<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
</head>
<body>
<div name="messageBodySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;">
<div>Hi!</div>
<div>I’m trying to get my strongSwan setup to work with forecast plugin in a Mac/iOS friendly environment.</div>
<div>I'm using the strongSwan 5.5.1 on LEDE Reboot r3267 and the native VPN clients on macOS Sierra and iOS 10.</div>
<div>The scenario is as follows:</div>
<div><br /></div>
<div> ------------ ----------------</div>
<div> | VPN Client |______________| Router Gateway |______ _ _ _ _ _ _</div>
<div> | macOS | tunnel | LEDE r3267 | internet</div>
<div> ------------ ----------------</div>
<div> |</div>
<div> -----------------</div>
<div> | |</div>
<div> ------------ ------------</div>
<div> | LAN client | | LAN Server |</div>
<div> ------------ ------------</div>
<div><br /></div>
<div>I successfully got the VPN working with the following setup on the LEDE router:</div>
<div><br /></div>
<div>$ cat /etc/ipsec.conf</div>
<div># ipsec.conf - strongSwan IPsec configuration file</div>
<div><br /></div>
<div>conn %default</div>
<div>keyexchange=ikev2</div>
<div>left=%any</div>
<div>leftid=[vpn-gateway-fqdn]</div>
<div>leftcert=serverCert.pem</div>
<div>leftsubnet=0.0.0.0/0,::/0</div>
<div>leftfirewall=yes</div>
<div>right=%any</div>
<div>rightsourceip=%dhcp</div>
<div>rightsubnet=%dynamic,224.0.0.0/4,10.0.1.255</div>
<div>rightdns=10.0.1.1</div>
<div>mark=%unique</div>
<div>auto=add</div>
<div>ike=aes256-aes128-sha256-sha1-modp2048-modp1024</div>
<div>esp=aes256-aes128-sha1</div>
<div><br /></div>
<div>conn x509</div>
<div>dpdaction=clear</div>
<div>#righcert=clientCert.pem</div>
<div>rightid=*@[domain]</div>
<div>authby=pubkey</div>
<div><br /></div>
<div>conn eap-tls</div>
<div>leftauth=pubkey</div>
<div>#righcert=clientCert.pem</div>
<div>rightid=*@[domain]</div>
<div>rightauth=eap-tls</div>
<div>eap_identity=%any</div>
<div><br /></div>
<div>$ cat /etc/strongswan.conf</div>
<div># strongswan.conf - strongSwan configuration file</div>
<div>#</div>
<div># Refer to the strongswan.conf(5) manpage for details</div>
<div>#</div>
<div># Configuration changes should be made in the included files</div>
<div><br /></div>
<div>charon {</div>
<div> threads = 8</div>
<div> load_modular = yes</div>
<div> plugins {</div>
<div> dhcp {</div>
<div> force_server_address = yes</div>
<div> identity_lease = yes</div>
<div> server = 10.0.1.255</div>
<div> }</div>
<div> forecast {</div>
<div> interface = br-lan</div>
<div> reinject = x509,eap-tls</div>
<div> }</div>
<div> include strongswan.d/charon/*.conf</div>
<div> }</div>
<div>}</div>
<div>#include strongswan.d/*.conf</div>
<div><br /></div>
<div>$ cat /etc/firewall.user</div>
<div>iptables -I INPUT --src 10.0.1.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT</div>
<div>iptables -I FORWARD --src 10.0.1.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT</div>
<div>iptables -I FORWARD --dst 10.0.1.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT</div>
<div>iptables -I OUTPUT --dst 10.0.1.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT</div>
<div><br /></div>
<div>I can't use split-tunneling since macOS/iOS won't resolve names within the LAN unless I have leftsubnet=0.0.0.0/0. So all the traffic gets routed through the tunnel.</div>
<div><br /></div>
<div>Thing is, when I add mark=%unique to ipsec.conf, I can still ping clients in the LAN, but internet traffic gets dropped when connected to the tunnel. If I remove mark=%unique, it works flawlessly, but traffic won't get marked, what I need for the forecast plugin.</div>
<div><br /></div>
<div>I can see in the logs that the domain names are properly resolved, but it seems that the traffic going outside the local network originating in the VPN client, gets dropped.</div>
<div><br /></div>
<div>Finally, when connected to the VPN with mark=%unique and the forecast plugin loaded, I can't see any broadcast/multicast from the VPN client. I mostly use avahi-daemon to broadcast shares within the LAN, but can't see any of them.</div>
<div><br /></div>
<div>ip xfrm policy show</div>
<div>src 224.0.0.0/4 dst 0.0.0.0/0 </div>
<div>dir fwd priority 198976 </div>
<div>mark 0x2/0xffffffff</div>
<div>tmpl src [vpn-client-ip] dst [vpn-gateway-ip]</div>
<div>proto esp reqid 2 mode tunnel</div>
<div>src 224.0.0.0/4 dst 0.0.0.0/0 </div>
<div>dir in priority 198976 </div>
<div>mark 0x2/0xffffffff</div>
<div>tmpl src [vpn-client-ip] dst [vpn-gateway-ip]</div>
<div>proto esp reqid 2 mode tunnel</div>
<div>src 0.0.0.0/0 dst 224.0.0.0/4 </div>
<div>dir out priority 198976 </div>
<div>mark 0x2/0xffffffff</div>
<div>tmpl src [vpn-gateway-ip] dst [vpn-client-ip]</div>
<div>proto esp reqid 2 mode tunnel</div>
<div>src 10.0.1.255/32 dst 0.0.0.0/0 </div>
<div>dir fwd priority 191808 </div>
<div>mark 0x2/0xffffffff</div>
<div>tmpl src [vpn-client-ip] dst [vpn-gateway-ip]</div>
<div>proto esp reqid 2 mode tunnel</div>
<div>src 10.0.1.255/32 dst 0.0.0.0/0 </div>
<div>dir in priority 191808 </div>
<div>mark 0x2/0xffffffff</div>
<div>tmpl src [vpn-client-ip] dst [vpn-gateway-ip]</div>
<div>proto esp reqid 2 mode tunnel</div>
<div>src 0.0.0.0/0 dst 10.0.1.255/32 </div>
<div>dir out priority 191808 </div>
<div>mark 0x2/0xffffffff</div>
<div>tmpl src [vpn-gateway-ip] dst [vpn-client-ip]</div>
<div>proto esp reqid 2 mode tunnel</div>
<div>src 10.0.1.239/32 dst 0.0.0.0/0 </div>
<div>dir fwd priority 191808 </div>
<div>mark 0x2/0xffffffff</div>
<div>tmpl src [vpn-client-ip] dst [vpn-gateway-ip]</div>
<div>proto esp reqid 2 mode tunnel</div>
<div>src 10.0.1.239/32 dst 0.0.0.0/0 </div>
<div>dir in priority 191808 </div>
<div>mark 0x2/0xffffffff</div>
<div>tmpl src [vpn-client-ip] dst [vpn-gateway-ip]</div>
<div>proto esp reqid 2 mode tunnel</div>
<div>src 0.0.0.0/0 dst 10.0.1.239/32 </div>
<div>dir out priority 191808 </div>
<div>mark 0x2/0xffffffff</div>
<div>tmpl src [vpn-gateway-ip] dst [vpn-client-ip]</div>
<div>proto esp reqid 2 mode tunnel</div>
<div><br /></div>
<div>Any ideas?</div>
<div><br /></div>
</div>
</body>
</html>