VPN - [решено] 3 маршрутизатора D-Link DI-804HV

[hosco]

Telepuzik, да пробовал конечно, первое что делаю. Старый дедовский способ - если что-то не работает, первым делом ребутни

[hosco]

Telepuzik, попробую. А при организации нескольких туннелей на одном устройстве не нужно дополнительно порт открывать, или ещё что-нибудь включить?

Вот эта строчка в логе меня смущает:

Thursday May 17, 2012 14:26:07 Disassociated: Blocked access attempt from 94.21.154.10:49093 to UDP port 23518

Рабочий туннель отвалился сразу после добавления нового, может новый занял место предыдущего? Его порт?

[hosco]

Вот новый лог, после удаления и создания заново:

Thursday May 17, 2012 16:10:55 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:10:56 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:10:57 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:01 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:02 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:02 Send IKE (INFO) : delete [192.168.0.0|91.204.178.84]-->[91.197.78.146|192.168.3.0] phase 2

Thursday May 17, 2012 16:11:02 IKE phase2 (IPSec SA) remove : 192.168.0.0 192.168.3.0

Thursday May 17, 2012 16:11:02 inbound SPI = 0x4e05a46e, outbound SPI = 0x0

Thursday May 17, 2012 16:11:02 Send IKE Q1(QINIT) : 192.168.0.0 --> 192.168.3.0

Thursday May 17, 2012 16:11:03 Send IKE (INFO) : delete [192.168.0.0|91.204.178.84]-->[91.197.78.146|192.168.3.0] phase 2

Thursday May 17, 2012 16:11:03 IKE phase2 (IPSec SA) remove : 192.168.0.0 192.168.3.0

Thursday May 17, 2012 16:11:03 inbound SPI = 0x4f0544be, outbound SPI = 0x0

Thursday May 17, 2012 16:11:04 Send IKE Q1(QINIT) : 192.168.0.0 --> 192.168.3.0

Thursday May 17, 2012 16:11:05 Receive IKE INFO : 91.197.78.146 --> 91.204.178.84

Thursday May 17, 2012 16:11:06 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:07 Send IKE (INFO) : delete [192.168.0.0|91.204.178.84]-->[91.197.78.146|192.168.3.0] phase 2

Thursday May 17, 2012 16:11:07 IKE phase2 (IPSec SA) remove : 192.168.0.0 192.168.3.0

Thursday May 17, 2012 16:11:07 inbound SPI = 0x5005070e, outbound SPI = 0x0

Thursday May 17, 2012 16:11:07 Send IKE Q1(QINIT) : 192.168.0.0 --> 192.168.3.0

Thursday May 17, 2012 16:11:07 Receive IKE INFO : 91.197.78.146 --> 91.204.178.84

Thursday May 17, 2012 16:11:07 Receive IKE INFO : 91.197.78.146 --> 91.204.178.84

Thursday May 17, 2012 16:11:08 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:09 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:09 Receive IKE INFO : 91.197.78.146 --> 91.204.178.84

Thursday May 17, 2012 16:11:10 Receive IKE INFO : 91.197.78.146 --> 91.204.178.84

Thursday May 17, 2012 16:11:11 Receive IKE INFO : 91.197.78.146 --> 91.204.178.84

Thursday May 17, 2012 16:11:12 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:13 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:14 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:16 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:17 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:17 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:17 Send IKE (INFO) : delete [192.168.0.0|91.204.178.84]-->[91.197.78.146|192.168.3.0] phase 2

Thursday May 17, 2012 16:11:17 IKE phase2 (IPSec SA) remove : 192.168.0.0 192.168.3.0

Thursday May 17, 2012 16:11:17 inbound SPI = 0x51052e5e, outbound SPI = 0x0

Thursday May 17, 2012 16:11:17 Send IKE Q1(QINIT) : 192.168.0.0 --> 192.168.3.0

Thursday May 17, 2012 16:11:18 IKED re-TX : QINIT to 91.197.78.146

Thursday May 17, 2012 16:11:18 Send IKE (INFO) : delete [192.168.0.0|91.204.178.84]-->[91.197.78.146|192.168.3.0] phase 2

Thursday May 17, 2012 16:11:18 IKE phase2 (IPSec SA) remove : 192.168.0.0 192.168.3.0

Thursday May 17, 2012 16:11:18 inbound SPI = 0x52055fae, outbound SPI = 0x0

Вот такое ещё:

Thursday May 17, 2012 13:47:28 IKED re-TX : INIT to 91.197.78.146

Thursday May 17, 2012 13:47:29 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:30 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:30 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:31 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:32 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:34 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:35 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:36 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:38 IKED re-TX : INIT to 91.197.78.146

Thursday May 17, 2012 13:47:40 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:42 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:44 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:45 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:46 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:50 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:52 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:54 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:55 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

Thursday May 17, 2012 13:47:56 Error : 91.197.78.146 -> 91.204.178.84 QM must after P1 and MsgID!=0

[hosco]

А вот этим заполнячется лог, когда пытаюсь пинговать компьютер в локальной сети за роутером:



Thursday May 17, 2012 18:45:28 IPSec tunnel keep alive : peer IP 192.168.0.254

Thursday May 17, 2012 18:45:28 [192.168.3.0|91.197.78.146]-->[91.204.178.84|192.168.0.0]

Thursday May 17, 2012 18:45:35 Disassociated: Blocked access attempt from 62.63.87.46:37570 to UDP port 31446

Thursday May 17, 2012 18:45:35 Disassociated: Blocked access attempt from 213.79.119.202:23836 to UDP port 31446

Thursday May 17, 2012 18:45:36 IPSec tunnel keep alive : peer IP 192.168.0.254

Thursday May 17, 2012 18:45:36 [192.168.3.0|91.197.78.146]-->[91.204.178.84|192.168.0.0]

Thursday May 17, 2012 18:45:36 Disassociated: Blocked access attempt from 91.204.176.17:64420 to UDP port 31446

Thursday May 17, 2012 18:45:36 Disassociated: Blocked access attempt from 109.62.140.237:14872 to UDP port 31446

Thursday May 17, 2012 18:45:37 Disassociated: Blocked access attempt from 62.63.87.46:37570 to UDP port 31446

Thursday May 17, 2012 18:45:37 Disassociated: Blocked access attempt from 213.79.119.202:23836 to UDP port 31446

Thursday May 17, 2012 18:45:39 Disassociated: Blocked access attempt from 91.204.176.17:64420 to UDP port 31446

Thursday May 17, 2012 18:45:39 Disassociated: Blocked access attempt from 109.62.140.237:14872 to UDP port 31446

Thursday May 17, 2012 18:45:40 Disassociated: Blocked access attempt from 109.62.189.253:9282 to UDP port 31446

Thursday May 17, 2012 18:45:41 Disassociated: Blocked access attempt from 62.63.87.46:37570 to UDP port 31446

Thursday May 17, 2012 18:45:41 Disassociated: Blocked access attempt from 213.79.119.202:23836 to UDP port 31446

Thursday May 17, 2012 18:45:43 Disassociated: Blocked access attempt from 109.62.140.237:14872 to UDP port 31446

Thursday May 17, 2012 18:45:43 Disassociated: Blocked access attempt from 109.62.189.253:9282 to UDP port 31446

Thursday May 17, 2012 18:45:44 Disassociated: Blocked access attempt from 91.204.176.17:64420 to UDP port 31446

Thursday May 17, 2012 18:45:48 Disassociated: Blocked access attempt from 109.62.189.253:9282 to UDP port 31446

[hosco]

Выяснил причину. На всех роутерах прошивка 1.53RU, но на двух от 28 апреля, на остальных от 30 апреля. Сразу и не увидишь такую мелочь. Странная фигня, на FTP лежит как раз от 28 апреля, где теперь искать от 30-го?

[hosco]

Здравствуйте! Настроил тоже два туннеля, все работает. Но один раз в сутки рвется именно 2 туннель. Причем я их менял местами в центральном роутере. Рвется все равно тот, что стоит в ID вторым. В настройках IKE как раз время 86400, что соответствует 24 часам. Я так понимаю в это время происходит пере регистрация туннелей. Но первый же восстанавливается, второй же нужно пере запускать вручную войдя в VPN статус и нажав сначала DROP потом reconnect.



Кстати у автора в настройках IKE livetime меньше чем в настройках ipsec, а в пособии на DLink наоборот.