<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><font face="Calibri" size="3">Hi,</font><div style="font-family: Calibri; font-size: 12pt; "><br></div><div style="font-family: Calibri; font-size: 12pt; ">I'm using StrongSwan on my OpenWRT based router to setup a VPN for my roadwarrior iOS 5 using XAUTH with PSK.</div><div style="font-family: Calibri; font-size: 12pt; "><br></div><div style="font-family: Calibri; font-size: 12pt; ">My setup is like this:</div><div style="font-family: Calibri; font-size: 12pt; "><br></div><div style="font-family: Calibri; font-size: 12pt; ">My internal network:</div><div style="font-family: Calibri; font-size: 12pt; "><br></div><div style="font-family: Calibri; font-size: 12pt; ">Network and range 172.16.67.96/255.255.255.224 (172.16.67.96 - 172.16.67.126)</div><div style="font-family: Calibri; font-size: 12pt; ">Gateway 172.16.67.97</div><div style="font-family: Calibri; font-size: 12pt; ">DNS 172.16.67.97</div><div style="font-family: Calibri; font-size: 12pt; "><br></div><div style="font-family: Calibri; font-size: 12pt; ">My OpenWRT is the gateway with IP address 172.16.67.97 and it obtains an external IP address assigned by my ISP. I'm using dyndns to get a proper name for the external IP.</div><div style="font-family: Calibri; font-size: 12pt; "><br></div><div style="font-family: Calibri; font-size: 12pt; ">And my virtual IP range for roadwarrior is</div><div style="font-family: Calibri; font-size: 12pt; "><br></div><div style="font-family: Calibri; font-size: 12pt; ">Network and range 172.16.67.128/255.255.255.224 (172.16.67.129 - 172.16.67.158)
</div><div style="font-family: Calibri; font-size: 12pt; ">DNS 172.16.67.97</div><div style="font-family: Calibri; font-size: 12pt; "><br></div><div style="font-family: Calibri; font-size: 12pt; ">My current ipsec.conf looks like this:</div><div style="font-family: Calibri; font-size: 12pt; "><br></div><div><div><font face="Calibri"># /etc/ipsec.conf - strongSwan IPsec configuration file</font></div><div><font face="Calibri"><br></font></div><div><font face="Calibri">config setup</font></div><div><br></div><div><font face="Calibri">conn ios</font></div><div><span style="font-family: Calibri; "> type=tunnel</span></div><div><font face="Calibri"> keyexchange=ikev1</font></div><div><font face="Calibri"> authby=xauthpsk</font></div><div><font face="Calibri"> xauth=server</font></div><div><font face="Calibri"> left=%defaultroute</font></div><div><span style="font-family: Calibri; "> leftsourceip=172.16.67.129</span></div><div><font face="Calibri"> leftsubnet=0.0.0.0/0</font></div><div><font face="Calibri"> leftfirewall=yes</font></div><div><span style="font-family: Calibri; "> right=%any</span></div><div><span style="font-family: Calibri; "> rightsourceip=172.16.67.130/27</span></div><div><span style="font-family: Calibri; "> auto=add</span></div></div><div><span style="font-family: Calibri; "><br></span></div><div><span style="font-family: Calibri; ">My strongswan.conf looks like this:</span></div><div><span style="font-family: Calibri; "><br></span></div><div><div><font face="Calibri"># /etc/strongswan.conf - strongSwan configuration file</font></div><div><font face="Calibri"><br></font></div><div><font face="Calibri">charon {</font></div><div><font face="Calibri"> dns1 = 172.16.67.97</font></div><div><font face="Calibri">}</font></div><div><font face="Calibri"><br></font></div><div><font face="Calibri">My ipsec.secrets file is setup properly. I could establish the VPN, a virtual IP address of 172.16.67.131. When I try to ping from my OpenWRT router or any internal LAN machine to the IP 172.16.67.131, it works.</font></div><div><font face="Calibri"><br></font></div><div><font face="Calibri">I also have a SSH client in my iPhone, when I try to SSH to the internal LAN (with both IP and DNS name), it failed. Seems like traffic can go from my internal LAN to the iPhone but not vice versa. So it is not a problem with the DNS. I think its either routing or firewall.</font></div><div><font face="Calibri"><br></font></div><div><font face="Calibri">Checked my firewall configuration using iptables -L FORWARDING, I do see 2 rules being added after the tunnel is established, allowing incoming 172.16.67.131 to any and allowing any from internal LAN to 172.16.67.131.</font></div></div><div><font face="Calibri"><br></font></div><div><font face="Calibri">Anyone knows what have I setup wrong?</font></div> </div></body>
</html>