<div dir="ltr">Hi<div><br></div><div>I added now the following rules:</div><div><br></div><div><font face="monospace, monospace">iptables -t nat -A POSTROUTING -s <a href="http://192.168.120.0/24">192.168.120.0/24</a> -o eth0 -m policy --dir out --pol ipsec -j ACCEPT</font><br></div><div><font face="monospace, monospace"><div>iptables -t nat -A POSTROUTING -s <a href="http://192.168.120.0/24">192.168.120.0/24</a> -o eth0 -j MASQUERADE</div><div><br></div><div>But no success</div><div><br></div></font></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-05-04 12:39 GMT+02:00 Noel Kuntze <span dir="ltr"><<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
</span>Hello Zhuyj,<br>
<br>
Please check that you enabled forwarding for the network devices<br>
that are involved in the forwarding of the packages.<br>
Also, please check the counters in the output of ipsec statusall to see,<br>
if the packets get decrypted. The counters should increment, when you send<br>
packets to the remote subnet.<br>
<span class=""><br>
Mit freundlichen Grüßen/Regards,<br>
Noel Kuntze<br>
<br>
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
<br>
</span><div><div class="h5">Am 04.05.2015 um 12:34 schrieb zhuyj:<br>
> Hi, Noel<br>
><br>
> Thanks for your reply.<br>
> I read carefully this link: <a href="https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling" target="_blank">https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling</a><br>
><br>
> In this link, I think, the most important is: ip_forward and iptables.<br>
> Now I show you the configurations on the sun:<br>
><br>
> root@strongswan2:~# cat /proc/sys/net/ipv4/ip_forward<br>
> 1<br>
> root@strongswan2:~# iptables-save<br>
> # Generated by iptables-save v1.4.21 on Mon May 4 18:29:28 2015<br>
> *nat<br>
> :PREROUTING ACCEPT [93:14126]<br>
> :INPUT ACCEPT [36:4578]<br>
> :OUTPUT ACCEPT [0:0]<br>
> :POSTROUTING ACCEPT [1:84]<br>
> -A POSTROUTING -s <a href="http://10.0.0.0/8" target="_blank">10.0.0.0/8</a> -o eth1 -m policy --dir out --pol ipsec -j ACCEPT<br>
> -A POSTROUTING -s <a href="http://10.0.0.0/8" target="_blank">10.0.0.0/8</a> -o eth1 -j MASQUERADE<br>
> COMMIT<br>
> # Completed on Mon May 4 18:29:28 2015<br>
> # Generated by iptables-save v1.4.21 on Mon May 4 18:29:28 2015<br>
> *filter<br>
> :INPUT ACCEPT [2033:256543]<br>
> :FORWARD ACCEPT [0:0]<br>
> :OUTPUT ACCEPT [182:23858]<br>
> -A FORWARD -s <a href="http://10.1.0.0/16" target="_blank">10.1.0.0/16</a> -d <a href="http://10.2.0.0/16" target="_blank">10.2.0.0/16</a> -i eth1 -m policy --dir in --pol ipsec --reqid 1 --proto esp -j ACCEPT<br>
> -A FORWARD -s <a href="http://10.2.0.0/16" target="_blank">10.2.0.0/16</a> -d <a href="http://10.1.0.0/16" target="_blank">10.1.0.0/16</a> -o eth1 -m policy --dir out --pol ipsec --reqid 1 --proto esp -j ACCEPT<br>
> COMMIT<br>
> # Completed on Mon May 4 18:29:28 2015<br>
><br>
> I think, ip forward feature is enabled in sun. And the iptables rules are inserted.<br>
> But the result is the same.<br>
><br>
> Any reply is appreciated.<br>
><br>
> Thanks a lot.<br>
> Zhu Yanjun<br>
><br>
> On 05/04/2015 06:01 PM, Noel Kuntze wrote:<br>
</div></div><div><div class="h5">> Hello,<br>
><br>
> Did you follow the guide for forwarding[1]?<br>
><br>
> [1] <a href="https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling" target="_blank">https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling</a><br>
><br>
> Mit freundlichen Grüßen/Regards,<br>
> Noel Kuntze<br>
><br>
> Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
><br>
> Am 04.05.2015 um 11:25 schrieb zhuyj:<br>
>>>> Hi,<br>
>>>><br>
>>>> Are you using psk or certificate to auth?<br>
>>>><br>
>>>> Best Regards!<br>
>>>> Zhu Yanjun<br>
>>>> On 05/04/2015 05:18 PM, zhuyj wrote:<br>
>>>>> Hi, Bernhard<br>
>>>>><br>
>>>>> Your problem is the same with mine.<br>
>>>>><br>
>>>>> Best Regards!<br>
>>>>> Zhu Yanjun<br>
>>>>><br>
>>>>> On 05/04/2015 05:00 PM, Bernhard Marx wrote:<br>
>>>>>> Hi Zhu,<br>
>>>>>><br>
>>>>>> no problem. I wish I would have :-)<br>
>>>>>> But moon and sun is connected via public networks?<br>
>>>>>> This is my scenario:<br>
>>>>>><br>
>>>>>> <a href="http://192.168.2.0/24" target="_blank">192.168.2.0/24</a> <<a href="http://192.168.2.0/24" target="_blank">http://192.168.2.0/24</a>> <=> 192.168.2.1 hardware router xx.xx.xx.xx (public IP from provider) <=> Internet <=> public IP on eth0 192.168.120.125 <=> <a href="http://192.168.120.0/24" target="_blank">192.168.120.0/24</a> <<a href="http://192.168.120.0/24" target="_blank">http://192.168.120.0/24</a>> on eth1<br>
>>>>>><br>
>>>>>> I can ping from 192.168.120.125 to 192.168.2.1 and vice versa - but I can not reach any devices in the subnet...<br>
>>>>>><br>
>>>>>> Regards<br>
>>>>>> Bernhard<br>
>>>>>><br>
>>>>>><br>
>>>>>> 2015-05-04 10:51 GMT+02:00 zhuyj <<a href="mailto:mounter625@163.com">mounter625@163.com</a> <mailto:<a href="mailto:mounter625@163.com">mounter625@163.com</a>>>:<br>
>>>>>><br>
>>>>>> Sorry. I thought your solve this problem already.<br>
>>>>>> Do you think that it is related with psk or pubkey? I mean that strongswan can support auth-based certificate very well.<br>
>>>>>> Maybe there is something wrong with psk auth?<br>
>>>>>><br>
>>>>>> Zhu Yanjun<br>
>>>>>><br>
>>>>>><br>
>>>>>> On 05/04/2015 04:45 PM, zhuyj wrote:<br>
>>>>>>> Hi, Marx<br>
>>>>>>><br>
>>>>>>> Please let me know how to solve this problem.<br>
>>>>>>><br>
>>>>>>> Thanks a lot.<br>
>>>>>>> Zhu Yanjun<br>
>>>>>>><br>
>>>>>>> On 05/04/2015 04:22 PM, Bernhard Marx wrote:<br>
>>>>>>>> Dear Zhu,<br>
>>>>>>>><br>
>>>>>>>> I think I have the issue... as send a request to mail list yesterday...<br>
>>>>>>>><br>
>>>>>>>> Feedback I received is to check the routing of packets... but I cant identify the issue...<br>
>>>>>>>><br>
>>>>>>>> Regards<br>
>>>>>>>> Bernhard<br>
>>>>>>>><br>
>>>>>>>> 2015-05-04 10:17 GMT+02:00 zhuyj <<a href="mailto:mounter625@163.com">mounter625@163.com</a> <mailto:<a href="mailto:mounter625@163.com">mounter625@163.com</a>>>:<br>
>>>>>>>><br>
>>>>>>>> Hi, all<br>
>>>>>>>><br>
>>>>>>>> I followed this link: <a href="http://www.strongswan.org/uml/testresults/ikev2/net2net-psk/" target="_blank">http://www.strongswan.org/uml/testresults/ikev2/net2net-psk/</a><br>
>>>>>>>><br>
>>>>>>>> I configured 4 vmare hosts. The hosts are ubuntu14.04.<br>
>>>>>>>><br>
>>>>>>>> The network topology is as below.<br>
>>>>>>>><br>
>>>>>>>> 10.1.0.10 <---->10.1.0.1 (moon) 192.168.0.1<----->192.168.0.2 (sun) 10.2.0.1<---->10.2.0.10<br>
>>>>>>>><br>
>>>>>>>> strongswan is 5.1.2.<br>
>>>>>>>><br>
>>>>>>>> >From this link: <a href="http://www.strongswan.org/uml/testresults/ikev2/net2net-psk/" target="_blank">http://www.strongswan.org/uml/testresults/ikev2/net2net-psk/</a>, after a vpn tunnel is created,<br>
>>>>>>>> I ran "ping 10.2.0.10" on clinet 10.1.0.10. But I can not get any reply from 10.2.0.10.<br>
>>>>>>>><br>
>>>>>>>> I can find the icmp packets into moon. But moon will not forward these icmp packets.<br>
>>>>>>>><br>
>>>>>>>> I exactly followed this link <a href="http://www.strongswan.org/uml/testresults/ikev2/net2net-psk/" target="_blank">http://www.strongswan.org/uml/testresults/ikev2/net2net-psk/</a>, but I can not get<br>
>>>>>>>> the same test result with this link.<br>
>>>>>>>><br>
>>>>>>>> Does any one have the similar experience?<br>
>>>>>>>><br>
>>>>>>>> Any reply is appreciated.<br>
>>>>>>>><br>
>>>>>>>> Thanks a lot.<br>
>>>>>>>> Zhu Yanjun<br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>> _______________________________________________<br>
>>>>>>>> Users mailing list<br>
>>>>>>>> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>><br>
>>>>>>>> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>> _______________________________________________<br>
>>>>>>>> Users mailing list<br>
>>>>>>>> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>><br>
>>>>>>>> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
>>>>>>><br>
>>>>>>><br>
>>>>>>> _______________________________________________<br>
>>>>>>> Users mailing list<br>
>>>>>>> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>><br>
>>>>>>> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
>>>>>><br>
>>>>><br>
>>>>><br>
>>>>> _______________________________________________<br>
>>>>> Users mailing list<br>
>>>>> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
>>>>> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
>>>><br>
>>>><br>
>>>> _______________________________________________<br>
>>>> Users mailing list<br>
>>>> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
>>>> <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
>>>><br>
>><br>
><br>
><br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
<br>
</div></div>iQIcBAEBCAAGBQJVR0x7AAoJEDg5KY9j7GZYdoEQAI7bJaY+Iy5volndjpsV4xol<br>
3Sv2TPyVa/Fvo4BWYlFWtpLvAsyUkRDCOGycRV2iD3LVd6Y+WC8QeN2KXvcC6nvK<br>
y0mS3bhxgonrMVDuJ/Qmrk3qmNIx5TkvqAjuxSxeKoKhoL9zigbUhCX4xRoLg+fq<br>
83vPQ5tMw03+hWshfKd+f8VPbSy9P3YNQ+9fy4f69bFRKcHDwj/L2k45L7s5gRMG<br>
shFL/VvIEWlZqzBRHbWGw3t7GUUDtsUjpy7M/1KJ5XelS97i7PBeU+JTQWpW64W5<br>
HoVolQgqc9BarsG4pUTx+v5Q31YexUawEfNngzcp3WoDvYvhPe+8Dqq0rEsZYZV5<br>
4cIBBEyKkCJ8caR5bdV+etvy80pDj/bnfM5RXNSGERB9pwTPF+WvsAHm6LpS1iiF<br>
ATwqIcEwcsvwR50+twhRmH+yoV2bcNCqsOxrKLqp2H4nab1/q0+R0j1uMoCW6IHv<br>
6v5ZAVanPLCgI0a+re61hndrCPVoXiPYMg3abLKZVFXmqcDgoL42Qc7F1XL+0csR<br>
WsO3CGIe45g7PG9DZ3gjhs0PP2grIVy3LzsHUi6ONuB5Jhy7FTMkClaH36WPVD4+<br>
zOi7lKPWiNWg+OqXzf7Fkb3FJCz3vjOBG1ieRrSsO05JBmqsReFmWR6F3J44gd17<br>
F1t5/uhaSEb4435vTos7<br>
=URb/<br>
-----END PGP SIGNATURE-----<br>
</blockquote></div><br></div>