[Suche] Empfehlung für Router mit Kabel Deutschland unter openWRT

kls

Danke. Sieht in meiner neuen Konfiguration genauso aus.
Bitte auch noch die Liste der Files in /etc/modules.d.

Klaus

kls

Ich habe jetzt mal von racoon her geschaut, was Sache ist, und da kann ich cougar ohne weiteres pingen! Und sobald so ein Ping stattgefunden hat, kann ich den Tunnel auch in umgekehrter Richtung von cougar nach racoon benutzen. Da fehlte anscheinend nur die "Initialzündung" (wie du in Post 235 schon vermutet hattest, aber in der anderen Richtung).

Somit ist also deine einfache Installationsanleitung verifiziert.
Nun wäre es nur noch schön, wenn ich ohne den "initialen Ping" auskommen könnte...

Klaus

kls

Jetzt habe ich, um ganz sicher zu sein, daß das Setup auch nach einem Reboot noch läuft, den Router neu gebootet, und siehe da, der Tunnel hat sofort funktioniert! Weiß der Geier, was da vorher schiefgelaufen ist. Auf jeden Fall läuft es jetzt mit dem minimalen Setup, wie du es beschrieben hast.

Danke und noch einen schönen Sonntag!

Klaus

ATD

Zitat von kls

Somit ist also deine einfache Installationsanleitung verifiziert.
Nun wäre es nur noch schön, wenn ich ohne den "initialen Ping" auskommen könnte...

Tja Klaus, schon klar.

Auch ich habe noch einmal meine Anleitung verifiziert. Festplatte aus der VM gelöscht und den Original Image neu eingebunden. Alles laut Anleitung aus der Post 194. Zusätzlich habe ich noch die luci-app-ddns installiert und arbeite jetzt mit echten DynDNS Einträgen an allen Seiten um weiter Fehler auszuschließen. Einen zweiten Standort habe ich noch hinzugefügt (zwei IPSec Tunnels). Alles funktioniert soweit. ABER:

Ich muss einen traceroute oder ping absetzen, bevor die Gegenseite auch pingen kann. Es genügt von einem PC in meinem Subnet den ping abzusetzen, es muss nicht unbedingt am Router erfolgen. Noch unerklärlicher ist es, dass nur die angesprochene Seite funktioniert. Das bedeutet, dass ich für jeden Tunnel einzeln agieren muss, erst danach ist alles OK.

Ich habe Vermutungen aufgestellt, woran es liegen könnte, aber ich kann momentan nur sagen, woran es nicht liegen kann.

- Die Gegenseite ist es nicht. Beide unterschiedliche Router arbeiten mit virtuellen Interfaces, kein FW. Beide bedienen über 20 IPSec Tunnels ohne Probleme.
- Der locale NAT ist es auch nicht, denn wenn da was fehlt, dann wäre es mit dem ersten ping in irgendeiner Richtung alles erledigt.
- Der Firewall/Forwarding kann es auch nicht sein, sie sind statisch und funktional.
- IPSec baut den Tunnel auf, also auch nicht schuldig.

Wie auch immer, mein Image ist BETA 2. Ich werde einfach abwarten, wie Deine Ergebnisse aussehen, denn momentan habe ich keinen Ansatz für das "Problem" nur Workaround. Also melde Dich, nachdem Du auch panther angebunden hast.

Albert

boc8222

I am a newbie to openwrt as well as strongswan. I had until I find your posts. Thanks. Every things work now except the hostname resolution. I can ping by hostname of remote site. Do you have any hints? Thanks again

boc8222

I can't ping by hostname of remote site PC and server. please advise any hints.

ATD

Zitat von boc8222

I can ping by hostname of remote site.

Zitat von boc8222

I can't ping by hostname of remote site PC and server.

I assume that your second statement is correct.

You have two options for a name resolution from the remote site.

1. If you have a few PCs without domain, than put each name and its IP address from the remote site into the OpenWRT local hosts file.

2. Exists both on local and remote site a real dns server with domains, than fill out the dnsmasq forward settings in LuCI.

Albert

ATD

Klaus, ein FW restart blockt bei mir den Datenfluss wieder. Das heißt, der FW ist das Problem und ich bin in der Bringschuld.

Albert

boc8222

Thanks

kls

Das mit dem ping ist auch nicht so schlimm. Ich lasse einfach auf dem Server per Cron jede Minute einen ping machen, der "öffnet" dann den Tunnel. Aber wenn du doch noch eine saubere Lösung findest, wäre das natürlich nicht schlecht ;-).

Zum Thema Tunnel zwischen cougar und panther: ich habe jetzt die /etc/ipsec.conf auf panther so geändert:

/etc/ipsec.conf

Code

# /etc/ipsec.conf - Openswan IPsec configuration file                                                                               

# This file:  /usr/share/doc/openswan/ipsec.conf-sample                                                                             
#                                                                                                                                   
# Manual:     ipsec.conf.5                                                                                                          


version 2.0     # conforms to second version of ipsec.conf specification                                                            

# basic configuration                                                                                                               
config setup                                                                                                                        
        # Do not set debug options to debug configuration issues!                                                                   
        # plutodebug / klipsdebug = "all", "none" or a combation from below:                                                        
        # "raw crypt parsing emitting control klips pfkey natt x509 dpd private"                                                    
        # eg:                                                                                                                       
        # plutodebug="control parsing"                                                                                              
        # Again: only enable plutodebug or klipsdebug when asked by a developer                                                     
        #                                                                                                                           
        # enable to get logs per-peer                                                                                               
        # plutoopts="--perpeerlog"                                                                                                  
        #                                                                                                                           
        # Enable core dumps (might require system changes, like ulimit -C)                                                          
        # This is required for abrtd to work properly                                                                               
        # Note: incorrect SElinux policies might prevent pluto writing the core                                                     
        dumpdir=/var/run/pluto/                                                                                                     
        #                                                                                                                           
        # NAT-TRAVERSAL support, see README.NAT-Traversal                                                                           
        nat_traversal=yes                                                                                                           
        # exclude networks used on server side by adding %v4:!a.b.c.0/24                                                            
        # It seems that T-Mobile in the US and Rogers/Fido in Canada are                                                            
        # using 25/8 as "private" address space on their 3G network.                                                                
        # This range has not been announced via BGP (at least upto 2010-12-21)                                                      
#       virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10               
        # OE is now off by default. Uncomment and change to on, to enable.                                                          
        oe=off                                                                                                                      
        # which IPsec stack to use. auto will try netkey, then klips then mast                                                      
        protostack=auto                                                                                                             
        # Use this to log to a file, or disable logging on embedded systems (like openwrt)                                          
        #plutostderrlog=/dev/null                                                                                                   

# Add connections here                                                                                                              

conn %default                                                                                                                       
        leftid=@panther.tvdr.de                                                                                                     
        left=%defaultroute                                                                                                          
        leftsubnet=192.168.100.0/24                                                                                                 
        #leftfirewall=no                                                                                                            
        authby=secret                                                                                                               
        auto=start                                                                                                                  

conn racoon                                                                                                                         
        rightid=@racoon.tvdr.de                                                                                                     
        right=88.198.76.220                                                                                                         

conn cougar                                                                                                                         
        rightid=@cougar.tvdr.de                                                                                                     
        right=%cougar.tvdr.de                                                                                                       
        rightsubnet=192.168.1.0/24

Alles anzeigen

"leftfirewall" kennt OpenSwan nicht, daher auskommentiert.
Der ipsec-Satus sieht damit so aus:

ipsec auto --status

Code

000 using kernel interface: klips
000 interface ipsec0/pppoe-wan 93.xx.xx.218
000 interface ipsec0/pppoe-wan 93.xx.xx.218
000 %myid = (none)
000 debug none
000 
000 virtual_private (%priv):
000 - allowed 0 subnets: 
000 - disallowed 0 subnets: 
000 WARNING: Either virtual_private= is not specified, or there is a syntax 
000          error in that line. 'left/rightsubnet=vhost:%priv' will not work!
000 WARNING: Disallowed subnets in virtual_private= is empty. If you have 
000          private address space in internal use, it should be excluded!
000 
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128, keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128
000 
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
000 
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} 
000 
000 "cougar": 192.168.100.0/24===93.xx.xx.218[@panther.tvdr.de,+S=C]...%any[@cougar.tvdr.de,+S=C]===192.168.1.0/24; prospective erouted; eroute owner: #0
000 "cougar":     myip=unset; hisip=unset;
000 "cougar":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "cougar":   policy: PSK+ENCRYPT+TUNNEL+PFS+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,24; interface: pppoe-wan; 
000 "cougar":   newest ISAKMP SA: #0; newest IPsec SA: #0; 
000 "racoon": 192.168.100.0/24===93.xx.xx.218[@panther.tvdr.de,+S=C]...88.198.76.220<88.198.76.220>[@racoon.tvdr.de,+S=C]; erouted; eroute owner: #2
000 "racoon":     myip=unset; hisip=unset;
000 "racoon":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "racoon":   policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,32; interface: pppoe-wan; 
000 "racoon":   newest ISAKMP SA: #1; newest IPsec SA: #2; 
000 "racoon":   IKE algorithm newest: AES_CBC_128-SHA1-MODP2048
000 
000 #2: "racoon":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27274s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate
000 #2: "racoon" used 112s ago; esp.c02349d5@88.198.76.220 esp.6581284e@93.xx.xx.218 tun.1001@88.198.76.220 tun.1002@93.xx.xx.218 ref=3 refhim=1
000 #1: "racoon":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2122s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000

Alles anzeigen

Der Tunner zwischen panther und racoon funktioniert damit nach wie vor einwandfrei, aber es kommt offensichtlich kein Tunnel zwischen cougar und panther zustande ("prospective erouted" statt "erouted").
Ich frage mich auch, woher panther wissen soll, daß er den Tunnel zu cougar "über racoon" leiten muß.

Klaus

ATD

Zitat von kls

Der Tunner zwischen panther und racoon funktioniert damit nach wie vor einwandfrei, aber es kommt offensichtlich kein Tunnel zwischen cougar und panther zustande ("prospective erouted" statt "erouted").

Versuch's mal in der ipsec.conf unter cougar (oder %default) flogendes:

Code

aggressive=yes
        ike=aes128-sha1-modp2048
        esp=aes128-sha1-modp2048

Zitat von kls

Ich frage mich auch, woher panther wissen soll, daß er den Tunnel zu cougar "über racoon" leiten muß.

Bei iptables wäre es ein Eintrag in der /etc/config/firewall -> option subnet '88.xxx.xx.220/32 192.168.1.0/24' bei der Zone vpn. Du hast aber ein virtuelles Interface, nicht wahr? Das ginge dann über die Routing Tabelle.

Albert

kls

Zitat von ATD
Versuch's mal in der ipsec.conf unter cougar (oder %default) flogendes:
Code
aggressive=yes
        ike=aes128-sha1-modp2048
        esp=aes128-sha1-modp2048

"aggressive" kennt OpenVpn nicht, und bei den anderen kommt im Log

Dec 14 16:09:14 panther authpriv.warn pluto[25778]: esp string error: Non initial digit found for auth keylen, just after "aes128-sha1-" (old_state=ST_AA_END)
Dec 14 16:09:14 panther daemon.err ipsec__plutorun: 034 esp string error: Non initial digit found for auth keylen, just after "aes128-sha1-" (old_state=ST_AA_END)

und die Verbindung wird gar nicht erst eingetragen.

Zitat

Du hast aber ein virtuelles Interface, nicht wahr? Das ginge dann über die Routing Tabelle.

Ja, es gibt auf panther ein "ipsec0".

Hier der Vollständigkeit halber das Log eines "ipsec restart" (ohne die drei o.g. Zeilen):

/etc/init.d/ipsec restart

Code

Dec 14 16:09:12 panther user.info kernel: klips_info:ipsec_init: KLIPS startup, Openswan KLIPS IPsec stack version: 2.6.37
Dec 14 16:09:12 panther user.info kernel: NET: Registered protocol family 15
Dec 14 16:09:12 panther user.warn kernel: registered KLIPS /proc/sys/net
Dec 14 16:09:12 panther user.info kernel: klips_info:ipsec_alg_init: KLIPS alg v=0.8.1-0 (EALG_MAX=255, AALG_MAX=251)
Dec 14 16:09:12 panther user.info kernel: klips_info:ipsec_alg_init: calling ipsec_alg_static_init()
Dec 14 16:09:12 panther user.warn kernel: ipsec_aes_init(alg_type=15 alg_id=12 name=aes): ret=0
Dec 14 16:09:12 panther user.warn kernel: ipsec_aes_init(alg_type=14 alg_id=9 name=aes_mac): ret=0
Dec 14 16:09:12 panther user.warn kernel: ipsec_3des_init(alg_type=15 alg_id=3 name=3des): ret=0
Dec 14 16:09:12 panther user.info kernel: KLIPS cryptoapi interface: alg_type=15 alg_id=12 name=cbc(aes) keyminbits=128 keymaxbits=256, found(0)
Dec 14 16:09:12 panther user.info kernel: KLIPS: lookup for ciphername=cbc(twofish): not found 
Dec 14 16:09:12 panther user.info kernel: KLIPS: lookup for ciphername=cbc(serpent): not found 
Dec 14 16:09:12 panther user.info kernel: KLIPS: lookup for ciphername=cbc(cast5): not found 
Dec 14 16:09:12 panther user.info kernel: KLIPS: lookup for ciphername=cbc(blowfish): not found 
Dec 14 16:09:12 panther user.info kernel: KLIPS: lookup for ciphername=cbc(des3_ede): not found 
Dec 14 16:09:12 panther daemon.err ipsec_setup: KLIPS debug `none'
Dec 14 16:09:13 panther daemon.err ipsec_setup: KLIPS ipsec0 on pppoe-wan 93.xx.xx.218/ pointtopoint 217.0.119.8/32 mtu 1492
Dec 14 16:09:13 panther authpriv.err ipsec__plutorun: Starting Pluto subsystem...
Dec 14 16:09:13 panther daemon.err ipsec_setup: ...Openswan IPsec started
Dec 14 16:09:13 panther daemon.err ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d
Dec 14 16:09:13 panther user.warn syslog: adjusting ipsec.d to /etc/ipsec.d
Dec 14 16:09:13 panther authpriv.warn pluto[25778]: LEAK_DETECTIVE support [disabled]
Dec 14 16:09:13 panther authpriv.warn pluto[25778]: OCF support for IKE [disabled]
Dec 14 16:09:13 panther authpriv.warn pluto[25778]: SAref support [disabled]: Protocol not available
Dec 14 16:09:13 panther authpriv.warn pluto[25778]: SAbind support [disabled]: Protocol not available
Dec 14 16:09:13 panther authpriv.warn pluto[25778]: NSS support [disabled]
Dec 14 16:09:13 panther authpriv.warn pluto[25778]: HAVE_STATSD notification support not compiled in
Dec 14 16:09:13 panther authpriv.warn pluto[25778]: Setting NAT-Traversal port-4500 floating to on
Dec 14 16:09:13 panther authpriv.warn pluto[25778]:    port floating activation criteria nat_t=1/port_float=1
Dec 14 16:09:13 panther authpriv.warn pluto[25778]:    NAT-Traversal support  [enabled]
Dec 14 16:09:13 panther authpriv.warn pluto[25778]: using /dev/urandom as source of random entropy
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: starting up 1 cryptographic helpers
Dec 14 16:09:14 panther authpriv.warn pluto[25787]: using /dev/urandom as source of random entropy
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: started helper pid=25787 (fd:6)
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: Kernel interface auto-pick
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: No Kernel NETKEY interface detected
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: Using KLIPS IPsec interface code on 2.6.32.27
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: Changed path to directory '/etc/ipsec.d/cacerts'
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: Changed path to directory '/etc/ipsec.d/aacerts'
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: Changed path to directory '/etc/ipsec.d/ocspcerts'
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: Changing to directory '/etc/ipsec.d/crls'
Dec 14 16:09:14 panther authpriv.warn pluto[25778]:   Warning: empty directory
Dec 14 16:09:14 panther daemon.err ipsec_setup: Starting Openswan IPsec 2.6.37...
Dec 14 16:09:14 panther daemon.err ipsec_setup: ipsec0 -> NULL mtu=0(0) -> 0
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: added connection description "racoon"
Dec 14 16:09:14 panther daemon.err ipsec__plutorun: 002 added connection description "racoon"
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: esp string error: Non initial digit found for auth keylen, just after "aes128-sha1-" (old_state=ST_AA_END)
Dec 14 16:09:14 panther daemon.err ipsec__plutorun: 034 esp string error: Non initial digit found for auth keylen, just after "aes128-sha1-" (old_state=ST_AA_END)
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: listening for IKE messages
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: adding interface ipsec0/pppoe-wan 93.xx.xx.218:500
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: adding interface ipsec0/pppoe-wan 93.xx.xx.218:4500
Dec 14 16:09:14 panther authpriv.warn pluto[25778]: loading secrets from "/etc/ipsec.secrets"
Dec 14 16:09:14 panther daemon.err ipsec__plutorun: 021 no connection named "cougar"
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: initiating Main Mode
Dec 14 16:09:15 panther daemon.err ipsec__plutorun: 104 "racoon" #1: STATE_MAIN_I1: initiate
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: received Vendor ID payload [XAUTH]
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: received Vendor ID payload [Dead Peer Detection]
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: received Vendor ID payload [RFC 3947] method set to=109 
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: enabling possible NAT-traversal with method 4
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: initiating all conns with alias='cougar' 
Dec 14 16:09:15 panther daemon.err ipsec__plutorun: 000 initiating all conns with alias='cougar' 
Dec 14 16:09:15 panther daemon.err ipsec__plutorun: 021 no connection named "cougar"
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: Main mode peer ID is ID_FQDN: '@racoon.tvdr.de'
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp2048}
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:635d94a8 proposal=defaults pfsgroup=OAKLEY_GROUP_MODP2048}
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
Dec 14 16:09:15 panther authpriv.warn pluto[25778]: "racoon" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xc551665e <0x842caaf6 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
Dec 14 16:14:13 panther authpriv.warn pluto[25778]: shutting down
Dec 14 16:14:13 panther authpriv.warn pluto[25778]: forgetting secrets                                                                                                                                                                                                                               
Dec 14 16:14:13 panther authpriv.warn pluto[25778]: "racoon": deleting connection                                                                                                                                                                                                                    
Dec 14 16:14:13 panther authpriv.warn pluto[25778]: "racoon" #2: deleting state (STATE_QUICK_I2)                                                                                                                                                                                                     
Dec 14 16:14:13 panther authpriv.warn pluto[25778]: "racoon" #1: deleting state (STATE_MAIN_I4)                                                                                                                                                                                                      
Dec 14 16:14:13 panther authpriv.warn pluto[25778]: shutting down interface ipsec0/pppoe-wan 93.xx.xx.218:4500                                                                                                                                                                                     
Dec 14 16:14:13 panther authpriv.warn pluto[25778]: shutting down interface ipsec0/pppoe-wan 93.xx.xx.218:500                                                                                                                                                                                      
Dec 14 16:14:13 panther authpriv.warn pluto[25787]: pluto_crypto_helper: helper (0) is  normal exiting                                                                                                                                                                                               
Dec 14 16:14:14 panther user.crit kernel: IPSEC EVENT: KLIPS device ipsec0 shut down.                                                                                                                                                                                                                
Dec 14 16:14:15 panther user.info kernel: klips_info:pfkey_cleanup: shutting down PF_KEY domain sockets.                                                                                                                                                                                             
Dec 14 16:14:15 panther user.info kernel: NET: Unregistered protocol family 15                                                                                                                                                                                                                       
Dec 14 16:14:15 panther daemon.err ipsec_setup: ...Openswan IPsec stopped                                                                                                                                                                                                                            
Dec 14 16:14:15 panther daemon.err ipsec_setup: Stopping Openswan IPsec...                                                                                                                                                                                                                           
Dec 14 16:14:16 panther daemon.err ipsec_setup: Using KLIPS/legacy stack                                                                                                                                                                                                                             
Dec 14 16:14:17 panther user.info kernel: klips_info:ipsec_init: KLIPS startup, Openswan KLIPS IPsec stack version: 2.6.37                                                                                                                                                                           
Dec 14 16:14:17 panther user.info kernel: NET: Registered protocol family 15                                                                                                                                                                                                                         
Dec 14 16:14:17 panther user.warn kernel: registered KLIPS /proc/sys/net                                                                                                                                                                                                                             
Dec 14 16:14:17 panther user.info kernel: klips_info:ipsec_alg_init: KLIPS alg v=0.8.1-0 (EALG_MAX=255, AALG_MAX=251)                                                                                                                                                                                
Dec 14 16:14:17 panther user.info kernel: klips_info:ipsec_alg_init: calling ipsec_alg_static_init()                                                                                                                                                                                                 
Dec 14 16:14:17 panther user.warn kernel: ipsec_aes_init(alg_type=15 alg_id=12 name=aes): ret=0                                                                                                                                                                                                      
Dec 14 16:14:17 panther user.warn kernel: ipsec_aes_init(alg_type=14 alg_id=9 name=aes_mac): ret=0                                                                                                                                                                                                   
Dec 14 16:14:17 panther user.warn kernel: ipsec_3des_init(alg_type=15 alg_id=3 name=3des): ret=0                                                                                                                                                                                                     
Dec 14 16:14:17 panther user.info kernel: KLIPS cryptoapi interface: alg_type=15 alg_id=12 name=cbc(aes) keyminbits=128 keymaxbits=256, found(0)                                                                                                                                                     
Dec 14 16:14:17 panther user.info kernel: KLIPS: lookup for ciphername=cbc(twofish): not found                                                                                                                                                                                                       
Dec 14 16:14:17 panther user.info kernel: KLIPS: lookup for ciphername=cbc(serpent): not found                                                                                                                                                                                                       
Dec 14 16:14:17 panther user.info kernel: KLIPS: lookup for ciphername=cbc(cast5): not found                                                                                                                                                                                                         
Dec 14 16:14:17 panther user.info kernel: KLIPS: lookup for ciphername=cbc(blowfish): not found                                                                                                                                                                                                      
Dec 14 16:14:17 panther user.info kernel: KLIPS: lookup for ciphername=cbc(des3_ede): not found                                                                                                                                                                                                      
Dec 14 16:14:17 panther daemon.err ipsec_setup: KLIPS debug `none'                                                                                                                                                                                                                                   
Dec 14 16:14:18 panther daemon.err ipsec_setup: KLIPS ipsec0 on pppoe-wan 93.xx.xx.218/ pointtopoint 217.0.119.8/32 mtu 1492                                                                                                                                                                       
Dec 14 16:14:18 panther authpriv.err ipsec__plutorun: Starting Pluto subsystem...                                                                                                                                                                                                                    
Dec 14 16:14:18 panther daemon.err ipsec_setup: ...Openswan IPsec started                                                                                                                                                                                                                            
Dec 14 16:14:18 panther daemon.err ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d                                                                                                                                                                                                                
Dec 14 16:14:18 panther user.warn syslog: adjusting ipsec.d to /etc/ipsec.d                                                                                                                                                                                                                          
Dec 14 16:14:18 panther authpriv.warn pluto[26137]: LEAK_DETECTIVE support [disabled]                                                                                                                                                                                                                
Dec 14 16:14:18 panther authpriv.warn pluto[26137]: OCF support for IKE [disabled]                                                                                                                                                                                                                   
Dec 14 16:14:18 panther authpriv.warn pluto[26137]: SAref support [disabled]: Protocol not available                                                                                                                                                                                                 
Dec 14 16:14:18 panther authpriv.warn pluto[26137]: SAbind support [disabled]: Protocol not available                                                                                                                                                                                                
Dec 14 16:14:18 panther authpriv.warn pluto[26137]: NSS support [disabled]                                                                                                                                                                                                                           
Dec 14 16:14:18 panther authpriv.warn pluto[26137]: HAVE_STATSD notification support not compiled in                                                                                                                                                                                                 
Dec 14 16:14:18 panther authpriv.warn pluto[26137]: Setting NAT-Traversal port-4500 floating to on                                                                                                                                                                                                   
Dec 14 16:14:18 panther authpriv.warn pluto[26137]:    port floating activation criteria nat_t=1/port_float=1                                                                                                                                                                                        
Dec 14 16:14:18 panther authpriv.warn pluto[26137]:    NAT-Traversal support  [enabled]                                                                                                                                                                                                              
Dec 14 16:14:18 panther authpriv.warn pluto[26137]: using /dev/urandom as source of random entropy                                                                                                                                                                                                   
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)                                                                                                                                                                                    
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: starting up 1 cryptographic helpers                                                                                                                                                                                                              
Dec 14 16:14:19 panther authpriv.warn pluto[26144]: using /dev/urandom as source of random entropy                                                                                                                                                                                                   
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: started helper pid=26144 (fd:6)                                                                                                                                                                                                                  
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: Kernel interface auto-pick                                                                                                                                                                                                                       
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: No Kernel NETKEY interface detected                                                                                                                                                                                                              
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: Using KLIPS IPsec interface code on 2.6.32.27                                                                                                                                                                                                    
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: Changed path to directory '/etc/ipsec.d/cacerts'                                                                                                                                                                                                 
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: Changed path to directory '/etc/ipsec.d/aacerts'                                                                                                                                                                                                 
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: Changed path to directory '/etc/ipsec.d/ocspcerts'                                                                                                                                                                                               
Dec 14 16:14:19 panther daemon.err ipsec_setup: Starting Openswan IPsec 2.6.37...                                                                                                                                                                                                                    
Dec 14 16:14:19 panther daemon.err ipsec_setup: ipsec0 -> NULL mtu=0(0) -> 0                                                                                                                                                                                                                         
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: Changing to directory '/etc/ipsec.d/crls'                                                                                                                                                                                                        
Dec 14 16:14:19 panther authpriv.warn pluto[26137]:   Warning: empty directory                                                                                                                                                                                                                       
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: added connection description "racoon"                                                                                                                                                                                                            
Dec 14 16:14:19 panther daemon.err ipsec__plutorun: 002 added connection description "racoon"                                                                                                                                                                                                        
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: added connection description "cougar"                                                                                                                                                                                                            
Dec 14 16:14:19 panther daemon.err ipsec__plutorun: 002 added connection description "cougar"                                                                                                                                                                                                        
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: listening for IKE messages                                                                                                                                                                                                                       
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: adding interface ipsec0/pppoe-wan 93.xx.xx.218:500                                                                                                                                                                                             
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: adding interface ipsec0/pppoe-wan 93.xx.xx.218:4500                                                                                                                                                                                            
Dec 14 16:14:19 panther authpriv.warn pluto[26137]: loading secrets from "/etc/ipsec.secrets"                                                                                                                                                                                                        
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: initiating Main Mode                                                                                                                                                                                                                
Dec 14 16:14:20 panther daemon.err ipsec__plutorun: 104 "racoon" #1: STATE_MAIN_I1: initiate                                                                                                                                                                                                         
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: received Vendor ID payload [XAUTH]                                                                                                                                                                                                  
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: received Vendor ID payload [Dead Peer Detection]                                                                                                                                                                                    
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: received Vendor ID payload [RFC 3947] method set to=109                                                                                                                                                                             
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: enabling possible NAT-traversal with method 4                                                                                                                                                                                       
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "cougar": cannot initiate connection without knowing peer IP address (kind=CK_TEMPLATE)                                                                                                                                                          
Dec 14 16:14:20 panther daemon.err ipsec__plutorun: 029 "cougar": cannot initiate connection without knowing peer IP address (kind=CK_TEMPLATE)                                                                                                                                                      
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2                                                                                                                                                                          
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: STATE_MAIN_I2: sent MI2, expecting MR2                                                                                                                                                                                              
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected                                                                                                                                                               
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3                                                                                                                                                                          
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: STATE_MAIN_I3: sent MI3, expecting MR3                                                                                                                                                                                              
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: Main mode peer ID is ID_FQDN: '@racoon.tvdr.de'                                                                                                                                                                                     
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4                                                                                                                                                                          
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp2048}                                                                                                                       
Dec 14 16:14:20 panther authpriv.warn pluto[26137]: "racoon" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:dbe321ff proposal=defaults pfsgroup=OAKLEY_GROUP_MODP2048}                                                                              
Dec 14 16:14:21 panther authpriv.warn pluto[26137]: "racoon" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2                                                                                                                                                                        
Dec 14 16:14:21 panther authpriv.warn pluto[26137]: "racoon" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xc22a86c0 <0x7cf7050c xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}

Alles anzeigen

Klaus

ATD

Zitat von kls

"aggressive" kennt OpenVpn nicht, und bei den anderen kommt im Log

Geht das?

Code

aggrmode=yes
pfs=yes
ike=aes128-sha1;modp1024
esp=aes128-sha1;modp1024

Albert

kls

Damit gibt es keine Fehlermeldung beim Start mehr.
Das Log sieht auch interessant aus:

log

Code

Dec 14 19:08:30 panther user.info kernel: klips_info:ipsec_init: KLIPS startup, Openswan KLIPS IPsec stack version: 2.6.37
Dec 14 19:08:30 panther user.info kernel: NET: Registered protocol family 15
Dec 14 19:08:30 panther user.warn kernel: registered KLIPS /proc/sys/net
Dec 14 19:08:30 panther user.info kernel: klips_info:ipsec_alg_init: KLIPS alg v=0.8.1-0 (EALG_MAX=255, AALG_MAX=251)
Dec 14 19:08:30 panther user.info kernel: klips_info:ipsec_alg_init: calling ipsec_alg_static_init()
Dec 14 19:08:30 panther user.warn kernel: ipsec_aes_init(alg_type=15 alg_id=12 name=aes): ret=0
Dec 14 19:08:30 panther user.warn kernel: ipsec_aes_init(alg_type=14 alg_id=9 name=aes_mac): ret=0
Dec 14 19:08:30 panther user.warn kernel: ipsec_3des_init(alg_type=15 alg_id=3 name=3des): ret=0
Dec 14 19:08:30 panther user.info kernel: KLIPS cryptoapi interface: alg_type=15 alg_id=12 name=cbc(aes) keyminbits=128 keymaxbits=256, found(0)
Dec 14 19:08:30 panther user.info kernel: KLIPS: lookup for ciphername=cbc(twofish): not found 
Dec 14 19:08:30 panther user.info kernel: KLIPS: lookup for ciphername=cbc(serpent): not found 
Dec 14 19:08:30 panther user.info kernel: KLIPS: lookup for ciphername=cbc(cast5): not found 
Dec 14 19:08:30 panther user.info kernel: KLIPS: lookup for ciphername=cbc(blowfish): not found 
Dec 14 19:08:30 panther user.info kernel: KLIPS: lookup for ciphername=cbc(des3_ede): not found 
Dec 14 19:08:30 panther daemon.err ipsec_setup: KLIPS debug `none'
Dec 14 19:08:31 panther daemon.err ipsec_setup: KLIPS ipsec0 on pppoe-wan 93.xx.xx.218/ pointtopoint 217.0.119.8/32 mtu 1492
Dec 14 19:08:32 panther authpriv.err ipsec__plutorun: Starting Pluto subsystem...
Dec 14 19:08:32 panther daemon.err ipsec_setup: ...Openswan IPsec started
Dec 14 19:08:32 panther user.warn syslog: adjusting ipsec.d to /etc/ipsec.d
Dec 14 19:08:32 panther daemon.err ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: LEAK_DETECTIVE support [disabled]
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: OCF support for IKE [disabled]
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: SAref support [disabled]: Protocol not available
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: SAbind support [disabled]: Protocol not available
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: NSS support [disabled]
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: HAVE_STATSD notification support not compiled in
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: Setting NAT-Traversal port-4500 floating to on
Dec 14 19:08:32 panther authpriv.warn pluto[26497]:    port floating activation criteria nat_t=1/port_float=1
Dec 14 19:08:32 panther authpriv.warn pluto[26497]:    NAT-Traversal support  [enabled]
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: using /dev/urandom as source of random entropy
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: starting up 1 cryptographic helpers
Dec 14 19:08:32 panther authpriv.warn pluto[26506]: using /dev/urandom as source of random entropy
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: started helper pid=26506 (fd:6)
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: Kernel interface auto-pick
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: No Kernel NETKEY interface detected
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: Using KLIPS IPsec interface code on 2.6.32.27
Dec 14 19:08:32 panther daemon.err ipsec_setup: Starting Openswan IPsec 2.6.37...
Dec 14 19:08:32 panther daemon.err ipsec_setup: ipsec0 -> NULL mtu=0(0) -> 0
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: Changed path to directory '/etc/ipsec.d/cacerts'
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: Changed path to directory '/etc/ipsec.d/aacerts'
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: Changed path to directory '/etc/ipsec.d/ocspcerts'
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: Changing to directory '/etc/ipsec.d/crls'
Dec 14 19:08:32 panther authpriv.warn pluto[26497]:   Warning: empty directory
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: added connection description "racoon"
Dec 14 19:08:32 panther daemon.err ipsec__plutorun: 002 added connection description "racoon"
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: added connection description "cougar"
Dec 14 19:08:32 panther daemon.err ipsec__plutorun: 002 added connection description "cougar"
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: listening for IKE messages
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: adding interface ipsec0/pppoe-wan 93.xx.xx.218:500
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: adding interface ipsec0/pppoe-wan 93.xx.xx.218:4500
Dec 14 19:08:32 panther authpriv.warn pluto[26497]: loading secrets from "/etc/ipsec.secrets"
Dec 14 19:08:33 panther authpriv.warn pluto[26497]: "racoon" #1: initiating Main Mode
Dec 14 19:08:33 panther daemon.err ipsec__plutorun: 104 "racoon" #1: STATE_MAIN_I1: initiate
Dec 14 19:08:33 panther authpriv.warn pluto[26497]: "racoon" #1: received Vendor ID payload [XAUTH]
Dec 14 19:08:33 panther authpriv.warn pluto[26497]: "racoon" #1: received Vendor ID payload [Dead Peer Detection]
Dec 14 19:08:33 panther authpriv.warn pluto[26497]: "racoon" #1: received Vendor ID payload [RFC 3947] method set to=109 
Dec 14 19:08:33 panther authpriv.warn pluto[26497]: "racoon" #1: enabling possible NAT-traversal with method 4
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "cougar": cannot initiate connection without knowing peer IP address (kind=CK_TEMPLATE)
Dec 14 19:08:34 panther daemon.err ipsec__plutorun: 029 "cougar": cannot initiate connection without knowing peer IP address (kind=CK_TEMPLATE)
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "racoon" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "racoon" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "racoon" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "racoon" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "racoon" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "racoon" #1: Main mode peer ID is ID_FQDN: '@racoon.tvdr.de'
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "racoon" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "racoon" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp2048}
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "racoon" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:61c6a121 proposal=defaults pfsgroup=OAKLEY_GROUP_MODP2048}
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "racoon" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
Dec 14 19:08:34 panther authpriv.warn pluto[26497]: "racoon" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xce50b834 <0x04218b0c xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
Dec 14 19:08:44 panther authpriv.warn pluto[26497]: initiate on demand from 192.168.100.5:0 to 192.168.1.1:0 proto=0 state: fos_start because: acquire
Dec 14 19:08:44 panther authpriv.warn pluto[26497]: cannot initiate connection for packet 192.168.100.5:0 -> 192.168.1.1:0 proto=0 - template conn
Dec 14 19:10:32 panther authpriv.warn pluto[26497]: initiate on demand from 192.168.100.5:0 to 192.168.1.1:0 proto=0 state: fos_start because: acquire
Dec 14 19:10:32 panther authpriv.warn pluto[26497]: cannot initiate connection for packet 192.168.100.5:0 -> 192.168.1.1:0 proto=0 - template conn

Alles anzeigen

Ich hatte von 192.168.100.5 aus einen ping auf 192.168.1.1 gemacht, und anscheinend "wollte" panther, "konnte" aber nicht ;-).

ipsec auto --status

Code

000 using kernel interface: klips
000 interface ipsec0/pppoe-wan 93.xx.xx.218
000 interface ipsec0/pppoe-wan 93.xx.xx.218
000 %myid = (none)
000 debug none
000 
000 virtual_private (%priv):
000 - allowed 0 subnets: 
000 - disallowed 0 subnets: 
000 WARNING: Either virtual_private= is not specified, or there is a syntax 
000          error in that line. 'left/rightsubnet=vhost:%priv' will not work!
000 WARNING: Disallowed subnets in virtual_private= is empty. If you have 
000          private address space in internal use, it should be excluded!
000 
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128, keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128
000 
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
000 
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} 
000 
000 "cougar": 192.168.100.0/24===93.xx.xx.218[@panther.tvdr.de,+S=C]...%any[@cougar.tvdr.de,+S=C]===192.168.1.0/24; prospective erouted; eroute owner: #0
000 "cougar":     myip=unset; hisip=unset;
000 "cougar":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "cougar":   policy: PSK+ENCRYPT+TUNNEL+PFS+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,24; interface: pppoe-wan; 
000 "cougar":   newest ISAKMP SA: #0; newest IPsec SA: #0; 
000 "cougar":   IKE algorithms wanted: AES_CBC(7)_128-SHA1(2)_000-MODP1024(2); flags=-strict
000 "cougar":   IKE algorithms found:  AES_CBC(7)_128-SHA1(2)_160-MODP1024(2)
000 "cougar":   ESP algorithms wanted: AES(12)_128-SHA1(2)_000; pfsgroup=MODP1024(2); flags=-strict
000 "cougar":   ESP algorithms loaded: AES(12)_128-SHA1(2)_160
000 "racoon": 192.168.100.0/24===93.xx.xx.218[@panther.tvdr.de,+S=C]...88.198.76.220<88.198.76.220>[@racoon.tvdr.de,+S=C]; erouted; eroute owner: #2
000 "racoon":     myip=unset; hisip=unset;
000 "racoon":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "racoon":   policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,32; interface: pppoe-wan; 
000 "racoon":   newest ISAKMP SA: #1; newest IPsec SA: #2; 
000 "racoon":   IKE algorithm newest: AES_CBC_128-SHA1-MODP2048
000 
000 #2: "racoon":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27658s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate
000 #2: "racoon" esp.ce50b834@88.198.76.220 esp.4218b0c@93.xx.xx.218 tun.1001@88.198.76.220 tun.1002@93.xx.xx.218 ref=3 refhim=1
000 #1: "racoon":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2447s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000

Alles anzeigen

Klaus

ATD

Zitat von kls

Das Log sieht auch interessant aus:

Das klappt noch nicht:

Code

"cougar": cannot initiate connection without knowing peer IP address (kind=CK_TEMPLATE)

Vielleicht nur right=cougar.tvdr.de, also ohne % in der ipsec.conf.

Ggf. /etc/init.d/ipsec reload vor restart.

Albert

kls

Mit "right=cougar.tvdr.de" ging es nicht, weil es dafür (noch) keinen DNS-Eintrag gibt. Aber mit "right=192.168.1.1" sieht es so aus:

log

Code

Dec 14 22:20:59 panther authpriv.err ipsec__plutorun: Starting Pluto subsystem...
Dec 14 22:20:59 panther daemon.err ipsec_setup: ...Openswan IPsec started
Dec 14 22:20:59 panther daemon.err ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d
Dec 14 22:20:59 panther user.warn syslog: adjusting ipsec.d to /etc/ipsec.d
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: LEAK_DETECTIVE support [disabled]
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: OCF support for IKE [disabled]
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: SAref support [disabled]: Protocol not available
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: SAbind support [disabled]: Protocol not available
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: NSS support [disabled]
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: HAVE_STATSD notification support not compiled in
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: Setting NAT-Traversal port-4500 floating to on
Dec 14 22:20:59 panther authpriv.warn pluto[27236]:    port floating activation criteria nat_t=1/port_float=1
Dec 14 22:20:59 panther authpriv.warn pluto[27236]:    NAT-Traversal support  [enabled]
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: using /dev/urandom as source of random entropy
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: starting up 1 cryptographic helpers
Dec 14 22:20:59 panther authpriv.warn pluto[27240]: using /dev/urandom as source of random entropy
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: started helper pid=27240 (fd:6)
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: Kernel interface auto-pick
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: No Kernel NETKEY interface detected
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: Using KLIPS IPsec interface code on 2.6.32.27
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: Changed path to directory '/etc/ipsec.d/cacerts'
Dec 14 22:20:59 panther daemon.err ipsec_setup: Starting Openswan IPsec 2.6.37...
Dec 14 22:20:59 panther daemon.err ipsec_setup: ipsec0 -> NULL mtu=0(0) -> 0
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: Changed path to directory '/etc/ipsec.d/aacerts'
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: Changed path to directory '/etc/ipsec.d/ocspcerts'
Dec 14 22:20:59 panther authpriv.warn pluto[27236]: Changing to directory '/etc/ipsec.d/crls'
Dec 14 22:20:59 panther authpriv.warn pluto[27236]:   Warning: empty directory
Dec 14 22:21:00 panther authpriv.warn pluto[27236]: added connection description "racoon"
Dec 14 22:21:00 panther daemon.err ipsec__plutorun: 002 added connection description "racoon"
Dec 14 22:21:00 panther authpriv.warn pluto[27236]: added connection description "cougar"
Dec 14 22:21:00 panther daemon.err ipsec__plutorun: 002 added connection description "cougar"
Dec 14 22:21:00 panther authpriv.warn pluto[27236]: listening for IKE messages
Dec 14 22:21:00 panther authpriv.warn pluto[27236]: adding interface ipsec0/pppoe-wan 93.xx.xx.218:500
Dec 14 22:21:00 panther authpriv.warn pluto[27236]: adding interface ipsec0/pppoe-wan 93.xx.xx.218:4500
Dec 14 22:21:00 panther authpriv.warn pluto[27236]: loading secrets from "/etc/ipsec.secrets"
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: initiating Main Mode
Dec 14 22:21:01 panther daemon.err ipsec__plutorun: 104 "racoon" #1: STATE_MAIN_I1: initiate
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: received Vendor ID payload [XAUTH]
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: received Vendor ID payload [Dead Peer Detection]
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: received Vendor ID payload [RFC 3947] method set to=109 
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: enabling possible NAT-traversal with method 4
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "cougar" #2: initiating Aggressive Mode #2, connection "cougar"
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: Main mode peer ID is ID_FQDN: '@racoon.tvdr.de'
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp2048}
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #3: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:1f96a578 proposal=defaults pfsgroup=OAKLEY_GROUP_MODP2048}
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #3: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
Dec 14 22:21:01 panther authpriv.warn pluto[27236]: "racoon" #3: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xcb973ad2 <0x474f87d6 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none}
Dec 14 22:21:38 panther authpriv.warn pluto[27236]: initiate on demand from 192.168.100.5:0 to 192.168.1.1:0 proto=0 state: fos_start because: acquire

Alles anzeigen

ipsec auto --status

Code

000 using kernel interface: klips
000 interface ipsec0/pppoe-wan 93.xx.xx.218
000 interface ipsec0/pppoe-wan 93.xx.xx.218
000 %myid = (none)
000 debug none
000 
000 virtual_private (%priv):
000 - allowed 0 subnets: 
000 - disallowed 0 subnets: 
000 WARNING: Either virtual_private= is not specified, or there is a syntax 
000          error in that line. 'left/rightsubnet=vhost:%priv' will not work!
000 WARNING: Disallowed subnets in virtual_private= is empty. If you have 
000          private address space in internal use, it should be excluded!
000 
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=64, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=128, keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128
000 
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
000 
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,1,36} trans={0,1,144} attrs={0,1,192} 
000 
000 "cougar": 192.168.100.0/24===93.xx.xx.218[@panther.tvdr.de,+S=C]...192.168.1.1<192.168.1.1>[@cougar.tvdr.de,+S=C]===192.168.1.0/24; prospective erouted; eroute owner: #0
000 "cougar":     myip=unset; hisip=unset;
000 "cougar":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "cougar":   policy: PSK+ENCRYPT+TUNNEL+PFS+UP+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,24; interface: pppoe-wan; 
000 "cougar":   newest ISAKMP SA: #0; newest IPsec SA: #0; 
000 "cougar":   IKE algorithms wanted: AES_CBC(7)_128-SHA1(2)_000-MODP1024(2); flags=-strict
000 "cougar":   IKE algorithms found:  AES_CBC(7)_128-SHA1(2)_160-MODP1024(2)
000 "cougar":   ESP algorithms wanted: AES(12)_128-SHA1(2)_000; pfsgroup=MODP1024(2); flags=-strict
000 "cougar":   ESP algorithms loaded: AES(12)_128-SHA1(2)_160
000 "racoon": 192.168.100.0/24===93.xx.xx.218[@panther.tvdr.de,+S=C]...88.198.76.220<88.198.76.220>[@racoon.tvdr.de,+S=C]; erouted; eroute owner: #3
000 "racoon":     myip=unset; hisip=unset;
000 "racoon":   ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "racoon":   policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,32; interface: pppoe-wan; 
000 "racoon":   newest ISAKMP SA: #1; newest IPsec SA: #3; 
000 "racoon":   IKE algorithm newest: AES_CBC_128-SHA1-MODP2048
000 
000 #2: "cougar":500 STATE_AGGR_I1 (sent AI1, expecting AR1); EVENT_RETRANSMIT in 17s; nodpd; idle; import:admin initiate
000 #2: pending Phase 2 for "cougar" replacing #0
000 #3: "racoon":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27920s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate
000 #3: "racoon" esp.cb973ad2@88.198.76.220 esp.474f87d6@93.xx.xx.218 tun.1001@88.198.76.220 tun.1002@93.xx.xx.218 ref=3 refhim=1
000 #1: "racoon":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2808s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000

Alles anzeigen

Funktionieren tut es aber auch damit nicht.

Klaus

ATD

Zitat von kls

Mit "right=cougar.tvdr.de" ging es nicht, weil es dafür (noch) keinen DNS-Eintrag gibt.

Das ist suboptimal.

Zitat von kls

Aber mit "right=192.168.1.1" sieht es so aus:

Klaus, das ist doch logisch ganz falsch. Du kannst als right nur die externe public IP der Gegenseite eintragen. Entweder mit ddns oder im Klartext wie 188.xxx.xxx.113 wenn es sich nicht schon geändert hat. An die Interne Adresse kommst Du nur über den Tunnel oder durch Portforwards heran, niemals direkt aus dem Internet. Das NAT blockt alle anderen Pakete, die er nicht kennt. Dazu brauchen wir nicht einmal den Firewall.

Albert

ATD

Zitat von kls

Nun wäre es nur noch schön, wenn ich ohne den "initialen Ping" auskommen könnte...

Klaus, auch das können wir abhaken. Nach einem kurzen loggen von iptables war ersichtlich, dass das esp Protokoll blockiert wurde, solange kein Traffic von der Innenseite stattfand. Warum und wieso? Dafür habe ich keine Erklärung, aber eine Lösung.

/etc/firewall.user

Code

#/etc/firewall.user


iptables -t nat -A prerouting_wan_rule -m policy --dir in --pol ipsec -j ACCEPT
iptables -t nat -A postrouting_wan_rule -m policy --dir out --pol ipsec -j ACCEPT
iptables -A input_wan_rule -p esp -j ACCEPT

Danach war der Tunnelverkehr ohne Beschränkungen und ohne "initialen Ping" von allen Seiten möglich. Du wirst es vermutlich von racoon seine Seite aus einsetzen müssen, aber bei cougar würde ich es trotzdem unbedingt anwenden. Weitere Änderungen habe ich nicht vorgenommen.

Damit ist das ursprüngliche Problem: OpenWRT mit strongSwan IPSec Tunnel erledigt!?

Albert

kls

Zitat von ATD

Klaus, das ist doch logisch ganz falsch. Du kannst als right nur die externe public IP der Gegenseite eintragen. Entweder mit ddns oder im Klartext wie 188.xxx.xxx.113 wenn es sich nicht schon geändert hat. An die Interne Adresse kommst Du nur über den Tunnel oder durch Portforwards heran, niemals direkt aus dem Internet. Das NAT blockt alle anderen Pakete, die er nicht kennt. Dazu brauchen wir nicht einmal den Firewall.

Ich dachte, weil du für cougar

Code

conn panther
        rightid=@panther.tvdr.de
        right=%panther.tvdr.de
        rightsubnet=192.168.100.0/24

angegeben hattest, daß ich für panther einfach s/panther/cougar/ machen könnte und ipsec "irgendwie weiß", daß die VPN-Verbindung zwischen panther und cougar "über racoon" läuft. Aber da war ich wohl auf dem Holzweg ;-).

Da jetzt extra DDNS zu machen gefällt mir nicht so ganz. Vielleicht könnte ich ja meine ursprüngliche Idee wieder aufgreifen, nämlich daß durch geeignete Routing-Einträge die Pakete zwischen cougar und panther halt über racoon (durch den jeweiligen VPN-Tunnel) geroutet werden.

Klaus

kls

Zitat von ATD

Nach einem kurzen loggen von iptables war ersichtlich, dass das esp Protokoll blockiert wurde, solange kein Traffic von der Innenseite stattfand.
...
Du wirst es vermutlich von racoon seine Seite aus einsetzen müssen, aber bei cougar würde ich es trotzdem unbedingt anwenden. Weitere Änderungen habe ich nicht vorgenommen.

Das ist seltsam. Inzwischen tritt das anscheinend nicht mehr auf, ich kann die Verbindung zwischen cougar und racoon beliebig trennen und wieder aufbauen, und der Tunnel steht sofort (auch ohne deine Änderung).
Meine /etc/firewall.user hatte noch die zwei Zeilen

Code

iptables -A forwarding_rule -m policy --dir in --pol ipsec -m conntrack --ctstate N -j zone_vpn_forward
iptables -A input_wan_rule -m policy --dir in --pol ipsec -m conntrack --ctstate N -j ACCEPT

die du nicht hast. Ich habe die jetzt mal auskommentiert und es funktioniert trotzdem.
Bis auf weiteres verwende ich jetzt mal auf cougar

/etc/firewall.user

Code

#/etc/firewall.user


iptables -t nat -A prerouting_wan_rule -m policy --dir in --pol ipsec -j ACCEPT
iptables -t nat -A postrouting_wan_rule -m policy --dir out --pol ipsec -j ACCEPT
#iptables -A forwarding_rule -m policy --dir in --pol ipsec -m conntrack --ctstate N -j zone_vpn_forward
#iptables -A input_wan_rule -m policy --dir in --pol ipsec -m conntrack --ctstate N -j ACCEPT
#iptables -A input_wan_rule -p esp -j ACCEPT

und habe den Ping jede Minute auf racoon abgestellt. Mal sehen, wie es sich im Dauerbetrieb verhält. Sollte die Verbindung doch mal wieder nicht hochkommen, werde ich die "esp"-Zeile von dir aktivieren.

Zitat

Damit ist das ursprüngliche Problem: OpenWRT mit strongSwan IPSec Tunnel erledigt!?

Ja, das ist erledigt und ich habe inzwischen meine ganze Entwicklungsumgebung hierher verlegt :-).
Nochmals recht vielen Dank für deine unermüdliche und kompetente Hilfe!

Klaus

[Suche] Empfehlung für Router mit Kabel Deutschland unter openWRT

Jetzt mitmachen!

Benutzer online in diesem Thema