Question

Hi,

We have a sophos firewall with a lot of IPSec-Tunnels. There some working tunnel with RUT 230. One RUT 230 Tunnel is up, but the Traffic nor a ping does not go through. The configuration is always the same. The only difference ist that the tunnel with the problem has no Windows client in LAN. I also cannot reach the RUT web interface on this router. Do I need to define some routes when I don't use a Windows Client behind the RUT?

Non Windows client <-> RUT 230 <-> IPSEC-Tunnel <-> Sophos <-> Home-Network

Regards

Answer 1

Hi,

What exactly no windows client we're talking about?

What I would suggest is looking if your router is on the latest firmware release. After that please check this wiki post to check if everything that you already configured is right.

https://wiki.teltonika-networks.com/view/IPsec_configuration_examples

Also, you could run a ping and traceroute to see where your ping stops and then check that exact stopped address firewall rules.

If the firewall is okay, maybe indeed there's a route missing.

EB.

Comments

Hi,

the router has 1.13.3. I will be carefully because of my other problem with 1.14.

The Ping and Traceroute to adresses in the internet ist possible. To the internal adress I got no hops. I think it is because of the tunnel. Also in tunnel who are working I only see one hop to the firewall. Maybe it is a routing problem in the RUT 230? Normally I don´t need to define routes for the IPSec in the RUT 230. What route definitions can I test in the RUT 230?

Regards.

---

If the hop stops on the firewall, then it must be Sophos that isn't routed well.

You must create a route from Sophos to the other site in this case.

EB.

---

Thank you for your message. I cannot find the failure. The non windows client is a simple ethernet to serial converter with static IP. But I cannot reach the web UI form the RUT, and I think this must be the first step.

Here the routing information:

The Sophos route:

	TestTun [1 of 1 IPsec SAs established]

SA: 192.168.xxx.0/24=81... 217...=192.168.xxx.8/29

VPN ID: 81...

IKE: Auth PSK / Enc AES_CBC_256 / Hash HMAC_MD5 / Lifetime 7800s / PFS MODP_1024 / DPD

ESP: Enc AES_CBC_256 / Hash HMAC_MD5 / Lifetime 3600s

 Tracerout from sopohos to RUT

traceroute to 192.168.xxx.8 (192.168.xxx.8), 30 hops max, 40 byte packets using UDP

 1  * * *

 2  * * *

 3  * * *

 4  * * *

 5  * * *

 6  * * *

Traceroute from RUT to sophos:

traceroute to 192.168.xxx.253 (192.168.xxx.253), 30 hops max, 38 byte packets 1 * 2 * 3 * 4 * 5 * 6 * 7 * 8 * 9 * 10 * 11 * 12 * 13 * 14 * 15 * 16 * 17 * 18 * 19 * 20 * 21 * 22 * 23 * 24 * 25 * 26 * 27 * 28 * 29 * 30 *



IPSec statusall on RUT:

Status of IKE charon daemon (strongSwan 5.6.2, Linux 3.18.44, mips):

uptime: 5 days, since May 05 12:01:53 2021

malloc: sbrk 139264, mmap 0, used 124032, free 15232

worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 7

loaded plugins: charon aes des sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs8 pgp pem gmp xcbc hmac kernel-netlink resolve socket-default stroke updown xauth-generic

Listening IP addresses:

172...

192.168.xxx.8

Connections:

EWBHKWTun: %any4...81... IKEv1, dpddelay=30s

EWBHKWTun: local: [any4] uses pre-shared key authentication

EWBHKWTun: remote: [81...] uses pre-shared key authentication

EWBHKWTun: child: 192.168.xxx.8/29 === 192.168.yyy.0/24 TUNNEL, dpdaction=restart

passthrough0: %any...%any IKEv1/2

passthrough0: local: uses public key authentication

passthrough0: remote: uses public key authentication

passthrough0: child: 192.168.190.8/29 === 192.168.190.8/29 PASS

Shunted Connections:

passthrough0: 192.168.190.8/29 === 192.168.190.8/29 PASS

Security Associations (1 up, 0 connecting):

EWBHKWTun[63]: ESTABLISHED 35 minutes ago, 172...[any4]...81...[81..]

Tun[63]: IKEv1 SPIs: 04590ee024f60745_i* 99f112cff56bea7e_r, pre-shared key reauthentication in 77 minutes

Tun[63]: IKE proposal: AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024

Tun{163}: INSTALLED, TUNNEL, reqid 4, ESP SPIs: c58dea30_i 2e4d2a5b_o

Tun{163}: AES_CBC_256/HMAC_MD5_96/MODP_1024, 0 bytes_i, 1140 bytes_o (30 pkts, 319s ago), rekeying in 10 minutes

Tun{163}: 192.168.xxx.8/29 === 192.168.yyy.0/24