Openswan's ipsec verify fails on “Two or more interfaces found, checking IP forwarding”
I'm trying to set an L2TP/IPsec VPN. I have installed openswan from the repository on Ubuntu 13.04
Section: universe/net
Architecture: amd64
Version: 1:2.6.38-1
and configured it following the community docs.
# cat /etc/ipsec.conf
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.23.0/24
oe=off
protostack=netkey
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
# Apple iOS doesn't send delete notify so we need dead peer detection
# to detect vanishing clients
dpddelay=30
dpdtimeout=120
dpdaction=clear
# Set ikelifetime and keylife to same defaults windows has
ikelifetime=8h
keylife=1h
type=transport
# Replace IP address with your local IP (private, behind NAT IP is okay as well)
left=my.ip
# For updated Windows 2000/XP clients,
# to support old clients as well, use leftprotoport=17/%any
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
#force all to be nat'ed. because of iOS
forceencaps=yes
It starts fine but fails the verification
# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.38/K3.8.0-29-generic (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing XFRM related proc values [OK]
[OK]
[OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding [FAILED]
Checking NAT and MASQUERADEing [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
even though forwarding seems to be enabled
# cat /proc/sys/net/ipv4/ip_forward
1
What's wrong and how do I fix it?
networking vpn ipsec openswan
bumped to the homepage by Community♦ 2 days ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
I'm trying to set an L2TP/IPsec VPN. I have installed openswan from the repository on Ubuntu 13.04
Section: universe/net
Architecture: amd64
Version: 1:2.6.38-1
and configured it following the community docs.
# cat /etc/ipsec.conf
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.23.0/24
oe=off
protostack=netkey
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
# Apple iOS doesn't send delete notify so we need dead peer detection
# to detect vanishing clients
dpddelay=30
dpdtimeout=120
dpdaction=clear
# Set ikelifetime and keylife to same defaults windows has
ikelifetime=8h
keylife=1h
type=transport
# Replace IP address with your local IP (private, behind NAT IP is okay as well)
left=my.ip
# For updated Windows 2000/XP clients,
# to support old clients as well, use leftprotoport=17/%any
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
#force all to be nat'ed. because of iOS
forceencaps=yes
It starts fine but fails the verification
# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.38/K3.8.0-29-generic (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing XFRM related proc values [OK]
[OK]
[OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding [FAILED]
Checking NAT and MASQUERADEing [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
even though forwarding seems to be enabled
# cat /proc/sys/net/ipv4/ip_forward
1
What's wrong and how do I fix it?
networking vpn ipsec openswan
bumped to the homepage by Community♦ 2 days ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
Did you ever fix this?
– Will Gunn
Oct 4 '14 at 17:42
@WillGunn No. I ditched IPsec in favour of OpenVPN. OpenVPN is supported well through VPN API starting with Android 4.something. I remember that IPsec kinda worked on 12.04 though.
– Damn Terminal
Nov 6 '14 at 13:48
add a comment |
I'm trying to set an L2TP/IPsec VPN. I have installed openswan from the repository on Ubuntu 13.04
Section: universe/net
Architecture: amd64
Version: 1:2.6.38-1
and configured it following the community docs.
# cat /etc/ipsec.conf
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.23.0/24
oe=off
protostack=netkey
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
# Apple iOS doesn't send delete notify so we need dead peer detection
# to detect vanishing clients
dpddelay=30
dpdtimeout=120
dpdaction=clear
# Set ikelifetime and keylife to same defaults windows has
ikelifetime=8h
keylife=1h
type=transport
# Replace IP address with your local IP (private, behind NAT IP is okay as well)
left=my.ip
# For updated Windows 2000/XP clients,
# to support old clients as well, use leftprotoport=17/%any
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
#force all to be nat'ed. because of iOS
forceencaps=yes
It starts fine but fails the verification
# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.38/K3.8.0-29-generic (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing XFRM related proc values [OK]
[OK]
[OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding [FAILED]
Checking NAT and MASQUERADEing [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
even though forwarding seems to be enabled
# cat /proc/sys/net/ipv4/ip_forward
1
What's wrong and how do I fix it?
networking vpn ipsec openswan
I'm trying to set an L2TP/IPsec VPN. I have installed openswan from the repository on Ubuntu 13.04
Section: universe/net
Architecture: amd64
Version: 1:2.6.38-1
and configured it following the community docs.
# cat /etc/ipsec.conf
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.23.0/24
oe=off
protostack=netkey
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
# Apple iOS doesn't send delete notify so we need dead peer detection
# to detect vanishing clients
dpddelay=30
dpdtimeout=120
dpdaction=clear
# Set ikelifetime and keylife to same defaults windows has
ikelifetime=8h
keylife=1h
type=transport
# Replace IP address with your local IP (private, behind NAT IP is okay as well)
left=my.ip
# For updated Windows 2000/XP clients,
# to support old clients as well, use leftprotoport=17/%any
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
#force all to be nat'ed. because of iOS
forceencaps=yes
It starts fine but fails the verification
# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.38/K3.8.0-29-generic (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing XFRM related proc values [OK]
[OK]
[OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [OK]
Two or more interfaces found, checking IP forwarding [FAILED]
Checking NAT and MASQUERADEing [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [OK]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
even though forwarding seems to be enabled
# cat /proc/sys/net/ipv4/ip_forward
1
What's wrong and how do I fix it?
networking vpn ipsec openswan
networking vpn ipsec openswan
asked Aug 25 '13 at 11:36
Damn TerminalDamn Terminal
92141530
92141530
bumped to the homepage by Community♦ 2 days ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 2 days ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
Did you ever fix this?
– Will Gunn
Oct 4 '14 at 17:42
@WillGunn No. I ditched IPsec in favour of OpenVPN. OpenVPN is supported well through VPN API starting with Android 4.something. I remember that IPsec kinda worked on 12.04 though.
– Damn Terminal
Nov 6 '14 at 13:48
add a comment |
Did you ever fix this?
– Will Gunn
Oct 4 '14 at 17:42
@WillGunn No. I ditched IPsec in favour of OpenVPN. OpenVPN is supported well through VPN API starting with Android 4.something. I remember that IPsec kinda worked on 12.04 though.
– Damn Terminal
Nov 6 '14 at 13:48
Did you ever fix this?
– Will Gunn
Oct 4 '14 at 17:42
Did you ever fix this?
– Will Gunn
Oct 4 '14 at 17:42
@WillGunn No. I ditched IPsec in favour of OpenVPN. OpenVPN is supported well through VPN API starting with Android 4.something. I remember that IPsec kinda worked on 12.04 though.
– Damn Terminal
Nov 6 '14 at 13:48
@WillGunn No. I ditched IPsec in favour of OpenVPN. OpenVPN is supported well through VPN API starting with Android 4.something. I remember that IPsec kinda worked on 12.04 though.
– Damn Terminal
Nov 6 '14 at 13:48
add a comment |
1 Answer
1
active
oldest
votes
Stumbled over this while looking up the error :
I think this is the answer :
https://lists.openswan.org/pipermail/users/2009-September/017423.html
I have just upgraded to 2.6.23 and run ipsec verify and I get an
unexpected error:
Two or more interfaces found, checking IP forwarding [FAILED]
cat /proc/sys/net/ipv4/ip_forward gives 1 so I am confused.
If it helps eth0 is my WAN, eth1 is my normal LAN, eth1:0 is a virtual
IP on eth1 to get round a problem I have been having with running
Openswan on a combined gateway/file server, and eth2 is a second, unused
LAN adaptor.
Then you can ignore it. It's a warning when running a subnet-subnet or
subnet-host tunnel on the subnet side, where you need forwarding to go
from the public side (internet) to the lan.
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f337036%2fopenswans-ipsec-verify-fails-on-two-or-more-interfaces-found-checking-ip-forw%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Stumbled over this while looking up the error :
I think this is the answer :
https://lists.openswan.org/pipermail/users/2009-September/017423.html
I have just upgraded to 2.6.23 and run ipsec verify and I get an
unexpected error:
Two or more interfaces found, checking IP forwarding [FAILED]
cat /proc/sys/net/ipv4/ip_forward gives 1 so I am confused.
If it helps eth0 is my WAN, eth1 is my normal LAN, eth1:0 is a virtual
IP on eth1 to get round a problem I have been having with running
Openswan on a combined gateway/file server, and eth2 is a second, unused
LAN adaptor.
Then you can ignore it. It's a warning when running a subnet-subnet or
subnet-host tunnel on the subnet side, where you need forwarding to go
from the public side (internet) to the lan.
add a comment |
Stumbled over this while looking up the error :
I think this is the answer :
https://lists.openswan.org/pipermail/users/2009-September/017423.html
I have just upgraded to 2.6.23 and run ipsec verify and I get an
unexpected error:
Two or more interfaces found, checking IP forwarding [FAILED]
cat /proc/sys/net/ipv4/ip_forward gives 1 so I am confused.
If it helps eth0 is my WAN, eth1 is my normal LAN, eth1:0 is a virtual
IP on eth1 to get round a problem I have been having with running
Openswan on a combined gateway/file server, and eth2 is a second, unused
LAN adaptor.
Then you can ignore it. It's a warning when running a subnet-subnet or
subnet-host tunnel on the subnet side, where you need forwarding to go
from the public side (internet) to the lan.
add a comment |
Stumbled over this while looking up the error :
I think this is the answer :
https://lists.openswan.org/pipermail/users/2009-September/017423.html
I have just upgraded to 2.6.23 and run ipsec verify and I get an
unexpected error:
Two or more interfaces found, checking IP forwarding [FAILED]
cat /proc/sys/net/ipv4/ip_forward gives 1 so I am confused.
If it helps eth0 is my WAN, eth1 is my normal LAN, eth1:0 is a virtual
IP on eth1 to get round a problem I have been having with running
Openswan on a combined gateway/file server, and eth2 is a second, unused
LAN adaptor.
Then you can ignore it. It's a warning when running a subnet-subnet or
subnet-host tunnel on the subnet side, where you need forwarding to go
from the public side (internet) to the lan.
Stumbled over this while looking up the error :
I think this is the answer :
https://lists.openswan.org/pipermail/users/2009-September/017423.html
I have just upgraded to 2.6.23 and run ipsec verify and I get an
unexpected error:
Two or more interfaces found, checking IP forwarding [FAILED]
cat /proc/sys/net/ipv4/ip_forward gives 1 so I am confused.
If it helps eth0 is my WAN, eth1 is my normal LAN, eth1:0 is a virtual
IP on eth1 to get round a problem I have been having with running
Openswan on a combined gateway/file server, and eth2 is a second, unused
LAN adaptor.
Then you can ignore it. It's a warning when running a subnet-subnet or
subnet-host tunnel on the subnet side, where you need forwarding to go
from the public side (internet) to the lan.
answered Nov 4 '14 at 13:31
John CrispJohn Crisp
1
1
add a comment |
add a comment |
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f337036%2fopenswans-ipsec-verify-fails-on-two-or-more-interfaces-found-checking-ip-forw%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Did you ever fix this?
– Will Gunn
Oct 4 '14 at 17:42
@WillGunn No. I ditched IPsec in favour of OpenVPN. OpenVPN is supported well through VPN API starting with Android 4.something. I remember that IPsec kinda worked on 12.04 though.
– Damn Terminal
Nov 6 '14 at 13:48