<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>I have added following on local router</p>
<p>iptables -t nat -I POSTROUTING -s 10.1.1.0/26 -o vlan847 -m
policy --dir out --pol ipsec --proto esp -j ACCEPT<br>
(before it was iptables -t nat -I POSTROUTING -s 10.1.1.0/26 -d
192.168.1.0/24 -o vlan847 -m policy --dir out --pol ipsec --proto
esp -j ACCEPT)</p>
<p>And on remote router<br>
<br>
iptables -I FORWARD -s 10.1.1.0/26 -j ACCEPT<br>
iptables -t nat -I POSTROUTING -s 10.1.1.0/26 -j MASQUERADE<br>
</p>
<p>And now when the tunnel is up, internet doesnt work at all (all
pings time out), however I can still reach the remote subnet
192.168.1.0. What is the best way to troubleshoot, if the error is
on the local gateway or on the remote?<br>
</p>
<br>
<div class="moz-cite-prefix">Den 2017-04-30 kl. 20:39, skrev
<a class="moz-txt-link-abbreviated" href="mailto:noel.kuntze+strongswan-users-ml@thermi.consulting">noel.kuntze+strongswan-users-ml@thermi.consulting</a>:<br>
</div>
<blockquote
cite="mid:BB874B73-D045-456A-9E5C-A9A32C661C74@thermi.consulting"
type="cite">Fix your NAT rules.<br>
<br>
<div class="gmail_quote">Am 30. April 2017 12:28:48 MESZ schrieb
Dusan Ilic <a class="moz-txt-link-rfc2396E" href="mailto:dusan@comhem.se"><dusan@comhem.se></a>:
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt
0.8ex; border-left: 1px solid rgb(204, 204, 204);
padding-left: 1ex;">
<pre class="k9mail">Okey, so I found info about adding a "passthrough" connection for my
local LAN. I have done this now and when i start the connection the
network connection isn't cut off, however, it seems like my internet
traffic i still using my local gateway (browsed to a check my ip-page).
I can however still ping the remote network.
Here is my tabel 220
# ip route show table 220
<a moz-do-not-send="true" href="http://10.1.1.0/26">10.1.1.0/26</a> dev br0 proto static src <a moz-do-not-send="true" href="http://10.1.1.1">10.1.1.1</a> # LAN passthrough?
default via 85.24.x.x dev vlan847 proto static src <a moz-do-not-send="true" href="http://10.1.1.1">10.1.1.1</a>
So instead of a route to <a moz-do-not-send="true" href="http://192.168.1.0/24">192.168.1.0/24</a> a default route is added, but it
looks like it doesn't go through the tunnel... traffic to <a moz-do-not-send="true" href="http://192.168.1.0/24">192.168.1.0/24</a>
do get tunneled still though.
Den 2017-04-30 kl. 11:59, skrev Dusan Ilic:
<blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Hello again,
It worked with the hack! Thank you!
Last question (hopefully! :P)), if I would like to use the remote
endpoint to route *all* traffic over the vpn, is below the correct way?
I have changed rightsubnet locally to 0.0.0.0/0 and leftsubnet
remotely to 0.0.0.0/0, I have also added NAT on the remote router for
the local subnet on the local endpoint, and finally I have added the
local subnet to table 220 on the local router. I have also replaced
the Iptable forward rule on local endpoint with 0.0.0.0/0 instead of
only the remote subnet.
However, when I up the connection on the local router in a couple of
seconds my SSH connection stops responding, and I cannot reach the
local gateway or internet any longer. I have to reboot the local
router to get access again.
Is this familiar to you? What could be happening here?
Den 2017-04-29 kl. 18:44, skrev Noel Kuntze:
<blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;"> Hello Dusan,
On 29.04.2017 18:34, Dusan Ilic wrote:
<blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> It works! I found a hidden setting under Phase 1 in Fortigate where
i could add the local ID. Added it's dynamic dns hostname and now it
connects.
</blockquote> Great!
<blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> However, I still have issues with another endpoint I'm testing. My
local endpoint have Strongswan 5.5.1 and the remote endpoint have
4.5.2. Would that present any issues or incompatibilites?
Unfortunately it's not possible to upgrade the remote endpoint
(Strongswan).
</blockquote> Pluto resolves IDs that are FQDNs. I think there was a hack, where
you add the at-character in front of the FQDN in the ID settings and
that stops it from doing that.
Might apply to charon, too in such a low version number. Try the hack.
<blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> I tried below, per your suggestion
left=%local.example
leftid=local.example
right=%remote.example
rightid=remote.example
remote.example : PSK "PSKGOESHERE"
Log when local sides initiates connection:
parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
received AUTHENTICATION_FAILED notify error
</blockquote> You need to read the remote logs when the remote side sends you an
error message.
<blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> Log when remote side initiates connection:
Apr 29 16:32:20 R6250 <a moz-do-not-send="true" href="http://daemon.info">daemon.info</a> charon: 10[CFG] looking for peer
configs matching 85.24.x.x[85.24.x.x]...94.254.x.x[94.254.x.x]
Apr 29 16:32:20 R6250 <a moz-do-not-send="true" href="http://daemon.info">daemon.info</a> charon: 10[CFG] no matching peer
config found
It looks like the same issue, the remote endpoint doesnt send the
configured ID?
</blockquote> Yes.
<blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;"> And another question, when using dynamic hostnames instead of IP's
as "right", how often does Strongswan make a new DNS-lookup? How
does Strongswan handle the situation where let's say the remote
endpoint suddenly receives a new IP? Or if the local side receives a
new IP during established connection?
</blockquote> strongSwan does a DNS lookup whenever it tries to select a
configuration. Well, depends on if mobike is used or no and if the
peer who's IP changed can't send any traffic anymore.
Mobike and connectivity: IKE_SA and CHILD_SAs are migrated
No mobike and connectivity: Don't know. Maybe a new IKE_SA is
negotiated, because the one peer knows the local address has vanished
(and the CHILD_SAs migrated?).
No mobike and no connectivity: Timeout, if DPD is used. Otherwise the
IKE_SA and CHILD_SAs remain until the remote peer connects again.
Mobike and no connectivity: Timeout, if DPD is used. Otherwise the
IKE_SA and CHILD_SAs remain until the remote peer connects again.
Kind regards,
Noel</blockquote>
<hr>
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>
<a moz-do-not-send="true" href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a>
</blockquote>
</pre></blockquote></div>
Sent from mobile
</blockquote>
</body></html>