<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="margin: 0px; line-height: normal;" class="">We are struggling to get the AirPlay/ Bonjour announcements forwarded to the roadwarriors and would kindly ask for advice what is missing and preventing us from using AirPlay devices.</div><div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">Roadwarrior-kids' iOS devices are managed and supervised by OS X server. </div><div style="margin: 0px; line-height: normal;" class="">A profile with an always-on VPN setting to our StrongSwan server is pushed to all their devices.</div><div style="margin: 0px; line-height: normal;" class="">So even within local LAN, kids' devices use VPN connection.</div><div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">All http traffic from roadwarrior-kids thru VPN tunnel is forwarded to different ports on local machine to which local Squid is listening.</div><div style="margin: 0px; line-height: normal;" class="">This is to enable logging of kids Internet traffic.</div><div style="margin: 0px; line-height: normal;" class="">This works well.</div><div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">Avahi running on StrongSwan machine to forward Bonjour announcements.</div><div style="margin: 0px; line-height: normal;" class="">AirPlay devices are unfortunately *not* announced to roadwarriors iOS devices on VPN tunnel. </div><div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">Please help. Thank you very much.</div><div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">Setup:</div><div style="margin: 0px; line-height: normal;" class="">192.168.178.1 DSL Modem Router w/ Firewall enabled</div><div style="margin: 0px; line-height: normal;" class="">ports forwarded accordingly to StrongSwan and MacMini machines </div><div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">192.168.178.10 RaspBerryPi w/ vanilla Raspian Jessie Lite running StrongSwan</div><div style="margin: 0px; line-height: normal;" class="">only one interface eth0 involved</div><div style="margin: 0px; line-height: normal;" class="">avahi-daemon running w/ reflector setting enabled</div><div style="margin: 0px; line-height: normal;" class="">squid running as proxy without caching</div><div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">192.168.178.3 MacMini running OS X server w/ open directory, DNS, DHCP, profile manager enabled</div><div style="margin: 0px; line-height: normal;" class=""><span style="color: #e4af09" class=""><a href="http://myserver.mydomain.net" class="">myserver.mydomain.net</a></span> resolved by MacMini to its own address 192.168.178.3 so devices on LAN don't have to go thru DSL Modem Router</div><div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal; min-height: 14px;" class="">192.168.178.220 VPN IP address of roadwarrior-kid1.</div><div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">avahi-daemon.conf includes:</div><div style="margin: 0px; line-height: normal;" class="">domain-name=alocal</div><div style="margin: 0px; line-height: normal;" class="">enable-reflector=yes</div><div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">ipsec.conf reads:</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">config setup</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> uniqueids = no</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">conn %default</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> keyexchange=ikev2</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> ike=aes128-sha1-modp1024,aes128-sha1-modp1536,aes128-sha1-modp2048,aes128-sha256-ecp256,aes1$</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> esp=aes128-aes256-sha1-sha256-modp2048-modp4096-modp1024,aes128-sha1,aes128-sha1-modp1024,ae$</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> dpdaction=clear</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> dpddelay=300s</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> authby=pubkey</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> left=%any</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> leftsubnet=0.0.0.0/0</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> leftcert=strongSwan-Cert.der</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> leftsendcert=always</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> leftid=<a href="http://myserver.mydomain.net" class="">myserver.mydomain.net</a></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> leftfirewall=yes</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> right=%any</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> keyexchange=ikev2</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> auto=add</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">conn roadwarrior-kid1</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> <a href="mailto:rightid=kid@mydomain.net" class="">rightid=kid@mydomain.net</a></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> rightsourceip=192.168.178.220</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""> rightdns=208.67.222.123,208.67.220.123</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">conn roadwarrior-kid2</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>...</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">conn roadwarrior-kid3</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>...</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69); min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">iptables -t nat -L</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">Chain PREROUTING (policy ACCEPT)</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">target prot opt source destination </div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">REDIRECT tcp -- 192.168.178.220 anywhere tcp dpt:http redir ports 55220</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69); min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">Chain INPUT (policy ACCEPT)</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">target prot opt source destination </div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69); min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">Chain OUTPUT (policy ACCEPT)</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">target prot opt source destination </div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69); min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">Chain POSTROUTING (policy ACCEPT)</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">target prot opt source destination </div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">ACCEPT all -- 192.168.178.220 anywhere policy match dir out pol ipsec</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">MASQUERADE all -- 192.168.178.220 anywhere </div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69); min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">iptables -L</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">Chain INPUT (policy ACCEPT)</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">target prot opt source destination </div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69); min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">Chain FORWARD (policy ACCEPT)</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">target prot opt source destination </div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">ACCEPT all -- 192.168.178.220 anywhere policy match dir in pol ipsec reqid 189 proto esp</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">ACCEPT all -- anywhere 192.168.178.220 policy match dir out pol ipsec reqid 189 proto esp</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69); min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">Chain OUTPUT (policy ACCEPT)</div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class="">target prot opt source destination </div></body></html>