<div>Hi</div>
<div> </div>
<div>Assuming that you have NAT (MASQUERADE) enabled on wan (say eth0 interface) of your home router (with a pppoe connection to internet) and the LAN interface is identified as eth2, then i would request you to please try out the below iptable rules also:</div>
<div> </div>
<div>iptables -A INPUT -p esp -j ACCEPT<br>iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT<br>iptables -A OUTPUT -p esp -j ACCEPT<br>iptables -A OUTPUT -p udp -m udp --dport 500 -j ACCEPT<br>iptables -t nat -I POSTROUTING 1 -p esp -j ACCEPT<br>
iptables -t nat -I POSTROUTING 2 -s <a href="http://192.168.1.0/24">192.168.1.0/24</a> -d <a href="http://172.20.0.0/16">172.20.0.0/16</a> -j ACCEPT<br>iptables -I FORWARD 3 -i eth2 -o ppp0 -j ACCEPT<br>iptables -I FORWARD 4 -i eth2 -o eth0 -j ACCEPT<br>
iptables -I FORWARD 5 -i ppp0 -o eth2 -j ACCEPT<br>iptables -I FORWARD 6 -i eth0 -o eth2 -j ACCEPT</div>
<div> </div>
<div>please Note: the rules for the nat table should be added before the MASQUERADE rule, if any. hence the numbers 1 and 2.</div>
<div> </div>
<div>The basic reason i think is that the packets aren't getting forwarded across the wan to lan interfaces and vice-versa, once the ipsec tunnel is up.</div>
<div> </div>
<div>1. you can try only ipsec first by disabling firewall completely</div>
<div>2. next enable the existing firewall rules and ipsec and see where its getting dropped. also try to add some the rules mentioned above. </div>
<div> </div>
<div>i think it should work if 1 above works</div>
<div> </div>
<div>-rajiv</div>
<div><br><br> </div>
<div class="gmail_quote">On Mon, Sep 26, 2011 at 8:08 PM, Andrea Nottoli <span dir="ltr"><<a href="mailto:andreanottoli@gmail.com">andreanottoli@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">Hi everybody and sorry for my really bad english.<br><br>i've a problem with StrongSwan on latest OpenWRT firmware.<br>
I followed the tutorial on the wiki for setting-up a vpn server for connect to my home lan trough my iphone and ipad (so IKEv1 and PureIPSec).<br>I can connect and login (x509 cert) but i cant pin't my lan machine (es. my NAS).<br>
Seems iptables block navigation from wan to lan also during pure ipsec connection.<br><br>OpenWRT router ip: 192.168.1.254<br>Connection to internet: pppoe trough adsl modem<br><br><br>I've opened esp proto, 500 udp, 4500 udp, ah proto and added some policies for forward ipsec traffics but seems that isn't enough (check bottom).<br>
<br><br>Someone can help me? Thanks since now strongswan team!<br><br><br><br><br>This is my ipsec.conf<br><br>config setup<br> strictcrlpolicy=no<br> nat_traversal=yes<br> charonstart=yes<br><br>conn ios<br>
keyexchange=ikev1<br> authby=xauthrsasig<br> xauth=server<br> leftfirewall=yes<br> left=%defaultroute<br> leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> leftcert=serverCert.pem<br>
rightsourceip=192.168.1.25<br> rightsubnet=<a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a><br> right=%any<br> rightcert=clientCert.pem<br> pfs=no<br> auto=add<br><br><br><br>
<br><br>this is my firewall.users (a text file for custom rules loaded during firewall start from OpenWRT):<br><br>/usr/sbin/iptables -I INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT<br>/usr/sbin/iptables -I FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT<br>
/usr/sbin/iptables -I FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT<br>/usr/sbin/iptables -I OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT<br><br><br><br><br>this is my firewall.conf (the base file loaded fro firewall configuration every start, after this openwrt load the firewall.users script):<br>
config 'defaults'<br> option 'syn_flood' '1'<br> option 'input' 'ACCEPT'<br> option 'output' 'ACCEPT'<br> option 'drop_invalid' '1'<br>
option 'forward' 'ACCEPT'<br><br>config 'zone'<br> option 'name' 'lan'<br> option 'network' 'lan'<br> option 'input' 'ACCEPT'<br>
option 'output' 'ACCEPT'<br> option 'forward' 'REJECT'<br><br>config 'zone'<br> option 'name' 'wan'<br> option 'network' 'wan'<br>
option 'output' 'ACCEPT'<br> option 'mtu_fix' '1'<br> option 'masq' '1'<br> option 'input' 'REJECT'<br> option 'forward' 'REJECT'<br>
<br>config 'rule'<br> option 'src' 'wan'<br> option 'proto' 'udp'<br> option 'dest_port' '68'<br> option 'target' 'ACCEPT'<br>
option 'family' 'ipv4'<br><br>config 'rule'<br> option 'src' 'wan'<br> option 'proto' 'icmp'<br> option 'icmp_type' 'echo-request'<br>
option 'target' 'ACCEPT'<br><br>config 'include'<br> option 'path' '/etc/firewall.user'<br><br>config 'forwarding'<br> option 'dest' 'wan'<br>
option 'src' 'lan'<br><br>config 'redirect'<br> option '_name' 'qBittorrent verso nas'<br> option 'src' 'wan'<br> option 'proto' 'tcp'<br>
option 'src_dport' '6881'<br> option 'dest_ip' '192.168.1.1'<br> option 'dest_port' '6881'<br> option 'target' 'DNAT'<br> option 'dest' 'lan'<br>
<br>config 'rule'<br> option 'target' 'ACCEPT'<br> option '_name' 'PPPTP VPN'<br> option 'src' 'wan'<br> option 'proto' 'udp'<br>
option 'dest_port' '1723'<br><br>config 'rule'<br> option 'target' 'ACCEPT'<br> option '_name' 'accetta esp'<br> option 'src' 'wan'<br>
option 'proto' 'esp'<br><br>config 'rule'<br> option 'target' 'ACCEPT'<br> option '_name' 'accetta ike'<br> option 'src' 'wan'<br>
option 'proto' 'udp'<br> option 'dest_port' '500'<br><br>config 'rule'<br> option 'target' 'ACCEPT'<br> option '_name' 'accetta nat-t'<br>
option 'src' 'wan'<br> option 'proto' 'udp'<br> option 'dest_port' '4500'<br><br>config 'rule'<br> option 'target' 'ACCEPT'<br>
option '_name' 'accetta ah'<br> option 'src' 'wan'<br> option 'proto' 'ah'<br>_______________________________________________<br>Users mailing list<br><a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br></blockquote></div><br>