<HTML><HEAD></HEAD>
<BODY dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-FAMILY: 'Tahoma'; COLOR: #000000; FONT-SIZE: 10pt">
<DIV>Hey at all,</DIV>
<DIV> </DIV>
<DIV>I have some problems regarding strongswan. Maybe I get some help
here.</DIV>
<DIV> </DIV>
<DIV>I installed strongswan on a test-environment and all works great. After
that I moved strongswan to a different server (production server) and now there
are some problems.</DIV>
<DIV>I can still establish the vpn-tunnel, that works without any problems. But
I cannot ping the local hosts from any remote hosts and vica versa.</DIV>
<DIV> </DIV>
<DIV>I have to say that the production server is an internet-gateway at the same
time. This internet-gateway has the following interfaces:</DIV>
<DIV> </DIV>
<DIV>eth0 - network card for local-network (static ip: 10.0.1.1)</DIV>
<DIV>eth1 - network card for internet (ip is dynamically assigned by isp)</DIV>
<DIV> </DIV>
<DIV>local-network: 10.0.0.0/255.255.0.0, different notation 10.0.0.0/16</DIV>
<DIV> </DIV>
<DIV>Strongswan is configured (see ipsec.conf below) to assign ip's from the
following range: 10.0.4.0/255.255.255.0, different notation 10.0.4.0/24</DIV>
<DIV> </DIV>
<DIV>I use iptables for the firewall on this internet-gateway. The default
policy is to drop all packets. See the rules below of iptables.</DIV>
<DIV> </DIV>
<DIV>As I can see of "ipsec statusall", pings from remote-hosts to 10.0.1.1
increase the number of received bytes.</DIV>
<DIV>As I can also see of "ipsec statusall", pings from local-hosts to a
vpn-client (e.g. 10.0.4.1) increase the number of sent bytes.</DIV>
<DIV>But for any reason the particular counter-direction is not working. So the
ping does not work.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Any ideas what's going wrong here?</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Thanks in advance!</DIV>
<DIV> </DIV>
<DIV>Alex</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Finally some excerpts from my logs:</DIV>
<DIV> </DIV>
<DIV>-----------------------------------------------------</DIV>
<DIV>cat /proc/sys/net/ipv4/ip_forward</DIV>
<DIV>1</DIV>
<DIV>-----------------------------------------------------</DIV>
<DIV> </DIV>
<DIV>-----------------------------------------------------</DIV>
<DIV>In strongswan.conf I configured strongswan to only listen on
eth0-interface.</DIV>
<DIV> </DIV>
<DIV>charon {</DIV>
<DIV> interfaces_use = eth0</DIV>
<DIV>}</DIV>
<DIV> </DIV>
<DIV>The command "ipsec statusall" states that strongswan that this paremeter is
applied.</DIV>
<DIV> </DIV>
<DIV>Listening IP addresses:</DIV>
<DIV> 10.0.1.1</DIV>
<DIV>-----------------------------------------------------</DIV>
<DIV> </DIV>
<DIV>-----------------------------------------------------</DIV>
<DIV># iptables rules</DIV>
<DIV> </DIV>
<DIV># constants</DIV>
<DIV>LAN_INTERFACE=eth0</DIV>
<DIV>WAN_INTERFACE=eth1</DIV>
<DIV>VPN_IP=10.0.1.1</DIV>
<DIV> </DIV>
<DIV># setting standard-policies</DIV>
<DIV>iptables --table filter --policy INPUT DROP</DIV>
<DIV>iptables --table filter --policy FORWARD DROP</DIV>
<DIV>iptables --table filter --policy OUTPUT DROP</DIV>
<DIV> </DIV>
<DIV># destination nat for vpn-traffic</DIV>
<DIV>iptables --append PREROUTING --table nat --in-interface ${WAN_INTERFACE}
--protocol udp --dport 500 --jump DNAT --to-destination ${VPN_IP}:500</DIV>
<DIV>iptables --append PREROUTING --table nat --in-interface ${WAN_INTERFACE}
--protocol udp --dport 4500 --jump DNAT --to-destination ${VPN_IP}:4500</DIV>
<DIV> </DIV>
<DIV># allow vpn-traffic for local-machine</DIV>
<DIV>iptables --append INPUT --table filter --in-interface ${WAN_INTERFACE}
--protocol udp --destination-port 500 --jump ACCEPT</DIV>
<DIV>iptables --append INPUT --table filter --in-interface ${WAN_INTERFACE}
--protocol udp --destination-port 4500 --jump ACCEPT</DIV>
<DIV> </DIV>
<DIV># allow all traffic to/from lan-interface for local machine</DIV>
<DIV>iptables --append INPUT --table filter --in-interface ${LAN_INTERFACE}
--jump ACCEPT</DIV>
<DIV>iptables --append OUTPUT --table filter --out-interface ${LAN_INTERFACE}
--jump ACCEPT</DIV>
<DIV> </DIV>
<DIV># allow all outgoing traffic from lan-interface to wan-interface</DIV>
<DIV>iptables --append FORWARD --table filter --in-interface ${LAN_INTERFACE}
--out-interface ${WAN_INTERFACE} --match state --state NEW,ESTABLISHED,RELATED
--jump ACCEPT</DIV>
<DIV> </DIV>
<DIV># allow all incoming traffic from wan-interface to lan-interface that is
already is established from inside</DIV>
<DIV>iptables --append FORWARD --table filter --in-interface ${WAN_INTERFACE}
--out-interface ${LAN_INTERFACE} --match state --state ESTABLISHED,RELATED
--jump ACCEPT</DIV>
<DIV> </DIV>
<DIV># do network-address-translation (nat) to hide private addresses on public
internet</DIV>
<DIV>iptables --append POSTROUTING --table nat --out-interface ${WAN_INTERFACE}
--jump MASQUERADE</DIV>
<DIV>-----------------------------------------------------</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>-----------------------------------------------------</DIV>
<DIV>#ipsec.conf</DIV>
<DIV>conn %default</DIV>
<DIV> keyexchange=ikev2</DIV>
<DIV> ike=aes256-sha1-modp1024!</DIV>
<DIV> esp=aes256-sha1!</DIV>
<DIV> dpdaction=clear</DIV>
<DIV> dpddelay=300s</DIV>
<DIV> rekey=no</DIV>
<DIV> </DIV>
<DIV>conn vpn</DIV>
<DIV> left=%any</DIV>
<DIV> leftsubnet=0.0.0.0/0</DIV>
<DIV> leftauth=pubkey</DIV>
<DIV> leftcert=certificate.pem</DIV>
<DIV> right=%any</DIV>
<DIV> rightsourceip=10.0.4.0/24</DIV>
<DIV> rightdns=10.0.1.1</DIV>
<DIV> rightauth=eap-mschapv2</DIV>
<DIV> rightsendcert=never</DIV>
<DIV> eap_identity=%any</DIV>
<DIV> auto=add</DIV>
<DIV>-----------------------------------------------------</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>-----------------------------------------------------</DIV>
<DIV>#ip xfrm policy</DIV>
<DIV>src 10.0.4.1/32 dst 0.0.0.0/0</DIV>
<DIV> dir fwd priority 1923 ptype
main</DIV>
<DIV> tmpl src 77.4.129.61 dst
10.0.1.1</DIV>
<DIV>
proto esp reqid 4 mode tunnel</DIV>
<DIV>src 10.0.4.1/32 dst 0.0.0.0/0</DIV>
<DIV> dir in priority 1923 ptype
main</DIV>
<DIV> tmpl src 77.4.129.61 dst
10.0.1.1</DIV>
<DIV>
proto esp reqid 4 mode tunnel</DIV>
<DIV>src 0.0.0.0/0 dst 10.0.4.1/32</DIV>
<DIV> dir out priority 1923 ptype
main</DIV>
<DIV> tmpl src 10.0.1.1 dst
77.4.129.61</DIV>
<DIV>
proto esp reqid 4 mode tunnel</DIV>
<DIV>src 0.0.0.0/0 dst 0.0.0.0/0</DIV>
<DIV> dir 3 priority 0 ptype
main</DIV>
<DIV>src 0.0.0.0/0 dst 0.0.0.0/0</DIV>
<DIV> dir 4 priority 0 ptype
main</DIV>
<DIV>src 0.0.0.0/0 dst 0.0.0.0/0</DIV>
<DIV> dir 3 priority 0 ptype
main</DIV>
<DIV>src 0.0.0.0/0 dst 0.0.0.0/0</DIV>
<DIV> dir 4 priority 0 ptype
main</DIV>
<DIV>src ::/0 dst ::/0</DIV>
<DIV> dir 3 priority 0 ptype
main</DIV>
<DIV>src ::/0 dst ::/0</DIV>
<DIV> dir 4 priority 0 ptype
main</DIV>
<DIV>src ::/0 dst ::/0</DIV>
<DIV> dir 3 priority 0 ptype
main</DIV>
<DIV>src ::/0 dst ::/0</DIV>
<DIV> dir 4 priority 0 ptype
main</DIV>
<DIV>-----------------------------------------------------</DIV></DIV></DIV></BODY></HTML>