<div>Hi</div>
<div> </div>
<div>I would suggest you to do one more thing:</div>
<div> </div>
<div>- Remove the "leftfirewall=yes" from the ipsec.conf on both peers (if it is mentioned on remote peer too)</div>
<div> </div>
<div>- Manually add/paste the mentioned iptable rules which is basically simulating a split-tunnel scenario as shown in the attached png file. Also add the forward-chain rules with br-lan interface also, if possible</div>
<div> </div>
<div>- Logically speaking it should get solved with above steps</div>
<div> </div>
<div>But looking at your device config (the interfaces mentioned), i guess the issues may be because:</div>
<div> </div>
<div>- are there VLANs/sub-interfaces/alias-interfaces defined on Eth0?</div>
<div> </div>
<div>- Is there a Physical lan interface on your device? such as eth1 or eth2 (i.e other than eth0 which is i guess the wan interface)</div>
<div> </div>
<div>- why are you bridging the wan interface (eth0.2 or pppoe-wan) with lan (eth0.1). Although it should work, but the ipsec flow gets sometimes disrupted due to routing issues, when everything is bridged together. </div>
<div> </div>
<div>- I would generally keep the wan interface separate/standalone, and instead bridge the lan and wifi interface together (and i do run dhcp-server on the br0 interface to cater to the lan-side ethernet and wifi clients)</div>
<div> </div>
<div>hope this works</div>
<div> </div>
<div>thanks</div>
<div>rajiv</div>
<div> </div>
<div><br><br> </div>
<div class="gmail_quote">On Mon, Oct 3, 2011 at 6:57 PM, Andrea Nottoli <span dir="ltr"><<a href="mailto:andreanottoli@gmail.com">andreanottoli@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">
<div style="WORD-WRAP: break-word">Hi again,
<div>It doesn't works :(</div>
<div>I still can ping router and also manage it trough webGui, but can't reach other machines :(</div>
<div><br></div>
<div>I've edited the suggested rules for adjust to my ifconfig but without success, other ideas?</div>
<div>Sure, the problem is related to nat from ppp/wan to lan and vice-versa.</div>
<div><br></div>
<div>This is my ifconfig</div>
<div>wan interface is eth0.2, wih a pppoe-wan connection over it.</div>
<div>eth0.1 is the lan interface, bridget (br-lan) with eth0.2.</div>
<div><br></div>
<div>so i've edited the rules suggested by Rajiv with eth0.2 instead eth0 (wan) and eth0.1 instead eth2 (lan). Also changed ppp0 with pppoe-wan according to ifconfig (below).</div>
<div><br></div>
<div>Thanks again for your help, hope to finally solve this strange (and abnormal) issue with my ipsec config.</div>
<div><br></div>
<div><br></div>
<div><br></div>
<div>
<div>root@OpenWrt:~# ifconfig</div>
<div>br-lan Link encap:Ethernet HWaddr 74:EA:3A:E4:47:52 </div>
<div> inet addr:192.168.1.254 Bcast:192.168.1.255 Mask:255.255.255.0</div>
<div> inet6 addr: fe80::76ea:3aff:fee4:4752/64 Scope:Link</div>
<div> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1</div>
<div> RX packets:9450776 errors:0 dropped:0 overruns:0 frame:0</div>
<div> TX packets:21936047 errors:0 dropped:0 overruns:0 carrier:0</div>
<div> collisions:0 txqueuelen:0 </div>
<div> RX bytes:1169972374 (1.0 GiB) TX bytes:495910714 (472.9 MiB)</div>
<div><br></div>
<div>eth0 Link encap:Ethernet HWaddr 74:EA:3A:E4:47:52 </div>
<div> inet6 addr: fe80::76ea:3aff:fee4:4752/64 Scope:Link</div>
<div> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1</div>
<div> RX packets:32253959 errors:0 dropped:0 overruns:0 frame:0</div>
<div> TX packets:31904139 errors:0 dropped:0 overruns:0 carrier:0</div>
<div> collisions:0 txqueuelen:1000 </div>
<div> RX bytes:2811514789 (2.6 GiB) TX bytes:1757630697 (1.6 GiB)</div>
<div> Interrupt:4 </div>
<div><br></div>
<div>eth0.1 Link encap:Ethernet HWaddr 74:EA:3A:E4:47:52 </div>
<div> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1</div>
<div> RX packets:9841290 errors:0 dropped:0 overruns:0 frame:0</div>
<div> TX packets:22001555 errors:0 dropped:0 overruns:0 carrier:0</div>
<div> collisions:0 txqueuelen:0 </div>
<div> RX bytes:1856031729 (1.7 GiB) TX bytes:306500736 (292.3 MiB)</div>
<div><br></div>
<div>eth0.2 Link encap:Ethernet HWaddr 74:EA:3A:E4:47:52 </div>
<div> inet6 addr: fe80::76ea:3aff:fee4:4752/64 Scope:Link</div>
<div> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1</div>
<div> RX packets:22412477 errors:0 dropped:0 overruns:0 frame:0</div>
<div> TX packets:9902574 errors:0 dropped:0 overruns:0 carrier:0</div>
<div> collisions:0 txqueuelen:0 </div>
<div> RX bytes:503906886 (480.5 MiB) TX bytes:1451128324 (1.3 GiB)</div>
<div><br></div>
<div>lo Link encap:Local Loopback </div>
<div> inet addr:127.0.0.1 Mask:255.0.0.0</div>
<div> inet6 addr: ::1/128 Scope:Host</div>
<div> UP LOOPBACK RUNNING MTU:16436 Metric:1</div>
<div> RX packets:58 errors:0 dropped:0 overruns:0 frame:0</div>
<div> TX packets:58 errors:0 dropped:0 overruns:0 carrier:0</div>
<div> collisions:0 txqueuelen:0 </div>
<div> RX bytes:5341 (5.2 KiB) TX bytes:5341 (5.2 KiB)</div>
<div><br></div>
<div>mon.wlan0 Link encap:UNSPEC HWaddr 74-EA-3A-E4-47-52-00-00-00-00-00-00-00-00-00-00 </div>
<div> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1</div>
<div> RX packets:55353 errors:0 dropped:0 overruns:0 frame:0</div>
<div> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0</div>
<div> collisions:0 txqueuelen:1000 </div>
<div> RX bytes:8881039 (8.4 MiB) TX bytes:0 (0.0 B)</div>
<div><br></div>
<div>pppoe-wan Link encap:Point-to-Point Protocol </div>
<div> inet addr:79.XX.XX.XXX P-t-P:192.168.100.1 Mask:255.255.255.255</div>
<div> UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1</div>
<div> RX packets:1818589 errors:0 dropped:0 overruns:0 frame:0</div>
<div> TX packets:713853 errors:0 dropped:0 overruns:0 carrier:0</div>
<div> collisions:0 txqueuelen:3 </div>
<div> RX bytes:2430544726 (2.2 GiB) TX bytes:56985105 (54.3 MiB)</div>
<div><br></div>
<div>wlan0 Link encap:Ethernet HWaddr 74:EA:3A:E4:47:52 </div>
<div> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1</div>
<div> RX packets:494648 errors:0 dropped:0 overruns:0 frame:0</div>
<div> TX packets:837753 errors:0 dropped:0 overruns:0 carrier:0</div>
<div> collisions:0 txqueuelen:1000 </div>
<div> RX bytes:72276624 (68.9 MiB) TX bytes:1022316479 (974.9 MiB)</div></div>
<div><br></div>
<div><br></div>
<div><br></div>
<div><br></div>
<div><br></div>
<div><br>
<div>
<div>Il giorno 27/set/2011, alle ore 09:47, Rajiv Kulkarni ha scritto:</div>
<div>
<div></div>
<div class="h5"><br>
<blockquote type="cite">
<div>Hi</div>
<div> </div>
<div>Assuming that you have NAT (MASQUERADE) enabled on wan (say eth0 interface) of your home router (with a pppoe connection to internet) and the LAN interface is identified as eth2, then i would request you to please try out the below iptable rules also:</div>
<div> </div>
<div>iptables -A INPUT -p esp -j ACCEPT<br>iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT<br>iptables -A OUTPUT -p esp -j ACCEPT<br>iptables -A OUTPUT -p udp -m udp --dport 500 -j ACCEPT<br>iptables -t nat -I POSTROUTING 1 -p esp -j ACCEPT<br>
iptables -t nat -I POSTROUTING 2 -s <a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a> -d <a href="http://172.20.0.0/16" target="_blank">172.20.0.0/16</a> -j ACCEPT<br>iptables -I FORWARD 3 -i eth2 -o ppp0 -j ACCEPT<br>
iptables -I FORWARD 4 -i eth2 -o eth0 -j ACCEPT<br>iptables -I FORWARD 5 -i ppp0 -o eth2 -j ACCEPT<br>iptables -I FORWARD 6 -i eth0 -o eth2 -j ACCEPT</div>
<div> </div>
<div>please Note: the rules for the nat table should be added before the MASQUERADE rule, if any. hence the numbers 1 and 2.</div>
<div> </div>
<div>The basic reason i think is that the packets aren't getting forwarded across the wan to lan interfaces and vice-versa, once the ipsec tunnel is up.</div>
<div> </div>
<div>1. you can try only ipsec first by disabling firewall completely</div>
<div>2. next enable the existing firewall rules and ipsec and see where its getting dropped. also try to add some the rules mentioned above. </div>
<div> </div>
<div>i think it should work if 1 above works</div>
<div> </div>
<div>-rajiv</div>
<div><br><br> </div>
<div class="gmail_quote">On Mon, Sep 26, 2011 at 8:08 PM, Andrea Nottoli <span dir="ltr"><<a href="mailto:andreanottoli@gmail.com" target="_blank">andreanottoli@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">Hi everybody and sorry for my really bad english.<br><br>i've a problem with StrongSwan on latest OpenWRT firmware.<br>
I followed the tutorial on the wiki for setting-up a vpn server for connect to my home lan trough my iphone and ipad (so IKEv1 and PureIPSec).<br>I can connect and login (x509 cert) but i cant pin't my lan machine (es. my NAS).<br>
Seems iptables block navigation from wan to lan also during pure ipsec connection.<br><br>OpenWRT router ip: 192.168.1.254<br>Connection to internet: pppoe trough adsl modem<br><br><br>I've opened esp proto, 500 udp, 4500 udp, ah proto and added some policies for forward ipsec traffics but seems that isn't enough (check bottom).<br>
<br><br>Someone can help me? Thanks since now strongswan team!<br><br><br><br><br>This is my ipsec.conf<br><br>config setup<br> strictcrlpolicy=no<br> nat_traversal=yes<br> charonstart=yes<br><br>conn ios<br>
keyexchange=ikev1<br> authby=xauthrsasig<br> xauth=server<br> leftfirewall=yes<br> left=%defaultroute<br> leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> leftcert=serverCert.pem<br>
rightsourceip=192.168.1.25<br> rightsubnet=<a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a><br> right=%any<br> rightcert=clientCert.pem<br> pfs=no<br> auto=add<br><br><br><br>
<br><br>this is my firewall.users (a text file for custom rules loaded during firewall start from OpenWRT):<br><br>/usr/sbin/iptables -I INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT<br>/usr/sbin/iptables -I FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT<br>
/usr/sbin/iptables -I FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT<br>/usr/sbin/iptables -I OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT<br><br><br><br><br>this is my firewall.conf (the base file loaded fro firewall configuration every start, after this openwrt load the firewall.users script):<br>
config 'defaults'<br> option 'syn_flood' '1'<br> option 'input' 'ACCEPT'<br> option 'output' 'ACCEPT'<br> option 'drop_invalid' '1'<br>
option 'forward' 'ACCEPT'<br><br>config 'zone'<br> option 'name' 'lan'<br> option 'network' 'lan'<br> option 'input' 'ACCEPT'<br>
option 'output' 'ACCEPT'<br> option 'forward' 'REJECT'<br><br>config 'zone'<br> option 'name' 'wan'<br> option 'network' 'wan'<br>
option 'output' 'ACCEPT'<br> option 'mtu_fix' '1'<br> option 'masq' '1'<br> option 'input' 'REJECT'<br> option 'forward' 'REJECT'<br>
<br>config 'rule'<br> option 'src' 'wan'<br> option 'proto' 'udp'<br> option 'dest_port' '68'<br> option 'target' 'ACCEPT'<br>
option 'family' 'ipv4'<br><br>config 'rule'<br> option 'src' 'wan'<br> option 'proto' 'icmp'<br> option 'icmp_type' 'echo-request'<br>
option 'target' 'ACCEPT'<br><br>config 'include'<br> option 'path' '/etc/firewall.user'<br><br>config 'forwarding'<br> option 'dest' 'wan'<br>
option 'src' 'lan'<br><br>config 'redirect'<br> option '_name' 'qBittorrent verso nas'<br> option 'src' 'wan'<br> option 'proto' 'tcp'<br>
option 'src_dport' '6881'<br> option 'dest_ip' '192.168.1.1'<br> option 'dest_port' '6881'<br> option 'target' 'DNAT'<br> option 'dest' 'lan'<br>
<br>config 'rule'<br> option 'target' 'ACCEPT'<br> option '_name' 'PPPTP VPN'<br> option 'src' 'wan'<br> option 'proto' 'udp'<br>
option 'dest_port' '1723'<br><br>config 'rule'<br> option 'target' 'ACCEPT'<br> option '_name' 'accetta esp'<br> option 'src' 'wan'<br>
option 'proto' 'esp'<br><br>config 'rule'<br> option 'target' 'ACCEPT'<br> option '_name' 'accetta ike'<br> option 'src' 'wan'<br>
option 'proto' 'udp'<br> option 'dest_port' '500'<br><br>config 'rule'<br> option 'target' 'ACCEPT'<br> option '_name' 'accetta nat-t'<br>
option 'src' 'wan'<br> option 'proto' 'udp'<br> option 'dest_port' '4500'<br><br>config 'rule'<br> option 'target' 'ACCEPT'<br>
option '_name' 'accetta ah'<br> option 'src' 'wan'<br> option 'proto' 'ah'<br>_______________________________________________<br>Users mailing list<br><a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br></blockquote></div><br></blockquote></div></div></div><br></div></div></blockquote></div>
<br>