SSH on an IPsec tunnel with Openswan freezes

aixarat · 03-22-2009, 10:49 PM

Hello all,

After a lot of hard work, we were able to create an IPsec tunnel between a Linux box (Ubuntu Hardy) and a Stonegate firewall.

However, our celebration was short-lived: we can ssh through the tunnel, but once we have a working shell, it freezes after some 8 commands. It seems to be data-volume-related, since a Top command freezes it immediately.

Here's my Openswan config:

Code:

conn tresm-knx
	auth=esp
	auto=start
	authby=secret
	type=tunnel
	keyexchange=ike
	pfs=no
	left=ubuntu.public.ip.address
	leftsubnet=192.168.131.0/24
	right=stonegate.public.ip.address
	rightsubnet=10.154.200.0/24
	keyingtries=0

Nothing fancy, you see. The box has Shorewall 4, but it behaves the same with or without it (have tried several times)

Is there a setting I am missing that allows for a fluid data stream? Or the other way around, something I have is preventing the data from flowing?

I have the Stonegate side set to no compression, however I do not know if Openswan, in absence of a declared setting, takes a default configuration that may be conflicting with the tunnel's operation.

All and any help with this issue is greatly appreciated.

tuliojm · 03-24-2009, 12:01 PM

Hello,

do you check the log file for anything strage?
Maybe you could do some tests with the mtu values (let it equal in both sides). Decrease it and verify if something change.

Regards,

Tulio Munhoz

aixarat · 03-25-2009, 03:18 AM

Solved. It was weird.

As it happens, the DSL connection (pppoe) needs to be started after shorewall is started. Getting this backwards generates all sort of errors, from which we first noticed the shell freezing.