{"action":"created","issue":{"url":"https://api.github.com/repos/xelerance/Openswan/issues/116","labels_url":"https://api.github.com/repos/xelerance/Openswan/issues/116/labels{/name}","comments_url":"https://api.github.com/repos/xelerance/Openswan/issues/116/comments","events_url":"https://api.github.com/repos/xelerance/Openswan/issues/116/events","html_url":"https://github.com/xelerance/Openswan/issues/116","id":59829593,"number":116,"title":"Openswan behind NAT problem (only after 2.6.37)","user":{"login":"djgreg13","id":3840229,"avatar_url":"https://avatars.githubusercontent.com/u/3840229?v=3","gravatar_id":"","url":"https://api.github.com/users/djgreg13","html_url":"https://github.com/djgreg13","followers_url":"https://api.github.com/users/djgreg13/followers","following_url":"https://api.github.com/users/djgreg13/following{/other_user}","gists_url":"https://api.github.com/users/djgreg13/gists{/gist_id}","starred_url":"https://api.github.com/users/djgreg13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djgreg13/subscriptions","organizations_url":"https://api.github.com/users/djgreg13/orgs","repos_url":"https://api.github.com/users/djgreg13/repos","events_url":"https://api.github.com/users/djgreg13/events{/privacy}","received_events_url":"https://api.github.com/users/djgreg13/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-03-04T17:14:45Z","updated_at":"2015-03-04T20:33:57Z","closed_at":null,"body":"Hello, i have multiple NAT for attack my openswan server :+1: \r\n10.0.1.201(my server) <> WAN Adress 1 <------> WAN Client1 <> Client1( 192.168.1.10)\r\n\r\nOpenswan crash after upgrade to 2.6.38 or later, downgrade to 2.6.37 resolve problem\r\n\r\nOn OpenSwan 2.6.37 : \r\n```\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [RFC 3947] method set to=109 \r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike] method set to=110 \r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring unknown Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring unknown Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring unknown Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring unknown Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring unknown Vendor ID payload [9909b64eed937c6573de52ace952fa6b]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 110\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 110\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 110\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: ignoring Vendor ID payload [FRAGMENTATION 80000000]\r\nMar  4 17:38:09 DHCP pluto[1528]: packet from 109.221.173.1:500: received Vendor ID payload [Dead Peer Detection]\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: responding to Main Mode from unknown peer 109.221.173.1\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: STATE_MAIN_R1: sent MR1, expecting MI2\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): both are NATed\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: STATE_MAIN_R2: sent MR2, expecting MI3\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: Main mode peer ID is ID_IPV4_ADDR: '192.168.1.18'\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[1] 109.221.173.1 #1: switched from \"L2TP-PSK-NAT\" to \"L2TP-PSK-NAT\"\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: deleting connection \"L2TP-PSK-NAT\" instance with peer 109.221.173.1 {isakmp=#0/ipsec=#0}\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: new NAT mapping for #1, was 109.221.173.1:500, now 109.221.173.1:4500\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}\r\nMar  4 17:38:09 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: Dead Peer Detection (RFC 3706): enabled\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: Applying workaround for Mac OS X NAT-OA bug, ignoring proposed subnet\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #1: the peer proposed: 62.210.127.211/32:17/1701 -> 109.221.173.1/32:17/0\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: responding to Quick Mode proposal {msgid:55d80291}\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2:     us: 10.0.1.201<10.0.1.201>[+S=C]:17/1701---10.0.1.1\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2:   them: 109.221.173.1[192.168.1.18,+S=C]:17/58317\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: Dead Peer Detection (RFC 3706): enabled\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2\r\nMar  4 17:38:10 DHCP pluto[1528]: \"L2TP-PSK-NAT\"[2] 109.221.173.1 #2: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x0bc96274 <0x6ef7c556 xfrm=AES_256-HMAC_SHA1 NATOA=none NATD=109.221.173.1:4500 DPD=enabled}\r\n```\r\n\r\nOn OpenSwan 2.6.38 :\r\n```\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [RFC 3947] method set to=115 \r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike] meth=114, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-08] meth=113, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-07] meth=112, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-06] meth=111, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-05] meth=110, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-04] meth=109, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 115\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: ignoring Vendor ID payload [FRAGMENTATION 80000000]\r\nMar  4 17:34:17 DHCP pluto[1381]: packet from 109.221.173.1:500: received Vendor ID payload [Dead Peer Detection]\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: responding to Main Mode from unknown peer 109.221.173.1\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: STATE_MAIN_R1: sent MR1, expecting MI2\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): both are NATed\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: STATE_MAIN_R2: sent MR2, expecting MI3\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: Main mode peer ID is ID_IPV4_ADDR: '192.168.1.18'\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[3] 109.221.173.1 #3: switched from \"L2TP-PSK-NAT\" to \"L2TP-PSK-NAT\"\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: deleting connection \"L2TP-PSK-NAT\" instance with peer 109.221.173.1 {isakmp=#0/ipsec=#0}\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: new NAT mapping for #3, was 109.221.173.1:500, now 109.221.173.1:4500\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}\r\nMar  4 17:34:17 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: Dead Peer Detection (RFC 3706): enabled\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: the peer proposed: 62.210.127.211/32:17/1701 -> 192.168.1.18/32:17/0\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: NAT-Traversal: received 2 NAT-OA. using first, ignoring others\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: responding to Quick Mode proposal {msgid:da98c9fd}\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4:     us: 10.0.1.201<10.0.1.201>:17/1701---10.0.1.1\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4:   them: 109.221.173.1[192.168.1.18]:17/58376===192.168.1.18/32\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: Dead Peer Detection (RFC 3706): enabled\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2\r\nMar  4 17:34:18 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #4: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x0fb072ef <0xc19dc813 xfrm=AES_256-HMAC_SHA1 NATOA=192.168.1.18 NATD=109.221.173.1:4500 DPD=enabled}\r\nMar  4 17:34:38 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: received Delete SA(0x0fb072ef) payload: deleting IPSEC State #4\r\nMar  4 17:34:38 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: ERROR: netlink XFRM_MSG_DELPOLICY response for flow eroute_connection delete included errno 2: No such file or directory\r\nMar  4 17:34:38 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: received and ignored informational message\r\nMar  4 17:34:38 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1 #3: received Delete SA payload: deleting ISAKMP State #3\r\nMar  4 17:34:38 DHCP pluto[1381]: \"L2TP-PSK-NAT\"[4] 109.221.173.1: deleting connection \"L2TP-PSK-NAT\" instance with peer 109.221.173.1 {isakmp=#0/ipsec=#0}\r\nMar  4 17:34:38 DHCP pluto[1381]: packet from 109.221.173.1:4500: received and ignored informational message\r\n```"},"comment":{"url":"https://api.github.com/repos/xelerance/Openswan/issues/comments/77241180","html_url":"https://github.com/xelerance/Openswan/issues/116#issuecomment-77241180","issue_url":"https://api.github.com/repos/xelerance/Openswan/issues/116","id":77241180,"user":{"login":"simondeziel","id":545509,"avatar_url":"https://avatars.githubusercontent.com/u/545509?v=3","gravatar_id":"","url":"https://api.github.com/users/simondeziel","html_url":"https://github.com/simondeziel","followers_url":"https://api.github.com/users/simondeziel/followers","following_url":"https://api.github.com/users/simondeziel/following{/other_user}","gists_url":"https://api.github.com/users/simondeziel/gists{/gist_id}","starred_url":"https://api.github.com/users/simondeziel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simondeziel/subscriptions","organizations_url":"https://api.github.com/users/simondeziel/orgs","repos_url":"https://api.github.com/users/simondeziel/repos","events_url":"https://api.github.com/users/simondeziel/events{/privacy}","received_events_url":"https://api.github.com/users/simondeziel/received_events","type":"User","site_admin":false},"created_at":"2015-03-04T20:33:57Z","updated_at":"2015-03-04T20:33:57Z","body":"I assumed you were referring to that commit but since it's not part of 2.6.38 I started looking elsewhere.\r\n\r\nThe timing between the established IPsec SA (17:34:18) and the delete message (17:34:38) could indicate the the L2TP client was unhappy and hung up."}}