<div dir="ltr"><div>Hello:</div><div><br></div><div>I have just set up a vpn tunnel site-to-site with strongswan (4.5). The tunnel looks fine and connected to the other side, but seems there is a problem routing traffic through the tunnel.</div>
<div><br></div><div>Any idea?</div><div><br></div><div>Thanks!</div><div><br></div><div>Network diagram</div><div>===============</div><div><br></div><div><a href="http://pastebin.com/N8RGJady">http://pastebin.com/N8RGJady</a><br>
</div><div><br></div><div>Software</div><div>========</div><div>* debian wheezy</div><div>* strongswan 4.5.2-1.5+deb7u1</div><div><br></div><div>/etc/ipsec.conf</div><div>===============</div><div>root@starfleet ~ # cat /etc/ipsec.conf</div>
<div># ipsec.conf - strongSwan IPsec configuration file</div><div><br></div><div># basic configuration</div><div><br></div><div>config setup</div><div> plutodebug="all"</div><div> plutostderrlog=/var/log/pluto-ipsec</div>
<div>charonstart=no</div><div>plutostart=yes</div><div><br></div><div>conn net-net</div><div> ikelifetime=86400s</div><div> keylife=3600s</div><div> rekeymargin=3m</div><div> keyingtries=1</div><div> keyexchange=ikev1</div>
<div> authby=secret</div><div> ike=aes256-sha-modp1024!</div><div> esp=aes256-sha</div><div> right=YY.YYY.YYY.155</div><div> rightsubnet=<a href="http://172.30.20.0/27">172.30.20.0/27</a></div><div> left=XX.XX.XX.195</div>
<div> leftsubnet=<a href="http://192.168.100.0/24">192.168.100.0/24</a></div><div> leftfirewall=yes</div><div> pfs=no</div><div> auto=add</div><div><br></div><div>Ipsec up</div><div>========</div><div>root@starfleet ~ # ipsec up net-net</div>
<div>002 "net-net" #1: initiating Main Mode</div><div>102 "net-net" #1: STATE_MAIN_I1: initiate</div><div>003 "net-net" #1: ignoring Vendor ID payload [FRAGMENTATION c0000000]</div><div>104 "net-net" #1: STATE_MAIN_I2: sent MI2, expecting MR2</div>
<div>003 "net-net" #1: ignoring Vendor ID payload [Cisco-Unity]</div><div>003 "net-net" #1: received Vendor ID payload [XAUTH]</div><div>003 "net-net" #1: ignoring Vendor ID payload [###############################]</div>
<div>003 "net-net" #1: ignoring Vendor ID payload [Cisco VPN 3000 Series]</div><div>106 "net-net" #1: STATE_MAIN_I3: sent MI3, expecting MR3</div><div>002 "net-net" #1: Peer ID is ID_IPV4_ADDR: 'YY.YYY.YYY.155'</div>
<div>002 "net-net" #1: ISAKMP SA established</div><div>004 "net-net" #1: STATE_MAIN_I4: ISAKMP SA established</div><div>002 "net-net" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#1}</div>
<div>110 "net-net" #2: STATE_QUICK_I1: initiate</div><div>002 "net-net" #2: sent QI2, IPsec SA established {ESP=>0x8a12ab22 <0xa01abba1}</div><div>004 "net-net" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x8a12ab22 <0xa01abba1}</div>
<div><br></div><div>root@starfleet ~ # ipsec status</div><div>000 "net-net": <a href="http://192.168.100.0/24===XX.XX.XX.195[XX.XX.XX.195]...YY.YYY.YYY.155[YY.YYY.YYY.155]===172.30.20.0/27">192.168.100.0/24===XX.XX.XX.195[XX.XX.XX.195]...YY.YYY.YYY.155[YY.YYY.YYY.155]===172.30.20.0/27</a>; erouted; eroute owner: #2</div>
<div>000 "net-net": newest ISAKMP SA: #1; newest IPsec SA: #2; </div><div>000 </div><div>000 #2: "net-net" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 3331s; newest IPSEC; eroute owner</div>
<div>000 #2: "net-net" esp.8a12ab22@YY.YYY.YYY.155 (0 bytes) esp.a01abba1@XX.XX.XX.195 (0 bytes); tunnel</div><div>000 #1: "net-net" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 86050s; newest ISAKMP</div>
<div>000 </div><div><br></div><div>Network information</div><div>===================</div><div>* tun0 interface is used by openvpn server.</div><div>* virbr1 interface is a kvm network</div><div><br></div><div>root@starfleet ~ # ip -4 a s</div>
<div>1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN </div><div> inet <a href="http://127.0.0.1/8">127.0.0.1/8</a> scope host lo</div><div>2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000</div>
<div> inet XX.XX.XX.195/29 brd XX.XX.XX.199 scope global eth0</div><div>3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100</div><div> inet 10.8.0.1 peer <a href="http://10.8.0.2/32">10.8.0.2/32</a> scope global tun0</div>
<div>5: virbr1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP </div><div> inet <a href="http://192.168.100.1/24">192.168.100.1/24</a> brd 192.168.100.255 scope global virbr1</div><div> </div>
<div>root@starfleet ~ # ip -4 r s t 0</div><div>default via XX.XX.XX.193 dev eth0 </div><div><a href="http://10.8.0.0/16">10.8.0.0/16</a> via 10.8.0.2 dev tun0 </div><div>10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1 </div>
<div>XX.XX.XX.192/29 via XX.XX.XX.193 dev eth0 </div><div>XX.XX.XX.192/29 dev eth0 proto kernel scope link src XX.XX.XX.195 </div><div><a href="http://192.168.100.0/24">192.168.100.0/24</a> dev virbr1 proto kernel scope link src 192.168.100.1 </div>
<div>local 10.8.0.1 dev tun0 table local proto kernel scope host src 10.8.0.1 </div><div>broadcast XX.XX.XX.192 dev eth0 table local proto kernel scope link src XX.XX.XX.195 </div><div>local XX.XX.XX.195 dev eth0 table local proto kernel scope host src XX.XX.XX.195 </div>
<div>broadcast XX.XX.XX.199 dev eth0 table local proto kernel scope link src XX.XX.XX.195 </div><div>broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 </div><div>local <a href="http://127.0.0.0/8">127.0.0.0/8</a> dev lo table local proto kernel scope host src 127.0.0.1 </div>
<div>local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 </div><div>broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 </div><div>broadcast 192.168.100.0 dev virbr1 table local proto kernel scope link src 192.168.100.1 </div>
<div>local 192.168.100.1 dev virbr1 table local proto kernel scope host src 192.168.100.1 </div><div>broadcast 192.168.100.255 dev virbr1 table local proto kernel scope link src 192.168.100.1</div><div><br></div><div>
root@starfleet ~ # ip xfrm state</div><div>src XX.XX.XX.195 dst YY.YYY.YYY.155</div><div>proto esp spi 0x8a12ab22 reqid 16384 mode tunnel</div><div>replay-window 32 flag af-unspec</div><div>auth-trunc hmac(sha1) 0x######################################## 96</div>
<div>enc cbc(aes) 0x################################################################</div><div>src YY.YYY.YYY.155 dst XX.XX.XX.195</div><div>proto esp spi 0xa01abba1 reqid 16384 mode tunnel</div><div>replay-window 32 flag af-unspec</div>
<div>auth-trunc hmac(sha1) 0x######################################## 96</div><div>enc cbc(aes) 0x################################################################</div><div><br></div><div>root@starfleet ~ # ip xfrm policy</div>
<div>src <a href="http://192.168.100.0/24">192.168.100.0/24</a> dst <a href="http://172.30.20.0/27">172.30.20.0/27</a> </div><div>dir out priority 1847 ptype main </div><div>tmpl src XX.XX.XX.195 dst YY.YYY.YYY.155</div><div>
proto esp reqid 16384 mode tunnel</div><div>src <a href="http://172.30.20.0/27">172.30.20.0/27</a> dst <a href="http://192.168.100.0/24">192.168.100.0/24</a> </div><div>dir fwd priority 1847 ptype main </div><div>tmpl src YY.YYY.YYY.155 dst XX.XX.XX.195</div>
<div>proto esp reqid 16384 mode tunnel</div><div>src <a href="http://172.30.20.0/27">172.30.20.0/27</a> dst <a href="http://192.168.100.0/24">192.168.100.0/24</a> </div><div>dir in priority 1847 ptype main </div><div>tmpl src YY.YYY.YYY.155 dst XX.XX.XX.195</div>
<div>proto esp reqid 16384 mode tunnel</div><div>src ::/0 dst ::/0 </div><div>socket out priority 0 ptype main </div><div>src ::/0 dst ::/0 </div><div>socket in priority 0 ptype main </div><div>src ::/0 dst ::/0 </div><div>
socket out priority 0 ptype main </div><div>src ::/0 dst ::/0 </div><div>socket in priority 0 ptype main </div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div><div>socket out priority 0 ptype main </div>
<div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div><div>socket in priority 0 ptype main </div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div>
<div>socket out priority 0 ptype main </div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div><div>socket in priority 0 ptype main </div><div><br></div><div>root@starfleet ~ # ip route show table 220</div>
<div>root@starfleet ~ # </div><div><br></div><div>root@starfleet ~ # route -n</div><div>Kernel IP routing table</div><div>Destination Gateway Genmask Flags Metric Ref Use Iface</div><div>0.0.0.0 XX.XX.XX.193 0.0.0.0 UG 0 0 0 eth0</div>
<div>10.8.0.0 10.8.0.2 255.255.0.0 UG 0 0 0 tun0</div><div>10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0</div><div>XX.XX.XX.192 XX.XX.XX.193 255.255.255.248 UG 0 0 0 eth0</div>
<div>XX.XX.XX.192 0.0.0.0 255.255.255.248 U 0 0 0 eth0</div><div>192.168.100.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr1</div><div> </div><div>Iptables</div><div>========</div>
<div>root@starfleet ~ # iptables-save </div><div># Generated by iptables-save v1.4.14 on Fri May 24 16:07:39 2013</div><div>*nat</div><div>:PREROUTING ACCEPT [11:368]</div><div>:INPUT ACCEPT [1:48]</div><div>:OUTPUT ACCEPT [13:1012]</div>
<div>:POSTROUTING ACCEPT [13:1012]</div><div>-A POSTROUTING -s <a href="http://10.8.0.0/16">10.8.0.0/16</a> ! -d <a href="http://10.8.0.0/16">10.8.0.0/16</a> -o virbr1 -j MASQUERADE</div><div>-A POSTROUTING -s <a href="http://192.168.100.0/24">192.168.100.0/24</a> ! -d <a href="http://192.168.100.0/24">192.168.100.0/24</a> -p tcp -j MASQUERADE --to-ports 1024-65535</div>
<div>-A POSTROUTING -s <a href="http://192.168.100.0/24">192.168.100.0/24</a> ! -d <a href="http://192.168.100.0/24">192.168.100.0/24</a> -p udp -j MASQUERADE --to-ports 1024-65535</div><div>-A POSTROUTING -s <a href="http://192.168.100.0/24">192.168.100.0/24</a> ! -d <a href="http://192.168.100.0/24">192.168.100.0/24</a> -j MASQUERADE</div>
<div>COMMIT</div><div># Completed on Fri May 24 16:07:39 2013</div><div># Generated by iptables-save v1.4.14 on Fri May 24 16:07:39 2013</div><div>*mangle</div><div>:PREROUTING ACCEPT [271:19504]</div><div>:INPUT ACCEPT [261:19184]</div>
<div>:FORWARD ACCEPT [0:0]</div><div>:OUTPUT ACCEPT [181:28686]</div><div>:POSTROUTING ACCEPT [181:28686]</div><div>-A POSTROUTING -o virbr1 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill</div><div>COMMIT</div><div>
# Completed on Fri May 24 16:07:39 2013</div><div># Generated by iptables-save v1.4.14 on Fri May 24 16:07:39 2013</div><div>*filter</div><div>:INPUT ACCEPT [46:3380]</div><div>:FORWARD ACCEPT [0:0]</div><div>:OUTPUT ACCEPT [36:5220]</div>
<div>-A INPUT -i virbr1 -p udp -m udp --dport 53 -j ACCEPT</div><div>-A INPUT -i virbr1 -p tcp -m tcp --dport 53 -j ACCEPT</div><div>-A INPUT -i virbr1 -p udp -m udp --dport 67 -j ACCEPT</div><div>-A INPUT -i virbr1 -p tcp -m tcp --dport 67 -j ACCEPT</div>
<div>-A FORWARD -s <a href="http://172.30.20.0/27">172.30.20.0/27</a> -d <a href="http://192.168.100.0/24">192.168.100.0/24</a> -i eth0 -m policy --dir in --pol ipsec --reqid 16384 --proto esp -j ACCEPT</div><div>-A FORWARD -s <a href="http://192.168.100.0/24">192.168.100.0/24</a> -d <a href="http://172.30.20.0/27">172.30.20.0/27</a> -o eth0 -m policy --dir out --pol ipsec --reqid 16384 --proto esp -j ACCEPT</div>
<div>-A FORWARD -s <a href="http://10.8.0.0/16">10.8.0.0/16</a> -o virbr1 -j ACCEPT</div><div>-A FORWARD -i virbr1 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT</div><div>-A FORWARD -d <a href="http://192.168.100.0/24">192.168.100.0/24</a> -o virbr1 -m state --state RELATED,ESTABLISHED -j ACCEPT</div>
<div>-A FORWARD -s <a href="http://192.168.100.0/24">192.168.100.0/24</a> -i virbr1 -j ACCEPT</div><div>-A FORWARD -i virbr1 -o virbr1 -j ACCEPT</div><div>-A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable</div>
<div>-A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable</div><div>COMMIT</div><div># Completed on Fri May 24 16:07:39 2013</div><div><br></div><div>TcpDumping from 192.168.100.100 to 172.30.20.9</div><div>
==============================================</div><div>*** All commands are running at the same time. ***</div><div><br></div><div>root@enterprise:~# ping 172.30.20.9</div><div>PING 172.30.20.9 (172.30.20.9) 56(84) bytes of data.</div>
<div>^C</div><div>--- 172.30.20.9 ping statistics ---</div><div>6 packets transmitted, 0 received, 100% packet loss, time 4999ms</div><div><br></div><div>root@enterprise:~# tcpdump -v -n dst net <a href="http://172.30.20.0/27">172.30.20.0/27</a></div>
<div>tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes</div><div>16:23:48.919819 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div><div> 192.168.100.100 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 1, length 64</div>
<div>16:23:49.918949 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div><div> 192.168.100.100 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 2, length 64</div>
<div>16:23:50.918950 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div><div> 192.168.100.100 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 3, length 64</div>
<div>16:23:51.918952 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div><div> 192.168.100.100 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 4, length 64</div>
<div>16:23:52.918954 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div><div> 192.168.100.100 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 5, length 64</div>
<div>16:23:53.918951 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div><div> 192.168.100.100 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 6, length 64</div>
<div> </div><div>root@starfleet ~ # tcpdump -v -n dst net <a href="http://172.30.20.0/27">172.30.20.0/27</a></div><div>tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes</div><div>16:23:50.475100 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div>
<div> XX.XX.XX.195 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 1, length 64</div><div>16:23:51.474262 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div>
<div> XX.XX.XX.195 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 2, length 64</div><div>16:23:52.474280 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div>
<div> XX.XX.XX.195 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 3, length 64</div><div>16:23:53.474251 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div>
<div> XX.XX.XX.195 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 4, length 64</div><div>16:23:54.474213 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div>
<div> XX.XX.XX.195 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 5, length 64</div><div>16:23:55.474173 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84)</div>
<div> XX.XX.XX.195 > <a href="http://172.30.20.9">172.30.20.9</a>: ICMP echo request, id 2605, seq 6, length 64</div></div>