<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jan 17, 2017 at 1:12 AM, Mirko Parthey <span dir="ltr"><<a href="mailto:mirko.parthey@web.de" target="_blank">mirko.parthey@web.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-">On Mon, Jan 16, 2017 at 01:51:00AM +1100, Yudi V wrote:<br>
> Got strongswan VPN on an openwrt gateway acting as the server. Openwrt router<br>
> has two VLANS (say <a href="http://192.168.1.0/24" rel="noreferrer" target="_blank">192.168.1.0/24</a>, <a href="http://192.168.2.0/24" rel="noreferrer" target="_blank">192.168.2.0/24</a>), I used rightsourceip=%dhcp<br>
> and let the remote peer get IP from <a href="http://192.168.1.0/24" rel="noreferrer" target="_blank">192.168.1.0/24</a>.<br>
><br>
> This works fine and I can access resources (mostly network shares) in<br>
> <a href="http://192.168.1.0/24" rel="noreferrer" target="_blank">192.168.1.0/24</a> but I would also like to access resources in <a href="http://192.168.2.0/24" rel="noreferrer" target="_blank">192.168.2.0/24</a>. I<br>
> cannot seem to figure out how to do this.<br>
><br>
> Normally when I am connected to the openwrt gateway directly I can access the<br>
> resources in both VLANs (has appropriate rules in the firewall).<br>
><br>
> I did not add any specific firewall rules relating to strongswan setup except<br>
> for esp, ah, port 500 and 4500 on wan side. Not sure what settings need to be<br>
> changed to get access to the other subnets.<br>
> I would appreciate any suggestions.<br>
<br>
</span>Hello Yudi,<br>
<br>
I would suggest to find out where the traffic to <a href="http://192.168.2.0/24" rel="noreferrer" target="_blank">192.168.2.0/24</a> is dropped,<br>
on which machine and by which firewall rule / IPsec policy.<br>
For example, send an ICMP echo request (ping) from a remote machine,<br>
also try a larger size such as 1500.<br>
<br>
Does it arrive at the target machine?<br>
Is the request dropped, or the reply?<br></blockquote><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Linux IPsec has byte and packet counters, which can be shown with the<br>
strongSwan command "ipsec statusall". It also shows other useful information,<br>
so please post the output of this command after the connection has been<br>
established.<br>
Also enable logging in the OpenWrt firewall and look at the log (logread)<br>
and the netfilter rule counters (iptables -vL).<br>
<br>
This diagram shows the processing order of the netfilter hooks:<br>
<a href="http://inai.de/images/nf-packet-flow.png" rel="noreferrer" target="_blank">http://inai.de/images/nf-<wbr>packet-flow.png</a><br>
Please note that decapsulated IPsec traffic is processed by the network<br>
layer hooks a second time. This should be covered by the rules<br>
automatically inserted with leftfirewall=yes, but is worth checking.<br>
<br>
Are your routes set up correctly - on the client, the OpenWrt gateway,<br>
and the target machine in <a href="http://192.168.2.0/24" rel="noreferrer" target="_blank">192.168.2.0/24</a>?<br>
Remember that you will need valid routes for both directions.<br>
Do machines in <a href="http://192.168.2.0/24" rel="noreferrer" target="_blank">192.168.2.0/24</a> send all traffic to <a href="http://192.168.1.0/24" rel="noreferrer" target="_blank">192.168.1.0/24</a> via<br>
the OpenWrt gateway, or is there another router?<br>
<br>
You could also try to use an address range for the remote clients<br>
which is disjoint from the internal subnets. You will see if it breaks<br>
access to <a href="http://192.168.1.0/24" rel="noreferrer" target="_blank">192.168.1.0/24</a> as well, and this can be a base for<br>
further investigations.<br>
<br>
Regards,<br>
Mirko<br>
</blockquote></div><br><div>Thank you for the reply. <br><br></div><div>The problem was not strongswan or openwrt, but windows 10. When the connection is created, it uses split-tunneling by default, so anything not destined to <a href="http://192.168.1.0/64">192.168.1.0/64</a> was being router to the internet and obviously was failing. Once I disabled split-tunneling, everything was being sent to the remote gateway. All ok. <br><br></div><div>Another thing I noticed with openwrt is I have to use the DNS domain suffix (.lan) for hostnames to resolve properly over the VPN. <br></div><br></div><div class="gmail_extra">-- <br><div class="gmail_signature">Kind regards,<br>Yudi<br></div>
</div></div>