Page MenuHomeVyOS Platform

DMVPN opennhrp spokes dont work behind NAT
Closed, ResolvedPublicBUG


We find an issue with DMVPN when NAT is used
After first boot somehow a spoke with global address can connect to the spoke behind NAT with encrypted traffic.
When spokes don't communicate with each other the connection "disconnecting" (child SA's deleted) after some timeout and connection should be established (IPSec) when spokes again communicate with each other.
On this step IPSec connection can't be established with the host behind NAT and traffic passed unencrypted via clear gre tunnels.

We ran tests with @zsdc and found that issue with opennhrp-script

This is solution fixes this bug

--- opennhrp-script.origin	2022-04-07 14:04:28.104709038 +0300
+++ opennhrp-script.patched	2022-04-07 14:50:00.108961890 +0300
@@ -28,9 +28,12 @@
 	logger -t ${_script_name} -p local7.notice "Create link from $NHRP_SRCADDR ($NHRP_SRCNBMA) to $NHRP_DESTADDR ($NHRP_DESTNBMA)"
 	if [[ ( ${_type} == "spoke" ) && ( -e ${_strongswan_pid} ) ]]; then
 		if grep "${NHRP_SRCADDR}" "${_nhrp_ipsec}"; then
-			swanctl -t -S $NHRP_SRCNBMA -R $NHRP_DESTNBMA > /dev/null 2>&1
-			logger -t ${_script_name} -p local7.notice "IPSec: connect to $NHRP_SRCADDR ($NHRP_SRCNBMA)"
-			swanctl -i -c dmvpn -S $NHRP_SRCNBMA -R $NHRP_DESTNBMA || exit 1
+			if swanctl -l -r | grep -q "^list-sa event {dmvpn-DMVPN-.* state=ESTABLISHED local-host=$NHRP_SRCNBMA.*remote-host=$NHRP_DESTNBMA"; then
+				logger -t ${_script_name} -p local7.notice "IPSec: connection to $NHRP_DESTADDR ($NHRP_DESTNBMA) already exists"
+			else
+				logger -t ${_script_name} -p local7.notice "IPSec: connect to $NHRP_DESTADDR ($NHRP_DESTNBMA)"
+				swanctl -i -c dmvpn -S $NHRP_SRCNBMA -R $NHRP_DESTNBMA || exit 1
+			fi


Difficulty level
Easy (less than an hour)
VyOS 1.3.1-S1
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Related Objects

Mentioned In

Event Timeline

Script for testing which fix some bugs with DMVPN

Is the fix for DMVPN hub or spoke?

In T4350#123620, @c-po wrote:

Is the fix for DMVPN hub or spoke?

As I remember it is for spokes

c-po changed the task status from Open to Needs testing.May 20 2022, 7:57 PM
c-po claimed this task.
c-po triaged this task as Normal priority.
c-po moved this task from In Progress to Finished on the VyOS 1.3 Equuleus (1.3.2) board.
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.Sep 5 2022, 11:07 AM
dmbaturin changed Issue type from Unspecified (please specify) to Bug (incorrect behavior).