firewall.sh}' >> /tmp/fwrebuild.zone_lan_forward
 70   chmod +x /tmp/fwrebuild.zone_lan_forward
 71   /tmp/fwrebuild.zone_lan_forward
 66   echo "iptables -F zone_wan_forward" > /tmp/fwrebuild.zone_wan_forward
 67   iptables -S zone_wan_forward | grep zone_vpn_ACCEPT | grep -v "^-N" | awk '{ print "iptables " /etc/ipsec/firewall.sh}' >> /tmp/fwrebuild.zone_wan_forward
 68   echo "iptables -A zone_wan_forward -j zone_vpn_REJECT" >> /tmp/fwrebuild.zone_wan_forward
 69   iptables -S zone_wan_forward | grep -v zone_vpn_ACCEPT | grep -v "^-N" | awk '{ print "iptables " /etc/ipsec/firewall.sh}' >> /tmp/fwrebuild.zone_wan_forward
 70   chmod +x /tmp/fwrebuild.zone_wan_forward
 71   /tmp/fwrebuild.zone_wan_forward
 73 iptables -N zone_vpn_INPUT
 74 iptables -I INPUT -j zone_vpn_INPUT
 75 iptables -N zone_vpn_FORWARD
 76 iptables -I FORWARD -j zone_vpn_FORWARD
 77 config_foreach GetRemote remote
 21   local enabled
 22   local gateway
 23   config_get_bool enabled "racoon" enabled 0
 24   config_get      gateway "racoon" gateway
 25   [[ "1" == "0" ]] && return
 26   config_list_foreach "racoon" tunnel GetTunnel
  5   local remote_subnet
  6   local local_subnet
  7   local local_nat
  8   config_get remote_subnet "racoon_lan" remote_subnet
  9   config_get local_subnet  "racoon_lan" local_subnet
 10   config_get local_nat     "racoon_lan" local_nat ""
 11   iptables -A zone_vpn_ACCEPT -d 88.198.76.220/32 -j ACCEPT
 12   iptables -A zone_vpn_ACCEPT -s 88.198.76.220/32 -j ACCEPT
 13   iptables -A zone_vpn_REJECT -d 88.198.76.220/32 -j reject
 14   iptables -A zone_vpn_REJECT -s 88.198.76.220/32 -j reject
 15   iptables -A zone_vpn_INPUT -s 88.198.76.220/32 -j zone_vpn
 16   iptables -A zone_vpn_FORWARD -s 88.198.76.220/32 -j zone_vpn_forward
 17   if [ "" == "" ]; then
 18     iptables -t nat -A zone_vpn_nat -d 88.198.76.220/32 -j ACCEPT

Alles anzeigen

Die beiden temporären Dateien sind:

/tmp/fwrebuild.zone_lan_forward

/tmp/fwrebuild.zone_wan_forward

Klaus

ATD · 9. Dezember 2015

Klaus, heute hatte ich ein wenig Zeit (Hotline geschoben). Soweit sind wir schon:

it works ;-)

Code

root@OpenWrt:/# ipsec restart
Stopping strongSwan IPsec...
Starting strongSwan 5.3.3 IPsec [starter]...
root@OpenWrt:/# ipsec statusall
Status of IKE charon daemon (strongSwan 5.3.3, Linux 3.18.20, x86_64):
  uptime: 11 seconds, since Dec 09 18:48:47 2015
  malloc: sbrk 225280, mmap 0, used 212256, free 13024
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 2
  loaded plugins: charon aes des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pgp dnskey sshkey pem fips-prf gmp xcbc hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic
Listening IP addresses:
  192.168.220.1
  79.xxx.xxx.118
Connections:
          ms:  %any...xxx.dyndns.org,0.0.0.0/0,::/0  IKEv1 Aggressive
          ms:   local:  [cougar] uses pre-shared key authentication
          ms:   remote: [racoon] uses pre-shared key authentication
          ms:   child:  192.168.220.0/24 === 192.168.8.0/24 TUNNEL
Security Associations (1 up, 0 connecting):
          ms[1]: ESTABLISHED 11 seconds ago, 79.xxx.xxx.118[cougar]...79.xxx.xxx.173[racoon]
          ms[1]: IKEv1 SPIs: 8b89a581b1d31502_i* 46613ad86a57075c_r, pre-shared key reauthentication in 56 minutes
          ms[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
          ms{1}:  INSTALLED, TUNNEL, reqid 1, ESP SPIs: c0026296_i 31a345cc_o
          ms{1}:  AES_CBC_128/HMAC_SHA1_96, 28 bytes_i, 0 bytes_o, rekeying in 14 minutes
          ms{1}:   192.168.220.0/24 === 192.168.8.0/24
root@OpenWrt:/# traceroute 192.168.8.21
traceroute to 192.168.8.21 (192.168.8.21), 30 hops max, 46 byte packets
 1  192.168.8.254 (192.168.8.254)  53.702 ms  53.536 ms  53.449 ms
 2  192.168.8.21 (192.168.8.21)  53.158 ms  53.760 ms  54.332 ms
root@OpenWrt:/# ping 192.168.8.21
PING 192.168.8.21 (192.168.8.21): 56 data bytes
64 bytes from 192.168.8.21: seq=0 ttl=254 time=53.470 ms
64 bytes from 192.168.8.21: seq=1 ttl=254 time=53.430 ms

Alles anzeigen

Traceroute und Ping von OpenWRT Console an die 30 km entfernter Drucker hinter einem Funkwerk Router.

Lasse mir noch ein paar Tage Zeit. Vielleicht gibt es diese Woche schon die endgültige Lösung.

Albert

ATD · 9. Dezember 2015

Klaus, ich stufe es jetzt als Beta ein, aber teste selbst.

Wie bei der Rotorsteuerung wollte ich mich nicht geschlagen geben. So ist es mir gelungen, ohne den "Script" eine reine Zonen Forwarding mit einfachen Mitteln zu bewältigen.

1. Tunnel steht! (Geht ggf. viel einfacher. Wenn Du magst, dann schreibe ich was dazu.)
2. leftfirewall=no ! iptables Zonen Forward ohne störende Elemente.
3. Deine Änderungen (Diffs) behältst Du, geht aber auch eleganter.

Was Du noch brauchst, das steht hier:

Firewall Regeln

Code

login as: root
root@192.168.220.1's password:




BusyBox v1.23.2 (2015-07-25 06:35:11 CEST) built-in shell (ash)


  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 CHAOS CALMER (15.05, r46767)
 -----------------------------------------------------
  * 1 1/2 oz Gin            Shake with a glassful
  * 1/4 oz Triple Sec       of broken ice and pour
  * 3/4 oz Lime Juice       unstrained into a goblet.
  * 1 1/2 oz Orange Juice
  * 1 tsp. Grenadine Syrup
 -----------------------------------------------------
root@OpenWrt:~# cat /etc/config/firewall
#/etc/config/firewall
config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'


config zone
        option name 'vpn'
        option network ' '
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option subnet '192.168.8.0/24'


config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'


config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'


config forwarding
        option src 'vpn'
        option dest 'wan'


config forwarding
        option src 'lan'
        option dest 'wan'


config include
        option path '/etc/firewall.user'
        option reload 1


root@OpenWrt:~# cat /etc/firewall.user
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.


# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.


iptables -t nat -A prerouting_wan_rule -m policy --dir in --pol ipsec -j ACCEPT
iptables -t nat -A postrouting_wan_rule -m policy --dir out --pol ipsec -j ACCEPT
iptables -A forwarding_rule -m policy --dir in --pol ipsec -m conntrack --ctstate N -j zone_vpn_forward
iptables -A input_wan_rule -m policy --dir in --pol ipsec -m conntrack --ctstate N -j ACCEPT
root@OpenWrt:~#

Alles anzeigen

IP auf racoon setzen! Das war's schon.

Albert

kls · 10. Dezember 2015

Albert, du bist der Größte!!!

Direkt vom Router aus klappt es damit schon mal:

Code

root@OpenWrt:/etc# traceroute racoon.tvdr.de
traceroute to racoon.tvdr.de (88.198.76.220), 30 hops max, 38 byte packets
 1  racoon.tvdr.de (88.198.76.220)  24.885 ms  23.960 ms  25.415 ms
root@OpenWrt:/etc# ping racoon.tvdr.de
PING racoon.tvdr.de (88.198.76.220): 56 data bytes
64 bytes from 88.198.76.220: seq=0 ttl=64 time=30.125 ms
64 bytes from 88.198.76.220: seq=1 ttl=64 time=28.786 ms
64 bytes from 88.198.76.220: seq=2 ttl=64 time=29.116 ms
64 bytes from 88.198.76.220: seq=3 ttl=64 time=34.181 ms

Und ich kann auch umgekehrt von racoon aus den Router direkt ansprechen:

Code

racoon:~ # traceroute 192.168.1.1
traceroute to 192.168.1.1 (192.168.1.1), 30 hops max, 60 byte packets
 1  cougar.tvdr.de (192.168.1.1)  31.941 ms  31.930 ms  31.924 ms
racoon:~ # ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=28.3 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=23.2 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=24.9 ms

Was noch nicht geht ist racoon von einem Rechner im lokalen Netz (also "hinter" dem Router) anzusprechen:

Code

traceroute to racoon.tvdr.de (88.198.76.220), 64 hops max, 52 byte packets
 1  192.168.1.1 (192.168.1.1)  1.310 ms  0.878 ms  0.829 ms
 2  192.168.1.1 (192.168.1.1)  0.853 ms  0.821 ms  0.814 ms
Klauss-MacBook-Pro:~ kls$ ping racoon.tvdr.de
PING racoon.tvdr.de (88.198.76.220): 56 data bytes
92 bytes from 192.168.1.1: Destination Port Unreachable
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 5400 8996   0 0000  3f  01 8a15 192.168.1.179  88.198.76.220 


Request timeout for icmp_seq 0

Alles anzeigen

Und auch von racoon aus kann ich keinen Rechner "hinter" dem Router (also z.B. 192.168.1.220) ansprechen.

Wenn du auch dafür noch eine Lösung finden könntest, dann wäre es perfekt!

Klaus

ATD · 10. Dezember 2015

Zitat von kls

Albert, du bist der Größte!!!

Wenn Du es meinst.

Zitat von kls

Was noch nicht geht ist racoon von einem Rechner im lokalen Netz (also "hinter" dem Router) anzusprechen:

Das geht bei mir. Wie sind die IP Einstellungen von Deinem MacBook-Pro? (MacBook!?)

Zitat von kls

Und auch von racoon aus kann ich keinen Rechner "hinter" dem Router (also z.B. 192.168.1.220) ansprechen.

Zitat von kls

Wenn du auch dafür noch eine Lösung finden könntest, dann wäre es perfekt!

Das muss ich noch testen. Ich setze in VM OpenWRT neu auf (dauert ca. 15 Minuten), denn es geht viel schlanker als angenommen, dann berichte ich.

Albert

kls · 10. Dezember 2015

Zitat von ATD

Das geht bei mir. Wie sind die IP Einstellungen von Deinem MacBook-Pro? (MacBook!?)

Alles "out of the box" mit DHCP. Es geht auch von einem anderen (Linux-)Rechner aus hinter dem Router nicht.
Da fehlt vielleicht noch eine entsprechende FW-Regel.

Klaus

ATD · 10. Dezember 2015

Zitat von kls

Da fehlt vielleicht noch eine entsprechende FW-Regel.

So ist es.

Zusammenfassung:

1. OpenWRT in der VM Aufgesetzt, konfiguriert (Passwort, SSH, Interfaces, Zeit).
2. opkg update && opkg install strongswan-default ipset bringt alle benötigte Pakete.
3. /etc/strongswan.conf nicht geändert, /etc/ipsec.conf (leftfirewall=no !) und /etc/ipsec.secrets angepasst, Tunnel steht.
4. /etc/config/firewall und /etc/firewall.user erstellt, reboot.

/etc/config/firewall

Code

#/etc/config/firewall
config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'


config zone
        option name 'vpn'
        option network ' '
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option subnet '192.168.8.0/24'


config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'


config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'


config forwarding
        option src 'vpn'
        option dest 'lan'


config forwarding
        option src 'lan'
        option dest 'vpn'


config forwarding
        option src 'lan'
        option dest 'wan'


config include
        option path '/etc/firewall.user'
        option reload 1

Alles anzeigen

/etc/firewall.user

Das wäre mal eine aussagekräftige Anleitung, findest Du nicht? Wozu auf drei verschiedenen Internetseiten beschreiben, was nicht funktioniert?

Die /etc/config/firewall ist neu, tausche sie aus (IP ersetzen!). Sie behebt Deine restlichen Probleme.

Möchtest Du auch einen Tunnel von cougar nach panther?

Albert

kls · 10. Dezember 2015

SUPER!!!

Es funktioniert! In alle Richtungen und zwischen allen beteiligten Rechnern! Genau so, wie ich es brauche!
Deine Anleitung ist genial einfach und ich bin froh, daß du ohne das dubiose firewall.sh Script auskommst :-).
Ich werde am WE den Router nochmal komplett neu aufsetzen und deine Anleitung durchspielen. Durch die ganzen Versuche habe ich ja einiges installiert und "zerkonfiguriert", was gar nicht nötig ist. Dann habe ich wieder ein "sauberes" System :-).

Einen Tunnel zwischen cougar und panther hätte ich schon gerne, wobei ich bis jetzt davon ausgegangen bin, daß man das wohl mit entsprechenden Routing-Einträgen lösen könnte. Also etwa auf dem neuen Router eintragen, daß 192.168.100.0/24 zu racoon geroutet werden soll (racoon "weiß" ja bereits, wo dieses Netz hingeht) und auf panther entsprechend eintragen, daß 192.168.1.0/24 zu racoon geroutet wird. Oder mache ich es mir da zu einfach und man müsste das auch über iptables lösen?

Auf jeden Fall hast du mir ganz enorm geholfen! Ohne deine Hilfe wäre ich da wohl nie weitergekommen.
Dafür tausend Dank!

Klaus

ATD · 11. Dezember 2015

Zitat von kls

Deine Anleitung ist genial einfach und ich bin froh, daß du ohne das dubiose firewall.sh Script auskommst :-).

Ich auch. Das Script ist, na ja.

Zitat von kls

Ich werde am WE den Router nochmal komplett neu aufsetzen und deine Anleitung durchspielen.

Das ist eine gute Idee.

Zitat von kls

Einen Tunnel zwischen cougar und panther hätte ich schon gerne, wobei ich bis jetzt davon ausgegangen bin, daß man das wohl mit entsprechenden Routing-Einträgen lösen könnte.

Das geht mit strongSwan so brutal einfach, dass man es nur als Eleganz bezeichnen kann.

In /etc/ipsec.conf tragen wir einen neuen conn nach panther ein und schlagen den zweiten Subnet in der /etc/config/firewall dazu (option subnet '88.xxx.xxx.220/32 192.168.100.0/24').

Ja, das ist alles.

Ach: strongswan-mod-kernel-libipsec, forget it! Auch die diff-s. Wenn Du es unbedingt brauchst, dann so:

/etc/strongswan.conf

Das Log ist sehr gesprächig. Wenn Du magst oder wenig Platz, dann ändern.

Wie auch immer, wenn Du neu installierst, dann sollten wir VORHER die /etc/ipsec.conf unter die Lupe nehmen!

Hättest Du Dir nicht für die Sache eine Woche ohne Fußball aussuchen können!?

Albert

ATD · 11. Dezember 2015

Das ist für die zwei Tunnel (racoon und panther) von cougar gesehen.

/etc/ipsec.conf

Den zweiten Subnet in der /etc/config/firewall unter (option subnet '88.xxx.xxx.220/32 192.168.100.0/24') eintragen.

Albert

kls · 11. Dezember 2015

Ich habe es jetzt mit deinem jüngsten ipsec.conf probiert und auch damit funktioniert alles wunderbar.
Hier die etwas "aufgeräumte" Version, die ich jetzt auf cougar verwende:

/etc/ipsec.conf

Einige Parameter, die ich bisher nicht verwendet habe, die du aber angegeben hast, habe ich erstmal auskommentiert - ich möchte das Ganze zu simpel wie möglich halten.
Damit erhalte ich folgendes

ipsec statusall

Code

Status of IKE charon daemon (strongSwan 5.3.3, Linux 3.18.20, mips):
  uptime: 6 minutes, since Dec 11 16:47:18 2015
  malloc: sbrk 266240, mmap 0, used 250288, free 15952
  worker threads: 5 of 16 idle, 7/0/4/0 working, job queue: 0/0/0/0, scheduled: 5
  loaded plugins: charon test-vectors ldap pkcs11 aes des blowfish rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt af-alg fips-prf gmp agent xcbc cmac hmac ctr ccm gcm curl mysql sqlite attr kernel-libipsec kernel-netlink resolve socket-default farp stroke smp updown eap-identity eap-md5 eap-mschapv2 eap-radius eap-tls xauth-generic xauth-eap dhcp whitelist led duplicheck uci addrblock unity
Listening IP addresses:
  188.192.84.110
  192.168.1.1
  fd4c:dd00:f364::1
Connections:
      racoon:  %any...88.198.76.220  IKEv1/2
      racoon:   local:  [cougar.tvdr.de] uses pre-shared key authentication
      racoon:   remote: [racoon.tvdr.de] uses pre-shared key authentication
      racoon:   child:  192.168.1.0/24 === dynamic TUNNEL
     panther:  %any...panther.tvdr.de,0.0.0.0/0,::/0  IKEv1/2
     panther:   local:  [cougar.tvdr.de] uses pre-shared key authentication
     panther:   remote: [panther.tvdr.de] uses pre-shared key authentication
     panther:   child:  192.168.1.0/24 === 192.168.100.0/24 TUNNEL
Security Associations (1 up, 0 connecting):
      racoon[1]: ESTABLISHED 6 minutes ago, 188.192.84.110[cougar.tvdr.de]...88.198.76.220[racoon.tvdr.de]
      racoon[1]: IKEv2 SPIs: e7bc45f66ae4199d_i* 65afd5b353e6910a_r, pre-shared key reauthentication in 2 hours
      racoon[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
      racoon{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: 1d4a8f3b_i c7215cf1_o
      racoon{1}:  AES_CBC_128/HMAC_SHA1_96, 3479173 bytes_i (5139 pkts, 12s ago), 238335 bytes_o (3317 pkts, 12s ago), rekeying in 41 minutes
      racoon{1}:   192.168.1.0/24 === 88.198.76.220/32

Alles anzeigen

Der Tunnel zu panther ist offensichtlich schon bereit, die entsprechenden Änderungen auf panther wage ich aber remote nicht zu machen, um nicht Gefahr zu laufen, mich auszusperren. Ich bin Montag/Dienstag wieder am alten Standort, dann werde ich das von dort aus testen.
Morgen werde ich das Ganze hier auf cougar nochmal vom Scratch neu aufsetzen, um zu sehen mit welchen minimalen Anpassungen es funktioniert.

Klaus

ATD · 11. Dezember 2015

Zitat von kls

Einige Parameter, die ich bisher nicht verwendet habe, die du aber angegeben hast, habe ich erstmal auskommentiert - ich möchte das Ganze zu simpel wie möglich halten.

Die Einträge ike und esp brauchst Du spätestens nach der Neuinstallation, weil strongswan-mod-kernel-libipsec für die "Suchautomatik" nicht mit installiert wird, wozu auch.

Das Mode aggressive=yes schaltest Du zu, wenn es bei der Tunnel mit dynamische IPs Probleme gibt, wie right=%panther.tvdr.de, sonst tut es das Mode main auch. Ob ikev1 oder ikev2, bzw. Kombi, dass ist Deine Sache.

Du arbeitest mit AES-128, dazu passt die PFS DH Gruppe modp2048 nicht. Besser wäre es die modp3072 zu nehmen (sofern vertretbar), damit Du in DH auch 128 security bits hast. Bei modp2048 sind es nur 103 bits und damit eine potentielle Schwachstelle in der Verschlüsselungskette. Wer einen brute-force plant dann wendet er das traditionell auf DH und nicht auf AES an. Wir wollen nicht, dass PFS nicht mehr für Perfect Forward Secrecy steht.

Zitat von kls

Der Tunnel zu panther ist offensichtlich schon bereit, die entsprechenden Änderungen auf panther wage ich aber remote nicht zu machen, um nicht Gefahr zu laufen, mich auszusperren.

Ein SSH Portforward von WAN kommend auf 127.0.0.1 verhindert das schon. Wenn Du fertig bist, dann entsorgst Du den wieder.

Albert

kls · 12. Dezember 2015

Du hast Recht, die Zeilen mit "ike", "esp" und "agressive" brauche ich anscheinend doch, denn sonst gibt es Probleme beim "rekey". Ist mir auch erst aufgefallen, als die Verbindung nach etwa einer Stunde nicht mehr ging. Mit den Zeilen läuft sie jetzt dauerhaft stabil.

Ich habe mal versuchsweise auf modp3072 umgestellt (sowohl auf racoon als auch auf cougar), aber damit kam der Tunnel nicht zustande. Muß ich da außer modp2048 zu modp3072 zu ändern noch etwas machen?

Klaus

[Suche] Empfehlung für Router mit Kabel Deutschland unter openWRT

Jetzt mitmachen!

Teilen