<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.19019">
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2 face="MS Sans Serif">Greetings everyone,</FONT></DIV>
<DIV><FONT face="MS Sans Serif"></FONT> </DIV>
<DIV><FONT face="MS Sans Serif">Back in Dec 2009 Johannes RuBek wrote:
</FONT></DIV>
<DIV><FONT face="Courier New"></FONT> </DIV>
<DIV><FONT face="Courier New">>Hello Guys,<BR>>I've nailed the problem
down to our second "wan" interface.<BR>>We have two interfaces connected to
the internet and therefore two<BR>>default routes.<BR>>eth4 which is
connected via SDSL and ppp0 which is connected to ADSL.<BR>>eth4 is the
default route, ppp0 adds a default route to table 210, which<BR>>is used for
policy routes based on firewall marks.<BR>>the ip on eth4 is what we have in
left=.<BR>>If i take down ppp0, strongswan installs source routes as
expected.<BR>>If ppp0 is there, strongswan gets the "Network is unreachable"
error.<BR>>I think strongswan might be confused by the two default gateways
here..<BR>>Is it possible that strongswan uses the wrong gateway as nexthop
on the<BR>>right interface?<BR>>Do you have any suggestions for a case
like that?<BR></DIV></FONT>
<DIV><FONT face="MS Sans Serif"></FONT> </DIV>
<DIV><FONT face="MS Sans Serif">Two years later I am facing the exact same
problem on Ubuntu 10.10 with Strongswan 4.5.1. Where do I go to report bug
in Strongswan?</FONT></DIV>
<DIV><FONT size=2 face="MS Sans Serif"></FONT> </DIV>
<DIV><FONT face="MS Sans Serif">Overview of the setup:</FONT></DIV>
<UL>
<LI><FONT size=2 face="MS Sans Serif">Tunnel is between 192.168.1.0 and
192.168.2.0 subnets. Tunnel can only pass traffic one way, from 192.168.1.0 to
2.0 but not the other way around.</FONT></LI>
<LI><FONT face="MS Sans Serif">192.168.2.1 is the end with problem. It
has two WAN interfaces (call them 2.2.2.2 and 6.6.6.6). So ip route list
table main shows two default routes. Also ip route list table 220 is
empty.</FONT></LI>
<LI><FONT face="MS Sans Serif">When charon tries to setup the route, it calls
get_nexthop() for 2.2.2.2. The function returns gw of 6.6.6.6 instead of
gateway for 2.2.2.2.</FONT></LI>
<LI><FONT face="MS Sans Serif">Following that charon complains "received
netlink error: no such process" and "unable to install source route for
192.168.2.1".</FONT></LI>
<LI><FONT face="MS Sans Serif">If I use "ip route del" to remove default
routes involving the second WAN interface, charon can install the route
successfully and the tunnel passes traffic both ways.</FONT></LI>
<LI><FONT face="MS Sans Serif">A minor detail: the route "default via 6.6.6.x
dev eth2" appears twice, one in main table and another in a user table. I have
to delete both of them.</FONT></LI></UL>
<DIV><FONT face="MS Sans Serif">Below are the specifics and syslog.</FONT></DIV>
<DIV><FONT face="MS Sans Serif"></FONT> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">syslog<BR>==========<BR>charon: 05[KNL]
getting a local address in traffic selector 192.168.2.0/24<BR>charon: 05[KNL]
using host 192.168.2.1<BR>charon: 05[KNL] getting address to reach
1.1.1.1<BR>charon: 05[KNL] getting interface name for 2.2.2.2<BR>charon: 05[KNL]
2.2.2.2 is on interface eth1<BR>charon: 05[KNL] installing route: 192.168.1.0/24
via 6.6.6.254 src 192.168.2.1 dev eth1<BR>charon: 05[KNL] getting iface index
for eth1<BR>charon: 05[KNL] received netlink error: No such process
(3)<BR>charon: 05[KNL] unable to install source route for
192.168.2.1</FONT></DIV>
<DIV><FONT size=2 face="MS Sans Serif"></FONT> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">ipsec.conf<BR>===========<BR>config
setup<BR> plutostart=no</FONT></DIV>
<DIV><FONT size=2 face="MS Sans Serif"></FONT> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">conn
%default<BR>
mobike=no<BR>
keyexchange=ikev2<BR>
authby=secret<BR>
type=tunnel<BR>
leftsubnet=192.168.2.0/24<BR>
left=2.2.2.2</FONT></DIV>
<DIV><FONT size=2 face="MS Sans Serif"></FONT> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">conn
net2net<BR>
right=1.1.1.1<BR>
rightsubnet=192.168.1.0/24<BR>
auto=route</FONT></DIV>
<DIV><FONT size=2 face="MS Sans Serif"></FONT> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">interfaces<BR>===========<BR># The
primary network interface<BR>auto eth1<BR>iface eth1 inet
static<BR> address
2.2.2.2<BR> netmask
255.255.255.248<BR> broadcast
2.2.2.7<BR> metric
90<BR> gateway 2.2.2.1</FONT></DIV>
<DIV><FONT size=2 face="MS Sans Serif"></FONT> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">auto eth1:1<BR>iface eth1:1 inet
static<BR> address
2.2.2.3<BR> netmask
255.255.255.248<BR> broadcast
2.2.2.7</FONT></DIV>
<DIV><FONT size=2 face="MS Sans Serif"></FONT> </DIV>
<DIV><FONT size=2 face="MS Sans Serif"># LAN interface<BR>auto eth0<BR>iface
eth0 inet static<BR> address
192.168.2.1<BR> netmask
255.255.255.0<BR> broadcast
192.168.2.255</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif"># Extra interface 1<BR>auto eth2<BR>iface
eth2 inet dhcp</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">ip route list table 220 is
empty<BR>================================<BR>(expecting: 192.168.1.0/24 via
2.2.2.1 dev eth1 proto static src 192.168.2.1)</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="MS Sans Serif">ip route list table
main<BR>========================<BR>2.2.2.0/29 dev eth1 proto kernel
scope link src 2.2.2.2<BR>192.168.2.0/24 dev eth0 proto kernel
scope link src 192.168.2.1<BR>6.6.6.0/22 dev eth2 proto kernel
scope link src 6.6.6.6<BR>default via 2.2.2.1 dev eth1 metric
90<BR>default via 6.6.6.254 dev eth2 metric 100</FONT></DIV>
<DIV> </DIV><FONT size=2 face="MS Sans Serif">
<DIV><BR>extra info: there is another pair of default routes<BR>involving the
two wan ports<BR>-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-</DIV>
<DIV> </DIV>
<DIV>ip rule list<BR>=============<BR>0: from all
lookup local<BR>220: from all lookup 220<BR>10101: from
2.2.2.0/29 lookup wan1<BR>10102: from 6.6.6.0/22 lookup
wan2<BR>32766: from all lookup main<BR>32767: from all lookup
default</DIV>
<DIV> </DIV>
<DIV>ip route list table wan1<BR>========================<BR>default via 2.2.2.1
dev eth1</DIV>
<DIV> </DIV>
<DIV>ip route list table wan2<BR>========================<BR>default via
6.6.6.254 dev eth2</FONT></DIV>
<DIV><FONT face="MS Sans Serif"></FONT> </DIV>
<DIV><FONT size=2 face="MS Sans Serif"></FONT> </DIV></BODY></HTML>