<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>existing traffic before strong swan</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">I have a question about what happens if traffic is trying to be sent out the interface</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">strongswan uses while the tunnel is being established, will this cause trouble? </FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">I have an issue where some traffic goes through the tunnel, but some does not. </FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">My setup is configured like the example</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">‘</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">nat before esp</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">’</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> My firewall on moon is setup as shown below.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"> </SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">I have iptables on moon setup to d</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">isplay traffic that is dropped, and</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">traffic that is not esp protocol should not be sent out eth0.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> The traffic that is not passed through the tunnel is response traffic to communication initiated from Bob.</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">The communication from</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">Bob makes it to Alice, but when Alice tries to respond</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">, the response packets are blocked when they try to make it out</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">eth0 on moon, so it would appear they are not going through the tunnel.</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> I know the tunnel is established because alice pings bob through the tunnel. </FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">It is also an intermittent problem, because when I reboot moon,</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">sometimes</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">the response packets will go</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> through the tunnel</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">, until I reboot again, and sometimes, some response packets go through the tunnel</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">while others do not.</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">My ipsec.conf on moon is as follows</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">config setup</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">plutodebug=control</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">crlcheckinterval=180</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">strictcrlpolicy=no</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">charonstart=no</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">conn %default</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">ikelifetime=60m</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">keylife=20m</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">rekeymargin=3m</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">keyingtries=1</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">conn host-net</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">left=</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">%defaultroute</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">leftcert=moonCert.pem</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">leftid=@moon.strongswan.org</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">leftfirewall=yes</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">right=192.168</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">.6.1</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">rightsubnet=0.</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">0</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">.0.0/</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">0</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">rightid=@sun.strongswan.org</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">auto=</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">start</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">authyby=rsasig</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">My iptables rules</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> on moon</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri"> are as follows:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<UL DIR=LTR><UL DIR=LTR>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">*nat</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">:PREROUTING ACCEPT [0:0]</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"></FONT></SPAN><SPAN LANG="en-us"> </SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">:POSTROUTING ACCEPT [0:0]</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">:OUTPUT ACCEPT [0:0]</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"># NAT traffic from host</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A POSTROUTING -o eth0 -j MASQUERADE</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">COMMIT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">*filter</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">:INPUT DROP [0:0]</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">:FORWARD DROP [0:0]</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">:OUTPUT DROP [0:0]</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"># Allow local communication.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A INPUT -i lo -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A OUTPUT -o lo -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"># forward traffic from host to POSTROUTING chain</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A FORWARD -i eth1 -o eth0 -s 192.168.99.1 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A FORWARD -o eth1 -i eth0 -d 192.168.99.1 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"># Allow NTP</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A INPUT -i eth1 -p udp --sport 123 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A OUTPUT -o eth1 -p udp --sport 123 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"># Allow DNS </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A INPUT -i eth1 -p udp --sport 53 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A INPUT -i eth1 -p udp --dport 53 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A OUTPUT -o eth1 -p udp --sport 53 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A OUTPUT -o eth1 -p udp --dport 53 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"># Allow icmp traffic</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">#-A FORWARD -i eth1 -p icmp -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">#-A FORWARD -i eth0 -p icmp --icmp-type echo-reply -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"># Allow ssh forwarding</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A INPUT -p tcp --dport 10794 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A OUTPUT -p tcp --sport 10794 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"># allow esp</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A INPUT -i eth0 -p 50 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A OUTPUT -o eth0 -p 50 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"># allow IKE</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"># Log dropped traffic</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A INPUT -j LOG --log-tcp-options --log-ip-options --log-level warning --log-prefix "admin in:"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A FORWARD -j LOG --log-tcp-options --log-ip-options --log-level warning --log-prefix "admin forward:"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-A OUTPUT -j LOG --log-tcp-options --log-ip-options --log-level warning --log-prefix "admin out:"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">COMMIT</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
</UL></UL>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Thanks for the help,</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B></B></SPAN><B><SPAN LANG="en-us"></SPAN></B><B><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">Mark Marwil</FONT></SPAN></B><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><BR>
</SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
</BODY>
</HTML>