l2tp/ipsec - xl2tpd/strongswan

...
Chain FORWARD (policy ACCEPT)
...
ACCEPT     tcp  --  anywhere             192.168.0.115       tcp dpt:1701
ACCEPT     udp  --  anywhere             192.168.0.115       udp dpt:1701
ACCEPT     udp  --  anywhere             192.168.0.115       udp dpt:500
ACCEPT     udp  --  anywhere             192.168.0.115       udp dpt:4500
...

Chain PREROUTING (policy ACCEPT)
...
DNAT       tcp  --  anywhere             8.8.8.8 tcp dpt:1701 to:192.168.0.115:1701
DNAT       udp  --  anywhere             8.8.8.8 udp dpt:1701 to:192.168.0.115:1701
DNAT       udp  --  anywhere             8.8.8.8 udp dpt:500 to:192.168.0.115:500
DNAT       udp  --  anywhere             8.8.8.8 udp dpt:4500 to:192.168.0.115:4500
...
DNAT       0    --  anywhere             8.8.8.8 to:192.168.0.115

03[ENC] verifying message structure
03[ENC] found payload of type HASH_V1
03[ENC] found payload of type SECURITY_ASSOCIATION_V1
03[ENC] found payload of type NONCE_V1
03[ENC] found payload of type ID_V1
03[ENC] found payload of type ID_V1
03[ENC] found payload of type NAT_OA_V1
03[ENC] found payload of type NAT_OA_V1
03[ENC] parsed QUICK_MODE request 2 [ HASH SA No ID ID NAT-OA NAT-OA ]
03[IKE] changing received traffic selectors 9.9.9.9/32[udp/l2f]=== 8.8.8.8/32[udp/l2f] due to NAT
03[CFG] looking for a child config for 192.168.0.115/32[udp/l2f] === 9.9.9.9/32[udp/l2f]
03[CFG] proposing traffic selectors for us:
03[CFG]  192.168.0.115/32
03[CFG] proposing traffic selectors for other:
03[CFG]  0.0.0.0/0
03[CFG]   candidate "rw-jeka" with prio 1+1
03[CFG] found matching child config "rw-jeka" with prio 2
03[CFG] selecting traffic selectors for other:
03[CFG]  config: 0.0.0.0/0, received: 9.9.9.9/32[udp/l2f] => match: 9.9.9.9/32[udp/l2f]
03[CFG] selecting traffic selectors for us:
03[CFG]  config: 192.168.0.115/32, received: 192.168.0.115/32[udp/l2f] => match: 192.168.0.115/32[udp/l2f]
03[CFG] selecting proposal:

06[ENC] insert decrypted payload of type HASH_V1 at end of list
06[ENC] verifying message structure
06[ENC] found payload of type HASH_V1
06[ENC] parsed QUICK_MODE request 3 [ HASH ]
06[IKE] sa payload missing
06[IKE] queueing INFORMATIONAL task
06[IKE] activating new tasks

xl2tpd[27409]: IPsec SAref does not work with L2TP kernel mode yet, enabling forceuserspace=yes
xl2tpd[27409]: setsockopt recvref[30]: Protocol not available
xl2tpd[27409]: This binary does not support kernel L2TP.
xl2tpd[27409]: xl2tpd version xl2tpd-1.3.1 started on vpn PID:27409
xl2tpd[27409]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
xl2tpd[27409]: Forked by Scott Balmos and David Stipp, (C) 2001
xl2tpd[27409]: Inherited by Jeff McAdams, (C) 2002
xl2tpd[27409]: Forked again by Xelerance (www.xelerance.com) (C) 2006
xl2tpd[27409]: Listening on IP address 192.168.0.115, port 1701

;
; Sample l2tpd configuration file
;
; This example file should give you some idea of how the options for l2tpd
; should work.  The best place to look for a list of all options is in
; the source code itself, until I have the time to write better documetation :)
; Specifically, the file "file.c" contains a list of commands at the end.
;
; You most definitely don't have to spell out everything as it is done here
;
[global]                                                               ; Global parameters:
debug network = yes
debug tunnel = yes
ipsec saref = no
; saref refinfo = 30
listen-addr = 192.168.0.115
port = 1701                                                    ; * Bind to port 1701
auth file = /etc/xl2tpd/l2tp-secrets   ; * Where our challenge secrets are
; access control = yes                                  ; * Refuse connections without IP match
rand source = dev                     ; Source for entropy for random
;                                       ; numbers, options are:
;                                       ; dev - reads of /dev/urandom
;                                       ; sys - uses rand()
;                                       ; egd - reads from egd socket
;                                       ; egd is not yet implemented
;
[lns default]                                                  ; Our fallthrough LNS definition
exclusive = yes                                                ; * Only permit one tunnel per host
assign ip = yes
ip range = 10.0.0.1-10.10.0.4  ; * Allocate from this IP range
; no ip range = 192.168.0.3-192.168.0.9 ; * Except these hosts
; ip range = 192.168.0.5                                ; * But this one is okay
; ip range = lac1-lac2                                  ; * And anything from lac1 to lac2's IP
; lac = 192.168.1.4 - 192.168.1.8               ; * These can connect as LAC's
; no lac = untrusted.marko.net                  ; * This guy can't connect
hidden bit = no                                                ; * Use hidden AVP's?
local ip = 10.0.0.5                            ; * Our local IP to use
length bit = yes                                               ; * Use length bit in payload?
require chap = yes                                     ; * Require CHAP auth. by peer
refuse pap = yes                                               ; * Refuse PAP authentication
refuse chap = no                                               ; * Refuse CHAP authentication
refuse authentication = no                     ; * Refuse authentication altogether
require authentication = yes                   ; * Require peer to authenticate
unix authentication = no                               ; * Use /etc/passwd for auth.
name = peer.Gov.ru                                           ; * Report this as our hostname
ppp debug = yes                                                ; * Turn on PPP debugging
pppoptfile = /etc/ppp/options.l2tpd.lns        ; * ppp options file
; call rws = 10                                                 ; * RWS for call (-1 is valid)
; tunnel rws = 4                                                ; * RWS for tunnel (must be > 0)
flow bit = yes                                         ; * Include sequence numbers
challenge = no                                         ; * Challenge authenticate peer ;
; rx bps = 10000000                             ; Receive tunnel speed
; tx bps = 10000000                             ; Transmit tunnel speed
; bps = 100000                                  ; Define both receive and transmit speed in one option

# ipsec.conf - strongSwan IPsec configuration file
# basic configuration
config setup
        charondebug = "dmn 2, mgr 2, ike 2, chd 2, job 2, cfg 2, knl 2, net 2, asn 2, enc 2, lib 2, esp 2, tls 2, tnc 2, imc 2, imv 2, pts 2"
        #charondebug = "asn 2, enc 2, lib 2, esp 2, tls 2, tnc 2, imc 2, imv 2, pts 2"
        # strictcrlpolicy=yes
        # uniqueids = no
        nat_traversal=yes
        #strictpolicy=no
        charonstart=yes
        plutostart=no
        #charondebug="ike 2, knl 2, net 3, cfg 0"
# Add connections here.
# Sample VPN connections
#conn sample-self-signed
#      leftsubnet=10.1.0.0/16
#      leftcert=selfCert.der
#      leftsendcert=never
#      right=192.168.0.2
#      rightsubnet=10.2.0.0/16
#      rightcert=peerCert.der
#      auto=start
#conn sample-with-ca-cert
#      leftsubnet=10.1.0.0/16
#      leftcert=myCert.pem
#      right=192.168.0.2
#      rightsubnet=10.2.0.0/16
#      rightid="C=CH, O=Linux strongSwan CN=peer name"
#      auto=start
conn rw-jeka
        ikelifetime=60m
        keylife=20m
        rekeymargin=3m
        keyingtries=1
        dpdaction=restart
        #dpdelay=30s
        dpdtimeout=180s
        keyexchange=ikev1
        authby=secret
        left=192.168.0.115
        #left=9.9.9.9
        #leftsubnet=192.168.0.0/24
        leftid=192.168.0.115
        #leftcert=/etc/ipsec.d/certs/servercert.pem
        #leftauth=pubkey
        right=%any
        #rightauth=eap-mschapv2
        #rightsendcert=never
        rightsubnet=0.0.0.0/0
        rightsourceip=192.168.111.0/24
        type=tunnel
        auto=add

root@vpn:~# ipsec statusall
Status of IKE charon daemon (strongSwan 5.1.1, Linux 3.2.0-4-amd64, x86_64):
  uptime: 8 seconds, since Nov 24 14:27:33 2013
  malloc: sbrk 262144, mmap 0, used 225072, free 37072
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 7
  loaded plugins: charon aes des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic
Virtual IP pools (size/online/offline):
  192.168.111.0/24: 254/0/0
Listening IP addresses:
  192.168.0.115
Connections:
     rw-jeka:  192.168.0.115...%any  IKEv1, dpddelay=30s
     rw-jeka:   local:  [192.168.0.115] uses pre-shared key authentication
     rw-jeka:   remote: uses pre-shared key authentication
     rw-jeka:   child:  dynamic === 0.0.0.0/0 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 connecting):
     rw-jeka[1]: ESTABLISHED 3 seconds ago, 192.168.0.115[192.168.0.115]...9.9.9.9[9.9.9.9]
     rw-jeka[1]: IKEv1 SPIs: 90b394d6268b77a1_i ae44327ab524f0e4_r*, pre-shared key reauthentication in 54 minutes
     rw-jeka[1]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
     rw-jeka{1}:  INSTALLED, TRANSPORT, ESP in UDP SPIs: c18e3040_i 12971c72_o
     rw-jeka{1}:  AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 14 minutes
     rw-jeka{1}:   192.168.0.115/32[udp/l2f] === 9.9.9.9/32[udp/l2f]
root@vpn:~#

root@vpn:~# /usr/local/sbin/ipsec version
Linux strongSwan U5.1.1/K3.2.0-4-amd64
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil, Switzerland
See 'ipsec --copyright' for copyright information.

# iptables -A INPUT -p 51 -m ah --ahspi 500 -j DROP
# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       ipv6-auth--  anywhere             anywhere           ah spi:500

# iptables -A INPUT -p 50 -m esp --espspi 500 -j DROP
# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       ipv6-crypt--  anywhere             anywhere           esp spi:500