<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Awesome, worked! Thanks! (Android 5.0.2)<br>
<br>
For googlers: <br>
1) Set net.ipv6.conf.all.proxy_ndp=1 in sysctl.conf<br>
<br>
2) Change in ipsec.conf:<br>
<tt> leftfirewall=no</tt><tt><br>
</tt><tt> leftupdown=/etc/ipsec.d/proxyndp.updown</tt><tt><br>
</tt><br>
3) Make /etc/ipsec.d/proxyndp.updown executable and contain:<br>
<br>
<tt>#!/bin/sh</tt><tt><br>
</tt><tt>case $PLUTO_VERB in</tt><tt><br>
</tt><tt> up-client-v6)</tt><tt><br>
</tt><tt> ip -6 neigh add proxy ${PLUTO_PEER_CLIENT%????} dev
eth0</tt><tt><br>
</tt><tt> ;;</tt><tt><br>
</tt><tt> down-client-v6)</tt><tt><br>
</tt><tt> ip -6 neigh delete proxy ${PLUTO_PEER_CLIENT%????}
dev eth0</tt><tt><br>
</tt><tt> ;;</tt><tt><br>
</tt><tt>esac</tt><br>
<br>
<br>
On 01/07/15 23:26, Noel Kuntze wrote:<br>
<span style="white-space: pre;">></span><br>
<blockquote type="cite">Hello Carl,<br>
<br>
Take a look at this ticket:
<a class="moz-txt-link-freetext" href="https://wiki.strongswan.org/issues/1008">https://wiki.strongswan.org/issues/1008</a><br>
<br>
Mit freundlichen Grüßen/Kind Regards,<br>
Noel Kuntze<br>
<br>
GPG Key ID: 0x63EC6658<br>
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
<br>
Am 01.07.2015 um 12:39 schrieb Carl Hörberg:<br>
> I've setup strongswan on a vps from digitalocean on a ubuntu
14.04 box.<br>
> It works great with the android client for ipv4 traffic but
ipv6 traffic<br>
> does not seems to go through.<br>
<br>
> Server's ipsec.conf:<br>
<br>
> config setup<br>
> conn %default<br>
> left=%any<br>
> leftid=vpn.mydomain.com<br>
> leftsubnet=0.0.0.0/0,::/0<br>
> leftfirewall=yes<br>
> right=%any<br>
> rightsourceip=192.168.211.0/24,2a03:b0c0:2:d0::4b4:9001/64<br>
>
rightdns=8.8.8.8,8.8.4.4,2001:4860:4860::8888,2001:4860:4860::8844<br>
> conn ikev2<br>
> keyexchange=ikev2<br>
> dpdaction=clear<br>
> dpddelay=300s<br>
> rekey=no<br>
> leftcert=vpn.mydomain.com.pem<br>
> leftauth=pubkey<br>
> rightauth=eap-gtc<br>
> eap_identity=%any<br>
> auto=add<br>
<br>
> 2a03:b0c0:2:d0::4b4:9001/64 is the subnet the vps is assigned
by<br>
> digitalocean.<br>
<br>
> The server log when the Android client connects:<br>
<br>
> Jul 1 10:28:11 mail-ams3 charon: 03[IKE] peer requested
virtual IP %any<br>
> Jul 1 10:28:11 mail-ams3 charon: 03[CFG] assigning new lease
to 'carl'<br>
> Jul 1 10:28:11 mail-ams3 charon: 03[IKE] assigning virtual
IP<br>
> 192.168.211.1 to peer 'carl'<br>
> Jul 1 10:28:11 mail-ams3 charon: 03[IKE] peer requested
virtual IP %any6<br>
> Jul 1 10:28:11 mail-ams3 charon: 03[CFG] assigning new lease
to 'carl'<br>
> Jul 1 10:28:11 mail-ams3 charon: 03[IKE] assigning virtual
IP<br>
> 2a03:b0c0:2:d0::4b4:9002 to peer 'carl'<br>
> Jul 1 10:28:11 mail-ams3 charon: 03[IKE] CHILD_SA ikev2{1}
established<br>
> with SPIs c36bd0ef_i 3501ed85_o and TS 0.0.0.0/0 ::/0 ===<br>
> 192.168.211.1/32 2a03:b0c0:2:d0::4b4:9002/128<br>
> Jul 1 10:28:11 mail-ams3 vpn: + carl 192.168.211.1/32 ==
77.218.252.176<br>
> -- 188.166.89.56 == %any/0<br>
> Jul 1 10:28:11 mail-ams3 vpn: + carl
2a03:b0c0:2:d0::4b4:9002/128 ==<br>
> 77.218.252.176 -- 188.166.89.56 == %any6/0<br>
> Jul 1 10:28:11 mail-ams3 charon: 03[ENC] generating IKE_AUTH
response 4<br>
> [ AUTH CPRP(ADDR ADDR6 DNS DNS DNS6 DNS6) SA TSi TSr
N(MOBIKE_SUP)<br>
> N(ADD_6_ADDR) ]<br>
> Jul 1 10:28:11 mail-ams3 charon: 03[NET] sending packet:
from<br>
> 188.166.89.56[4500] to 77.218.252.176[1813] (396 bytes)<br>
<br>
> I've enabled ipv6 forwarding:<br>
<br>
> # cat /proc/sys/net/ipv6/conf/all/forwarding<br>
> 1<br>
<br>
> Am I missing something? Is it correct to set the VPS's IPv6
subnet as<br>
> rightsourceip?<br>
> Do I have to add any ip6tables rules for forwarding ipv6
traffic?<br>
> _______________________________________________<br>
> Users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
> <a class="moz-txt-link-freetext" href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a><br>
<br>
</blockquote>
<span style="white-space: pre;">></span><br>
<br>
<br>
</body>
</html>