<div dir="ltr"><div>Hi Tianjie,</div><div><br></div><div>Thanks for your response. Here is my server side config (with irrelevant sections and directives removed):</div><div><br></div><div>config setup</div><div> uniqueids=never</div>
<div><br></div><div>conn %default</div><div> eap_identity=%identity</div><div> left=%defaultroute</div><div> leftsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a></div><div> rightsourceip=%radius,<a href="http://10.0.0.0/24,10.0.1.0/24">10.0.0.0/24,10.0.1.0/24</a></div>
<div><br></div><div>conn win7</div><div> keyexchange=ikev2</div><div> ike=aes256-sha1-modp1024!</div><div> esp=aes256-sha1!</div><div> leftauth=pubkey</div><div> leftcert=...</div><div> leftid=@...</div><div> rightauth=eap-radius</div>
<div> rightsendcert=never</div><div> auto=add</div><div><br></div><div>And here is my local config:</div><div><br></div><div>config setup</div><div> uniqueids=never</div><div><br></div><div>conn win7</div><div> type=passthrough</div>
<div> dpdaction=restart</div><div> closeaction=restart</div><div> keyexchange=ikev2</div><div> ike=aes256-sha1-modp1024!</div><div> esp=aes256-sha1!</div><div> right=...</div><div> rightauth=pubkey</div><div> rightca=jiehanVpnCa.crt</div>
<div> rightsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a></div><div> leftsourceip=%config</div><div> leftauth=eap-mschapv2</div><div> eap_identity=...</div><div> auto=start</div><div><br></div><div>I am connecting from my local LAN <a href="http://192.168.11.0/24">192.168.11.0/24</a>, and I do have an address on that subnet on my wlp3s0 interface:</div>
<div><br></div><div>2: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000</div><div> link/ether 8c:70:5a:80:1e:78 brd ff:ff:ff:ff:ff:ff</div><div> inet <a href="http://192.168.11.172/24">192.168.11.172/24</a> brd 192.168.11.255 scope global wlp3s0</div>
<div> valid_lft forever preferred_lft forever</div><div> inet <a href="http://10.0.0.14/32">10.0.0.14/32</a> scope global wlp3s0</div><div> valid_lft forever preferred_lft forever</div><div> inet6 fe80::8e70:5aff:fe80:1e78/64 scope link </div>
<div> valid_lft forever preferred_lft forever</div><div><br></div><div>And here are the policies automatically installed:</div><div><br></div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://10.0.0.14/32">10.0.0.14/32</a> </div>
<div> dir fwd priority 1923 </div><div> tmpl src (MY_SERVER_IP) dst 192.168.11.172</div><div> proto esp reqid 1 mode tunnel</div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://10.0.0.14/32">10.0.0.14/32</a> </div>
<div> dir in priority 1923 </div><div> tmpl src (MY_SERVER_IP) dst 192.168.11.172</div><div> proto esp reqid 1 mode tunnel</div><div>src <a href="http://10.0.0.14/32">10.0.0.14/32</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div>
<div> dir out priority 1923 </div><div> tmpl src 192.168.11.172 dst (MY_SERVER_IP)</div><div> proto esp reqid 1 mode tunnel</div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div>
<div> socket in priority 0 </div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div><div> socket out priority 0 </div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div>
<div> socket in priority 0 </div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> </div><div> socket out priority 0 </div><div>src ::/0 dst ::/0 </div><div> socket in priority 0 </div>
<div>src ::/0 dst ::/0 </div><div> socket out priority 0 </div><div>src ::/0 dst ::/0 </div><div> socket in priority 0 </div><div>src ::/0 dst ::/0 </div><div> socket out priority 0</div><div><br></div><div>Thanks,</div>
<div><br></div><div>Jiehan</div></div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"><div>Jiehan<br></div></div></div>
<br><br><div class="gmail_quote">On Sat, Aug 10, 2013 at 9:40 PM, Tianjie Mao <span dir="ltr"><<a href="mailto:tjmao@tjmao.net" target="_blank">tjmao@tjmao.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><p>Hi Jiehan,</p>
<p>Could you please list your current configuration on both sides? I have been using charon and it does not seem to cause unwanted traffic to be forwarded to the remote site.</p>
<p>If that is a "local LAN" prefix, it should bypass the policy without a problem.</p>
<p>If that is a prefix that needs to be forwarded by one or more routers, does adding a more-specific route work for you?</p>
<p>Regards,<br>
Tianjie Mao</p>
</div><div class="gmail_quote"><div class="im">On Aug 10, 2013 9:12 PM, "Jiehan Zheng" <<a href="mailto:zheng@jiehan.org" target="_blank">zheng@jiehan.org</a>> wrote:<br type="attribution"></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div class="h5">
<div dir="ltr"><div>Hi,</div><div><br></div><div>I am using strongSwan 5.1.0 and my connection is using IKEv2. The rightsubnet on my machine and leftsubnet on the server are both <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>, causing all the traffic, including local LAN traffic from being sent through IPsec. I am looking for a way to exempt local traffic from being sent to the server. I've read through this thread:</div>
<div><a href="https://lists.strongswan.org/pipermail/users/2010-March/004614.html" target="_blank">https://lists.strongswan.org/pipermail/users/2010-March/004614.html</a><br></div><div><br></div><div>However, it's been three years so I am wondering if there is a better way, now with version 5.1.0 and charon, to achieve this?</div>
<div><br></div><div>Thanks,</div><br clear="all"><div><div dir="ltr"><div>Jiehan<br></div></div></div>
</div>
<br></div></div><div class="im">_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br></div></blockquote></div>
</blockquote></div><br></div>