Debian+ipsec-tools+racoon и маршрутизация

ping -I 10.0.0.17 2.3.4.5

Dec 21 23:43:02 boboshko racoon: INFO: initiate new phase 2 negotiation: 3.4.5.6[500]<=>1.2.3.4[500]
Dec 21 23:43:02 boboshko racoon: WARNING: attribute has been modified.
Dec 21 23:43:02 boboshko racoon: INFO: IPsec-SA established: ESP/Tunnel 3.4.5.6[500]->1.2.3.4[500] spi=18114199(0x1146697)
Dec 21 23:43:02 boboshko racoon: INFO: IPsec-SA established: ESP/Tunnel 3.4.5.6[500]->1.2.3.4[500] spi=790790926(0x2f22830e)

#!/bin/sh

### BEGIN INIT INFO
# Provides:          zfw
# Required-Start:    $syslog $local_fs $network
# Required-Stop:     $syslog $local_fs $network
# Should-Start:      $remote_fs $named
# Should-Stop:       $remote_fs $named
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Firewall rules
# Description:       Firewall rules
# 
#
### END INIT INFO

. /etc/network/common

modprobe ip_nat_ftp
modprobe ip_conntrack_ftp
modprobe ip_conntrack
modprobe iptable_nat
modprobe ip_nat_sip
modprobe ip_conntrack_sip

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

iptables -P INPUT DROP
iptables -P FORWARD DROP

/etc/init.d/tshaper stop
/etc/init.d/tshaper start

iptables -t mangle -A FORWARD -o $PPP -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

#open ports
iptables -A INPUT -i $INT -j ACCEPT
iptables -A INPUT -i ipsec0 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i $PPP -o $INT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INT -o $PPP -j ACCEPT

iptables -A FORWARD -i $EXT -o $INT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INT -o $EXT -j ACCEPT

iptables -A INPUT -i $TUN -j ACCEPT
iptables -A FORWARD -o $TUN -j ACCEPT

iptables -A FORWARD -o kvnet -j ACCEPT

iptables -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p tcp -m multiport --dport 20,21,22,53,80,5200,6666,6900,9091 -j ACCEPT
iptables -A INPUT -p udp -m multiport --dport 53,500,4500,5200 -j ACCEPT
iptables -A INPUT -p esp -j ACCEPT
iptables -A INPUT -p ah -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -m tcp -i $PPP --dport 6900 -j DNAT --to-destination 192.168.1.71:3389
iptables -t nat -A PREROUTING -p tcp -m tcp -i $EXT --dport 6900 -j DNAT --to-destination 192.168.1.71:3389
iptables -A FORWARD  -d 192.168.1.71/32 -p tcp -m tcp --dport 3389 -j ACCEPT

iptables -t nat -A POSTROUTING -o $PPP -p esp -j ACCEPT
iptables -t nat -A POSTROUTING -o $EXT -p esp -j ACCEPT
iptables -t nat -A POSTROUTING -o $PPP -p ah -j ACCEPT
iptables -t nat -A POSTROUTING -o $EXT -p ah -j ACCEPT

iptables -t nat -A POSTROUTING ! -s $IP1 -o $PPP -j SNAT --to-source $IP1
iptables -t nat -A POSTROUTING ! -s $IP2 -o $EXT -j SNAT --to-source $IP2

iptables -t nat -A POSTROUTING -d 192.168.0.0/24 -o kvnet -j MASQUERADE
iptables -t nat -A POSTROUTING ! -s 192.168.10.1 -o $TUN -j SNAT --to-source 192.168.10.1

iptables -t mangle -N outmark
iptables -t mangle -F outmark

iptables -t mangle -N mymark
iptables -t mangle -F mymark

iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -m mark --mark 0 -j mymark
iptables -t mangle -A PREROUTING -m mark --mark 0 -m state --state NEW,RELATED -j outmark
iptables -t mangle -A PREROUTING -j CONNMARK --save-mark

iptables -t mangle -A mymark -s 2.3.4.5/32 -j RETURN
iptables -t mangle -A mymark -d 2.3.4.5/32 -j RETURN
iptables -t mangle -A mymark -i $PPP -j MARK --set-mark 15
iptables -t mangle -A mymark -i $EXT -j MARK --set-mark 25
#iptables -t mangle -A mymark -j CONNMARK --save-mark

iptables -t mangle -A outmark -i $TUN -j RETURN
iptables -t mangle -A outmark -o $TUN -j RETURN
iptables -t mangle -A outmark -o kvnet -j RETURN
iptables -t mangle -A outmark -i kvnet -j RETURN
iptables -t mangle -A outmark -d 192.168.1.0/24 -j RETURN
iptables -t mangle -A outmark -s 10.10.10.16/28 -j RETURN
iptables -t mangle -A outmark -d 2.3.4.5/32 -j RETURN
iptables -t mangle -A outmark -m connmark ! --mark 0 -j RETURN
iptables -t mangle -A outmark -m statistic --mode nth --every 2 --packet 0 -j MARK --set-mark 10
iptables -t mangle -A outmark -m statistic --mode nth --every 2 --packet 1 -j MARK --set-mark 20

# tcpdump -i ppp0 -vvv dst 2.3.4.5
tcpdump: listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
15:31:13.801886 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
3.4.5.6 > 2.3.4.5: ICMP echo request, id 14767, seq 47, length 64
15:31:14.802003 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)

Dec 22 16:00:51 boboshko racoon: INFO: ISAKMP-SA expired 3.4.5.6[500]-1.2.3.4[500] spi:6ec60c06a331294c:bbe2697de3c8ee43
Dec 22 16:00:51 boboshko racoon: INFO: ISAKMP-SA deleted 3.4.5.6[500]-1.2.3.4[500] spi:6ec60c06a331294c:bbe2697de3c8ee43
Dec 22 16:18:28 boboshko racoon: INFO: IPsec-SA expired: ESP/Tunnel 1.2.3.4[500]->3.4.5.6[500] spi=238955569(0xe3e2c31)
Dec 22 16:30:28 boboshko racoon: INFO: IPsec-SA expired: ESP/Tunnel 1.2.3.4[500]->3.4.5.6[500] spi=238955569(0xe3e2c31)

3.4.5.6 1.2.3.4
        esp mode=tunnel spi=3542811989(0xd32b0555) reqid=0(0x00000000)
        E: aes-cbc  19e8f1e8 6f91d280 7fab1ddd bc706897 24c281b1 57833ce1 4ef0110e 614c51a3
        A: hmac-sha1  e22619f2 d80060a1 6f9304ef 6a997b46 7e6684e9
        seq=0x00000000 replay=4 flags=0x00000000 state=mature
        created: Dec 22 23:22:33 2011   current: Dec 22 23:22:43 2011
        diff: 10(s)     hard: 3600(s)   soft: 2880(s)
        last:                           hard: 0(s)      soft: 0(s)
        current: 0(bytes)       hard: 0(bytes)  soft: 0(bytes)
        allocated: 0    hard: 0 soft: 0
        sadb_seq=1 pid=4061 refcnt=0
1.2.3.4 3.4.5.6
        esp mode=tunnel spi=29157101(0x01bce6ed) reqid=0(0x00000000)
        E: aes-cbc  0d7fd96f a9e0dc15 f5f8775c 9154bc74 9e2243eb 4c104d3f 24dba176 6a1792e2
        A: hmac-sha1  bc5f0c58 f23c626c 1d5e2280 49164cae eece620a
        seq=0x00000000 replay=4 flags=0x00000000 state=mature
        created: Dec 22 23:22:33 2011   current: Dec 22 23:22:43 2011
        diff: 10(s)     hard: 3600(s)   soft: 2880(s)
        last:                           hard: 0(s)      soft: 0(s)
        current: 0(bytes)       hard: 0(bytes)  soft: 0(bytes)
        allocated: 0    hard: 0 soft: 0
        sadb_seq=0 pid=4061 refcnt=0


2.3.4.5[any] 10.10.10.16/28[any] 255
        fwd prio def ipsec
        esp/tunnel/1.2.3.4-3.4.5.6/require
        created: Dec 22 23:19:35 2011  lastused:
        lifetime: 0(s) validtime: 0(s)
        spid=18 seq=57 pid=4088
        refcnt=1
2.3.4.5[any] 10.10.10.16/28[any] 255
        in prio def ipsec
        esp/tunnel/1.2.3.4-3.4.5.6/require
        created: Dec 22 23:19:35 2011  lastused:
        lifetime: 0(s) validtime: 0(s)
        spid=8 seq=58 pid=4088
        refcnt=1
10.10.10.16/28[any] 2.3.4.5[any] 255
        out prio def ipsec
        esp/tunnel/3.4.5.6-1.2.3.4/require
        created: Dec 22 23:19:35 2011  lastused: Dec 22 23:22:40 2011
        lifetime: 0(s) validtime: 0(s)
        spid=1 seq=0 pid=4088
        refcnt=3

IKEv1 SAs:

   Active SA: 2
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 2

1   IKE Peer: 3.4.5.6
    Type    : L2L             Role    : responder
    Rekey   : no              State   : AM_ACTIVE
2   IKE Peer: 3.4.5.6
    Type    : L2L             Role    : responder
    Rekey   : no              State   : MM_ACTIVE

There are no IKEv2 SAs

a975-vpn4# sh crypto ipsec sa
interface: Outside
    Crypto map tag: VPN, seq num: 7, local addr: 1.2.3.4

      access-list 123telecom_crypto extended permit ip host 2.3.4.5 10.10.10.16 255.255.255.240
      local ident (addr/mask/prot/port): (2.3.4.5/255.255.255.255/0/0)
      remote ident (addr/mask/prot/port): (10.10.10.16/255.255.255.240/0/0)
      current_peer: 3.4.5.6

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 1.2.3.4/0, remote crypto endpt.: 3.4.5.6/0
      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: 0BDCDA98
      current inbound spi : E6A04693

    inbound esp sas:
      spi: 0xE6A04693 (3869263507)
         transform: esp-aes-256 esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 1044480, crypto-map: VPN
         sa timing: remaining key lifetime (sec): 3561
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x0BDCDA98 (199023256)
         transform: esp-aes-256 esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 1044480, crypto-map: VPN
         sa timing: remaining key lifetime (sec): 3561
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

isakmp_natt xx.xx.xx.xx [4500];

nat_traversal on;

# define all necessary variables
LocalLAN[1]='192.168.0.0/24'    # the LAN segment we're prepared to open
PublicIP[1]='212.238.151.172'   # Our own external IP for this connection
RemoteLAN[1]='192.168.1.0/24'   # the remote LAN segment we wanna reach
RemoteIP[1]='82.161.20.13'      # the public IP of the remote gateway

# open IKE port between us and them, in and out
iptables -A INPUT -p udp -s ${RemoteIP[1]} --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -p udp -d ${RemoteIP[1]} --sport 500 --dport 500 -j ACCEPT

# Pass network traffic through the NAT tables
>iptables -t nat -A PREROUTING -s ${RemoteLAN[1]} -d ${LocalLAN[1]} -j ACCEPT
>iptables -t nat -A POSTROUTING -s ${LocalLAN[1]} -d ${RemoteLAN[1]} -j ACCEPT

# Pass network traffic over the tunnel through the filter tables
iptables -A FORWARD -s ${RemoteLAN[1]} -d ${LocalLAN[1]} -j ACCEPT
iptables -A FORWARD -s ${LocalLAN[1]} -d ${RemoteLAN[1]} -j ACCEPT