在Ubuntu < – > CISCO路由器上使用OpenSwan的IPSEC隧道

我已经在UBUNTU SERVER linux盒子和CISCO ROUTER之间build立了一个隧道。

这是什么拓扑看起来像：

host 1 ------ UBUNTU SERVER IPSEC <---> CISCO ROUTER ------ host 2 | | | | | | | | 192.168.64.0/24 1.2.3.4 4.3.2.1 10.10.20.0/24 

这是我的问题：隧道安装并正确运行 。 我完全可以从CISCO ROUTER ping到192.168.64.0/24networking上的任何主机。 但是我无法从192.168.64.0/24networkingping到10.10.20.0/24networking上的任何主机。

这里有一些信息：

• 以编程方式与pipe理交换机（Cisco 3750）连接？
• 我的超额订阅是为我的networking？
• 思科MOTD从外部来源
• RIP v2概要
• 如何在Cisco交换机上允许IGMP通信？

ipsec.conf文件：

 conn my_vpn auto=start authby=secret ike=aes256-md5 phase2=esp phase2alg=aes256-md5 type=tunnel left=1.2.3.4 leftsubnet=192.168.64.0/24 leftnexthop=%defaultroute leftupdown="ipsec _updown --route yes" keyingtries=3 keyexchange=ike pfs=no right=4.3.2.1 rightsubnet=10.10.20.0/24 

ipsec look命令输出：

 XFRM state: src 4.3.2.1 dst 1.2.3.4 proto esp spi 0x0f9898dd reqid 16385 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(md5) 0xSOMEVALUE enc cbc(aes) 0xSOMEOHTERVALUE src 1.2.3.4 dst 4.3.2.1 proto esp spi 0x667b62d8 reqid 16385 mode tunnel replay-window 32 flag af-unspec auth-trunc hmac(md5) 0xSOMEVALUE enc cbc(aes) 0xSOMEOHTERVALUE XFRM policy: src 192.168.64.0/24 dst 10.10.20.0/24 dir out priority 2344 tmpl src 1.2.3.4 dst 4.3.2.1 proto esp reqid 16385 mode tunnel src 10.10.20.0/24 dst 192.168.64.0/24 dir fwd priority 2344 tmpl src 4.3.2.1 dst 1.2.3.4 proto esp reqid 16385 mode tunnel src 10.10.20.0/24 dst 192.168.64.0/24 dir in priority 2344 tmpl src 4.3.2.1 dst 1.2.3.4 proto esp reqid 16385 mode tunnel src ::/0 dst ::/0 socket out priority 0 src ::/0 dst ::/0 socket in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket in priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket out priority 0 src 0.0.0.0/0 dst 0.0.0.0/0 socket in priority 0 XFRM done IPSEC mangle TABLES iptables: No chain/target/match by that name. ip6tables: No chain/target/match by that name. NEW_IPSEC_CONN mangle TABLES iptables: No chain/target/match by that name. ip6tables: No chain/target/match by that name. ROUTING TABLES default dev ppp0 scope link 10.10.20.0/24 via 1.2.3.GW dev ppp0 1.2.3.GW dev ppp0 proto kernel scope link src 1.2.3.4 

1.2.3.GW是1.2.3.4的网关。

ipsec verify命令输出：

 Checking your system to see if IPsec got installed and started correctly: Version check and ipsec on-path [OK] Linux Openswan U2.6.37/K3.2.0-38-generic-pae (netkey) Checking for IPsec support in kernel [OK] SAref kernel support [N/A] NETKEY: Testing XFRM related proc values [OK] [OK] [OK] Checking that pluto is running [OK] Pluto listening for IKE on udp 500 [OK] Pluto listening for NAT-T on udp 4500 [FAILED] Two or more interfaces found, checking IP forwarding [FAILED] Checking NAT and MASQUERADEing [OK] Checking for 'ip' command [OK] Checking /bin/sh is not /bin/dash [WARNING] Checking for 'iptables' command [OK] Opportunistic Encryption Support [DISABLED] 

我必须补充：UBUNTU有一个ppp0连接，它的公有IP地址是1.2.3.4 。

静态路由信息：

 Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 ppp0 10.10.20.0 1.2.3.GW 255.255.255.0 UG 0 0 0 ppp0 

有任何想法吗？

 iptables -A POSTROUTING -o eth1 -j MASQUERADE 

 iptables -I POSTROUTING 1 -d 10.10.20.0/24 -o eth1 -j ACCEPT 

 Chain PREROUTING (policy ACCEPT 8875K packets, 566M bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 4898K packets, 325M bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 1089K packets, 82M bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 1412 packets, 119K bytes) pkts bytes target prot opt in out source destination 4 336 ACCEPT all -- * eth1 0.0.0.0/0 10.10.20.0/24 101M 6481M MASQUERADE all -- * eth1 0.0.0.0/0 0.0.0.0/0