[tkmds]

Hello,

What is the correct syntax to add XFRMI or VTI interfaces?

root@DD-WRT:~# ip link add xfrm0 type xfrm dev ipsec0 if_id 42
ip: RTNETLINK answers: Not supported
root@DD-WRT:~# ip link add vti0 type vti dev ipsec0 if_id 42
ip: RTNETLINK answers: Not supported
root@DD-WRT:~#

Or perhaps I'm missing a module?

DD-WRT v3.0-r40854 std (08/29/19)

Linux DD-WRT 4.4.190 #1092 SMP Thu Aug 29 11:32:59 +04 2019 armv7l DD-WRT

[ EDIT ] ----------------------------------

BACKGROUND

Configuring StrongSwan on DD-WRT. Everything works fine and tunnels are created however I can't ping or access REMOTE VM's.

According to https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules I need a few modules. Interestingly, what I do have is:


root@DD-WRT:~# find / -iname tunnel*
/lib/modules/4.4.190/tunnel4.ko
/lib/modules/4.4.190/tunnel6.ko
root@DD-WRT:~# find / -iname exp4*
root@DD-WRT:~# find / -iname esp4*
root@DD-WRT:~# find / -iname esp*
/lib/modules/4.4.190/esp6.ko
root@DD-WRT:~# find / -iname xfrm*
/lib/modules/4.4.190/xfrm6_mode_beet.ko
/lib/modules/4.4.190/xfrm6_mode_ro.ko
/lib/modules/4.4.190/xfrm6_mode_transport.ko
/lib/modules/4.4.190/xfrm6_mode_tunnel.ko
/lib/modules/4.4.190/xfrm6_tunnel.ko
/lib/modules/4.4.190/xfrm_algo.ko
/lib/modules/4.4.190/xfrm_ipcomp.ko
/proc/sys/net/core/xfrm_acq_expires
/proc/sys/net/core/xfrm_aevent_etime
/proc/sys/net/core/xfrm_aevent_rseqth
/proc/sys/net/core/xfrm_larval_drop
/proc/sys/net/ipv4/xfrm4_gc_thresh
root@DD-WRT:~#
root@DD-WRT:~#
root@DD-WRT:~# find / -iname ip_tunnel*
/lib/modules/4.4.190/ip_tunnel.ko
root@DD-WRT:~#


( Why is xfrm6_tunnel.ko installed but xfrm4_tunnel.ko missing? Should it even be there in the kernel image? )


Pinging, ssh etc access works find from REMOTE to LOCAL. But not LOCAL to REMOTE with strongswan-kernel-libipsec included. This I find odd because it seems to indicate the Remote to Strongswan connection is fine, just routing and forwarding packets from the DD-WRT router over to the Remote instances isn't working. Tried a tcpdump, but no reply:

root@DD-WRT:~# tcpdump -i ipsec0 -s 0 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ipsec0, link-type RAW (Raw IP), snapshot length 262144 bytes
08:44:28.318516 IP 100.100.100.100 > 10.10.0.4: ICMP echo request, id 36426, seq 0, length 64
08:44:29.325741 IP 100.100.100.100 > 10.10.0.4: ICMP echo request, id 36426, seq 1, length 64

What's also interesting, is that with this new config:

conn REMOTE-VLANS
authby=secret
auto=start
type=tunnel
keyexchange=ikev2
keylife=3600s
ikelifetime=28800s
rekey=yes
rekeymargin=3m
keyingtries=1
mobike=no
dpdaction=restart
left=100.100.100.100
leftsubnet=192.168.0.0/24
lefthostaccess=yes
right=123.123.123.123
rightsubnet=10.10.0.0/24
esp=aes256gcm16,aes256-sha2_256,aes256-sha1-modp2048,aes256-sha1,aes128-sha1!
ike=aes256-sha2_256-modp1024,aes256-sha1-modp1024,aes128-sha1-modp1024!

I no longer have to run:

ip route add 10.10.0.0/24 dev ipsec0

for packets to show up on ipsec0:


root@DD-WRT:~# tcpdump -i ipsec0 -s 0 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ipsec0, link-type RAW (Raw IP), snapshot length 262144 bytes
08:44:28.318516 IP 100.100.100.100 > 10.10.0.4: ICMP echo request, id 36426, seq 0, length 64
08:44:29.325741 IP 100.100.100.100 > 10.10.0.4: ICMP echo request, id 36426, seq 1, length 64

but not anymore. Connection is established fine:

root@DD-WRT:~# ipsec status
Security Associations (1 up, 0 connecting):
REMOTE-VLANS[1]: ESTABLISHED 2 seconds ago, 100.100.100.100[100.100.100.100]...123.123.123.123[123.123.123.123]
REMOTE-VLANS{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: 2170db44_i 27817e76_o
REMOTE-VLANS{1}: 192.168.0.0/24 === 10.10.0.0/24
root@DD-WRT:~#


However, I don't see anything going further than the ipsec0 interface that ipsec creates when starting up. It's a bit of a black box between there and the remote machine.


The only time I couldn't ping from REMOTE to LOCAL is when I was missing these F/W rules.


iptables -I FORWARD -s 10.10.0.0/24 -d 192.168.0.0/24 -j ACCEPT
iptables -I INPUT -p icmp -s 10.10.0.0/24 -d 192.168.0.1/32 -j ACCEPT


Thinking something similar was needed but for the reverse. Still looking at some StrongSwan recommendations to add XFRM, VTI or GRE interfaces, however, I get:


root@DD-WRT:~# ip link add xfrm0 type xfrm dev ipsec0 if_id 42
ip: RTNETLINK answers: Not supported
root@DD-WRT:~# ip link add vti0 type vti dev ipsec0 if_id 42
ip: RTNETLINK answers: Not supported
root@DD-WRT:~#

Trying GRE but:

root@DD-WRT:~# ip tunnel add ipsec01 local 100.100.100.100 remote 123.123.123.123 mode gre
ip: ioctl 0x89f1 failed: No such device
root@DD-WRT:~#

REMOTE is not running StrongSwan btw.


Tyvm,

[tkmds]

I tried to compile the XFRM modules to then drop them in but ran into some issues. Is this still the correct way to create the modules?

https://wiki.dd-wrt.com/wiki/index.php?title=Development#Requirements

[tkmds]

Tricked it and managed to compile the modules by creating a symbolic link like this:

[kernel-panic69]

It would help to know what target router you are referring to. Here's the old thread for Compiling DD-WRT that used to be in the Broadcom forum:

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=269372

Perhaps @egc, @yoyoma2, @rkboni or one of the other collaborators can shed some light on your situation.

[Alozaros]

v3.0-r40854 is an old build...and Kong builds ware ok with SSW and IPsec but not BS builds......according to the SVN IPsec and SSw... things ware WIP by that time try a newer build...it may help...

I guess you use R7000...

[kernel-panic69]

The modules could also be used from a comparable kernel version from the OpenWRT repo.

[tkmds]

Reason why I use this build, since at the time, only this version supported FRRouting / OSPF / Quagga properly.

https://svn.dd-wrt.com/ticket/6937

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322299

And I really need OSPF. Do you gentlemen know if FRRouting has been tested on any of the newer versions since I posted the two above?

This is what I have:

Asus RT-AC68U
Firmware Version DD-WRT v3.0-r40854 std (08/29/19)
Linux 4.4.190 #1092 SMP Thu Aug 29 11:32:59 +04 2019 armv7l
Broadcom BCM4708

I'll try OpenWRT later tonight. Now do you mean there could be a direct links to where I can at least find the xfrm_user.ko modules off their site or do you mean I would have to source and compile off their page? What would be the link?

Also, what would be the correct SVN link and toolchains to successfully compile off the DD-WRT sources? Ones I tried above weren't working.

Cheers,
TK

[kernel-panic69]

Almost thought I misspoke about the OpenWRT capability. The kmod packages listed in this directory are the ones that are available for k4.4 Broadcom ARM:

https://downloads.openwrt.org/releases/17.01.7/targets/bcm53xx/generic/packages/

Only way to find out if it's been fixed is check the svn log or flash 43502 and test it, I don't recall any commits that stand out.

[tkmds]

Glanced over the link briefly.

https://downloads.openwrt.org/releases/17.01.7/targets/brcm47xx/generic/packages/kmod-ipsec4_4.4.182-1_mipsel_mips32.ipk

Guessing it might be one of these IPSec repos. Don't see anything specific for XFRM.

Will look again later in the day.

Cheers,
TK

[kernel-panic69]

I linked you to the ARM cache, and you look in the MIPS cache. Are you *not* looking to do this on ARM?? BCM4708 is ARM!

[tkmds]

Sorry, I should have elaborated a bit more.

I did look here.

https://downloads.openwrt.org/releases/17.01.7/targets/bcm53xx/generic/packages/

But the CPU model is Broadcom BCM4708, not bcm53xxx, so I thought you meant for me to look under:

https://downloads.openwrt.org/releases/17.01.7/targets/brcm47xx/generic/packages/

not realizing what you mentioned. But taking a closer look, I see what you mean now. Sorry totally missed one is ARM the other is MIPS. ( I blame useless meetings for this.)

Then what I need is:

https://downloads.openwrt.org/releases/17.01.7/targets/bcm53xx/generic/packages/kmod-ipsec4_4.4.182-1_arm_cortex-a9.ipk

I suppose. Trying to list the contents of it.

[tkmds]

Hmm, nope. Loading /jffs/lib/modules/4.4.182/xfrm4_tunnel.ko is fine.

But when typing lsmod, that is when it crashes:

[tkmds]

I've upgraded to:

DD-WRT v3.0-r43502 std (06/23/20)


And reconfigured OSPF. Unlike my earlier post, I managed to reconfigure without FRRouting. So it works well again. As for XFRM, no luck. Same situation.

[tkmds]

Tried to install the modules again:

[tkmds]

Is there any other options for compiling and getting the modules into my build?

In the least need xfrm_user.ko if not the others.

https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules