<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Strongswan (v5.0.4) is running on my gateway. Tcpdump is clearly showing the packets making their way to the client (on my wan and lan), though I do not see anything coming back in return. I don't think the packets are being filtered on the way to the client device or back; I connected the device to my wifi network and experience the same issues. I currently have the following firewall rules enabled:<br><br>iptables -I INPUT -p udp --dport 500 -j ACCEPT<br>iptables -I INPUT -p udp --dport 4500 -j ACCEPT<br><br>when the tunnel comes up, two more entries are added:<br><br>ACCEPT all -- 10.10.10.1 67.215.65.0/24 policy match dir in pol ipsec reqid 1 proto ipv6-crypt<br>ACCEPT all -- 67.215.65.0/24 10.10.10.1 policy match dir out pol ipsec reqid 1 proto ipv6-crypt<br><br><br>Why did strongswan insert these rules and what do they mean? Neither my client device or my strongswan server are on the 67.215.65.0/24 ip range. I have no idea where strongswan is getting this 67.xxx network range. Is this correct? <br><br><div>> Subject: Re: [strongSwan] FW: ikev2 vpn using PKI auth with a Blackberry Z10<br>> From: martin@strongswan.org<br>> To: gawd0wns@hotmail.com<br>> CC: users@lists.strongswan.org<br>> Date: Mon, 16 Sep 2013 09:46:05 +0200<br>> <br>> Hi,<br>> <br>> > client device (24.114.94.100) connect to the server (99.234.220.200,<br>> > LAN ip-192.168.16.50) via public key authentication, and to have access<br>> > to the LAN (192.168.16.0/24) behind the server. [...] I cannot ping<br>> > between the host and client, or reach the subnet behind the host. <br>> > There are no errors when connecting, and I am issued a virtual ip<br>> > (10.10.10.1):<br>> <br>> I assume that the VPN client has a route to the host you ping. But does<br>> the host in your LAN has a route to the client, i.e. does it know where<br>> 10.10.10.1 is?<br>> <br>> If the IPsec gateway is not your default gateway, you'll have to install<br>> a route on each LAN host for the 10.10.10.0/24 subnet.<br>> <br>> Alternatively you might consider assigning unused addresses from<br>> 192.168.16.0/24 to the clients, statically or using the dhcp plugin.<br>> Then the farp plugin on your IPsec gateway could take care of responding<br>> to ARP responses on behalf of the IPsec clients.<br>> <br>> If that all does not help, you should run a network sniffer to see where<br>> your pings gets lost. Also, make sure IP forwarding is enabled on the<br>> IPsec gateway.<br>> <br>> Regards<br>> Martin<br>> <br>> [1]http://wiki.strongswan.org/projects/strongswan/wiki/FARPPlugin<br>> <br></div> </div></body>
</html>