https://wiki.ixheim.de/index.php?action=history&feed=atom&title=Ip_xfrm
Ip xfrm - Versionsgeschichte
2026-05-15T02:59:44Z
Versionsgeschichte dieser Seite in Xinux Wiki
MediaWiki 1.35.1
https://wiki.ixheim.de/index.php?title=Ip_xfrm&diff=14790&oldid=prev
Thomas: Die Seite wurde neu angelegt: „=Prinzip= ==tic== ip xfrm state flush ip xfrm state add src 192.168.244.53 dst 192.168.244.52 proto esp spi 0x12345678 \ reqid 0x12345678 mode tunnel aut…“
2017-10-22T06:51:44Z
<p>Die Seite wurde neu angelegt: „=Prinzip= ==tic== ip xfrm state flush ip xfrm state add src 192.168.244.53 dst 192.168.244.52 proto esp spi 0x12345678 \ reqid 0x12345678 mode tunnel aut…“</p>
<p><b>Neue Seite</b></p><div>=Prinzip=<br />
==tic==<br />
ip xfrm state flush<br />
<br />
ip xfrm state add src 192.168.244.53 dst 192.168.244.52 proto esp spi 0x12345678 \<br />
reqid 0x12345678 mode tunnel auth sha256 0x1234567890123456789012345678901234567890123456789012345678901234 \<br />
enc aes 0x0000123456789012345678901234567890123456789012345678901234567890<br />
<br />
ip xfrm state add src 192.168.244.52 dst 192.168.244.53 proto esp spi 0x12345678 \<br />
reqid 0x12345678 mode tunnel auth sha256 0x1234567890123456789012345678901234567890123456789012345678901234 \<br />
enc aes 0x0000123456789012345678901234567890123456789012345678901234567890<br />
<br />
ip xfrm policy flush<br />
<br />
ip xfrm policy add src 10.10.53.0/24 dst 10.10.52.0/24 dir out tmpl src 192.168.244.53 dst 192.168.244.52 \<br />
proto esp reqid 0x12345678 mode tunnel<br />
<br />
ip xfrm policy add src 10.10.52.0/24 dst 10.10.53.0/24 dir in tmpl src 192.168.244.52 dst 192.168.244.53 \<br />
proto esp reqid 0x12345678 mode tunnel<br />
<br />
==nogger==<br />
ip xfrm state flush<br />
<br />
ip xfrm state add src 192.168.244.53 dst 192.168.244.52 proto esp spi 0x12345678 \<br />
reqid 0x12345678 mode tunnel auth sha256 0x1234567890123456789012345678901234567890123456789012345678901234 \<br />
enc aes 0x0000123456789012345678901234567890123456789012345678901234567890<br />
<br />
ip xfrm state add src 192.168.244.52 dst 192.168.244.53 proto esp spi 0x12345678 \<br />
reqid 0x12345678 mode tunnel auth sha256 0x1234567890123456789012345678901234567890123456789012345678901234 \<br />
enc aes 0x0000123456789012345678901234567890123456789012345678901234567890<br />
<br />
ip xfrm policy flush<br />
<br />
ip xfrm policy add src 10.10.52.0/24 dst 10.10.53.0/24 dir out tmpl src 192.168.244.52 dst 192.168.244.53 \<br />
proto esp reqid 0x12345678 mode tunnel<br />
<br />
ip xfrm policy add src 10.10.53.0/24 dst 10.10.52.0/24 dir in tmpl src 192.168.244.53 dst 192.168.244.52 \<br />
proto esp reqid 0x12345678 mode tunnel<br />
<br />
==Kontrolle==<br />
*ip xfrm state<br />
<pre><br />
src 192.168.244.52 dst 192.168.244.53<br />
proto esp spi 0x12345678 reqid 305419896 mode tunnel<br />
replay-window 0 <br />
auth-trunc hmac(sha256) 0x1234567890123456789012345678901234567890123456789012345678901234 96<br />
enc cbc(aes) 0x0000123456789012345678901234567890123456789012345678901234567890<br />
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000<br />
sel src 0.0.0.0/0 dst 0.0.0.0/0 <br />
src 192.168.244.53 dst 192.168.244.52<br />
proto esp spi 0x12345678 reqid 305419896 mode tunnel<br />
replay-window 0 <br />
auth-trunc hmac(sha256) 0x1234567890123456789012345678901234567890123456789012345678901234 96<br />
enc cbc(aes) 0x0000123456789012345678901234567890123456789012345678901234567890<br />
anti-replay context: seq 0x0, oseq 0x196, bitmap 0x00000000<br />
sel src 0.0.0.0/0 dst 0.0.0.0/0 <br />
</pre><br />
*ip xfrm policy<br />
<pre><br />
<br />
src 10.10.52.0/24 dst 10.10.53.0/24 <br />
dir in priority 0 <br />
tmpl src 192.168.244.52 dst 192.168.244.53<br />
proto esp reqid 305419896 mode tunnel<br />
src 10.10.53.0/24 dst 10.10.52.0/24 <br />
dir out priority 0 <br />
tmpl src 192.168.244.53 dst 192.168.244.52<br />
proto esp reqid 305419896 mode tunnel<br />
</pre><br />
*ip xfrm monitor <br />
<pre><br />
Async event (0x10) replay update <br />
src 192.168.244.53 dst 192.168.244.52 reqid 0x12345678 protocol esp SPI 0x12345678<br />
Async event (0x20) timer expired <br />
src 192.168.244.53 dst 192.168.244.52 reqid 0x12345678 protocol esp SPI 0x12345678<br />
Async event (0x20) timer expired <br />
src 192.168.244.53 dst 192.168.244.52 reqid 0x12345678 protocol esp SPI 0x12345678<br />
Async event (0x20) timer expired <br />
src 192.168.244.53 dst 192.168.244.52 reqid 0x12345678 protocol esp SPI 0x12345678<br />
</pre><br />
<br />
=Skript=<br />
<br />
<br />
<br />
*/usr/local/sbin/tunnel.sh<br />
<pre><br />
#!/bin/bashWireshark VPN entschlüsseln<br />
<br />
if [ "$4" == "" ]; then<br />
echo "usage: $0 <local_ip> <remote_ip> <new_local_ip> <new_remote_ip>"<br />
echo "creates an ipsec tunnel between two machines"<br />
exit 1<br />
fi<br />
<br />
SRC="$1"; shift<br />
DST="$1"; shift<br />
LOCAL="$1"; shift<br />
REMOTE="$1"; shift<br />
<br />
KEY1=0x`dd if=/dev/urandom count=32 bs=1 2> /dev/null| xxd -p -c 64`<br />
KEY2=0x`dd if=/dev/urandom count=32 bs=1 2> /dev/null| xxd -p -c 64`<br />
echo KEY1 = $KEY1<br />
echo KEY2 = $KEY2<br />
ID=0x`dd if=/dev/urandom count=4 bs=1 2> /dev/null| xxd -p -c 8`<br />
<br />
echo "spdflush; flush;" | sudo setkey -c<br />
echo ip xfrm state add src $SRC dst $DST proto esp spi $ID reqid $ID mode tunnel auth sha256 $KEY1 enc aes $KEY2<br />
sudo ip xfrm state add src $SRC dst $DST proto esp spi $ID reqid $ID mode tunnel auth sha256 $KEY1 enc aes $KEY2<br />
echo ip xfrm state add src $DST dst $SRC proto esp spi $ID reqid $ID mode tunnel auth sha256 $KEY1 enc aes $KEY2<br />
sudo ip xfrm state add src $DST dst $SRC proto esp spi $ID reqid $ID mode tunnel auth sha256 $KEY1 enc aes $KEY2<br />
echo ip xfrm policy add src $LOCAL dst $REMOTE dir out tmpl src $SRC dst $DST proto esp reqid $ID mode tunnel<br />
sudo ip xfrm policy add src $LOCAL dst $REMOTE dir out tmpl src $SRC dst $DST proto esp reqid $ID mode tunnel<br />
echo ip xfrm policy add src $REMOTE dst $LOCAL dir in tmpl src $DST dst $SRC proto esp reqid $ID mode tunnel<br />
sudo ip xfrm policy add src $REMOTE dst $LOCAL dir in tmpl src $DST dst $SRC proto esp reqid $ID mode tunnel<br />
#echo 5<br />
#sudo ip addr add $LOCAL dev lo<br />
#echo 6<br />
#sudo ip route add $REMOTE dev eth0 src $LOCAL<br />
<br />
<br />
ssh $DST /bin/bash << EOF<br />
echo "spdflush; flush;" | sudo setkey -c<br />
sudo ip xfrm state add src $SRC dst $DST proto esp spi $ID reqid $ID mode tunnel auth sha256 $KEY1 enc aes $KEY2<br />
sudo ip xfrm state add src $DST dst $SRC proto esp spi $ID reqid $ID mode tunnel auth sha256 $KEY1 enc aes $KEY2<br />
sudo ip xfrm policy add src $REMOTE dst $LOCAL dir out tmpl src $DST dst $SRC proto esp reqid $ID mode tunnel<br />
sudo ip xfrm policy add src $LOCAL dst $REMOTE dir in tmpl src $SRC dst $DST proto esp reqid $ID mode tunnel<br />
# sudo ip addr add $REMOTE dev lo<br />
# sudo ip route add $LOCAL dev eth0 src $REMOTE<br />
EOF<br />
</pre><br />
<br />
=Links=<br />
*https://gist.github.com/vishvananda/7094676</div>
Thomas