<div dir="ltr">Hi Noel,<div>Many thanks for the pointer. Looks like I am missing something more or perhaps making a mistake. </div><div><br></div><div>Client [1.100.0.9] -- Server [1.100.0.5] <br></div><div><br></div><div>Goal: All non-ICMP traffic to be over IPsec tunnel between these two machines.</div><div><br></div><div>Strongswan 5.1.2</div><div><br></div><div>The client and server are using self-signed certificates and have each other's certs in /etc/ipsec.d/certs/</div><div><br></div><div><b>Client ipsec.conf:</b></div><div><div><br></div></div><div><div>config setup</div><div> charondebug = "dmn 0,mgr 1, ike 2, job 2, cfg 2, knl 1, net 1, tls 1, lib 0, enc 0, tnc 0"</div><div> uniqueids=no</div><div><br></div><div>conn %default</div><div> ikelifetime=60m</div><div> keylife=20m</div><div> rekeymargin=3m</div><div> keyingtries=1</div><div> keyexchange=ikev2</div><div> authby=rsasig</div><div><br></div><div>conn skip</div><div> type=<b><font color="#ff0000">passthrough</font></b></div><div> left=1.100.0.9</div><div> leftsubnet=0.0.0.0/0[icmp/]</div><div> leftcert=client_cert.pem</div><div> leftsendcert=always</div><div> rightcert=server_cert.pem</div><div> right=1.100.0.5</div><div> rightsubnet=0.0.0.0/0[icmp/]</div><div> auto=route</div><div><br></div><div>conn 1.100.0.5</div><div> type=<font color="#ff0000"><b>transport</b></font></div><div> left=1.100.0.9</div><div> leftcert=client_cert.pem</div><div> leftsendcert=always</div><div> rightcert=server_cert.pem</div><div> right=1.100.0.5</div><div> reauth=no</div><div> auto=start</div></div><div><br></div><div><b>Server ipsec.conf:</b></div><div><br></div><div><div>config setup</div><div> charondebug = "dmn 0,mgr 1, ike 2, job 2, cfg 2, knl 1, net 1, tls 1, lib 0, enc 0, tnc 0"</div><div> uniqueids=no</div><div><br></div><div>conn %default</div><div> ikelifetime=60m</div><div> keylife=20m</div><div> rekeymargin=3m</div><div> keyingtries=1</div><div> keyexchange=ikev2</div><div> authby=rsasig</div><div><br></div><div>conn skip</div><div> type=<b><font color="#ff0000">passthrough</font></b></div><div> left=1.100.0.5</div><div> leftsubnet=0.0.0.0/0[icmp/]</div><div> leftcert=server_cert.pem</div><div> leftsendcert=always</div><div> rightcert=client_cert.pem</div><div> right=1.100.0.9</div><div> rightsubnet=0.0.0.0/0[icmp/]</div><div> auto=route</div><div><br></div><div>conn 1.100.0.9</div><div> type=<b><font color="#ff0000">transport</font></b></div><div> left=1.100.0.5</div><div> leftcert=server_cert.pem</div><div> leftsendcert=always</div><div> rightcert=client_cert.pem</div><div> right=1.100.0.9</div><div> reauth=no</div><div> auto=add</div></div><div><br></div><div><div>=============</div><div>Output of setkey -DP on client:</div><div><div>root@agarwalpiyush0:/usr/local/google/home/agarwalpiyush/work/agent-v# ./sbin/nfv_cli dm_carl0 setkey -DP</div><div>1.100.0.5 1.100.0.9 icmp</div><div> fwd prio high + 1073740030 ipsec</div><div> esp/tunnel/1.100.0.5-1.100.0.9/unique:1</div><div> created: May 23 11:21:42 2017 lastused: </div><div> lifetime: 0(s) validtime: 0(s)</div><div> spid=1834 seq=1 pid=103981</div><div> refcnt=1</div><div>1.100.0.5 1.100.0.9 icmp</div><div> in prio high + 1073740030 ipsec</div><div> esp/tunnel/1.100.0.5-1.100.0.9/unique:1</div><div> created: May 23 11:21:42 2017 lastused: </div><div> lifetime: 0(s) validtime: 0(s)</div><div> spid=1824 seq=2 pid=103981</div><div> refcnt=1</div><div>1.100.0.9 1.100.0.5 icmp</div><div> out prio high + 1073740030 ipsec</div><div> esp/tunnel/1.100.0.9-1.100.0.5/unique:1</div><div> created: May 23 11:21:42 2017 lastused: </div><div> lifetime: 0(s) validtime: 0(s)</div><div> spid=1817 seq=3 pid=103981</div><div> refcnt=1</div><div>0.0.0.0/0 0.0.0.0/0 icmp</div><div> fwd prio high + 1073739774 none</div><div> created: May 23 11:21:31 2017 lastused: </div><div> lifetime: 0(s) validtime: 0(s)</div><div> spid=1698 seq=4 pid=103981</div><div> refcnt=1</div><div>0.0.0.0/0 0.0.0.0/0 icmp</div><div> in prio high + 1073739774 none</div><div> created: May 23 11:21:31 2017 lastused: May 23 11:21:35 2017</div><div> lifetime: 0(s) validtime: 0(s)</div><div> spid=1688 seq=5 pid=103981</div><div> refcnt=2</div><div>0.0.0.0/0 0.0.0.0/0 icmp</div><div> out prio high + 1073739774 none</div><div> created: May 23 11:21:31 2017 lastused: </div><div> lifetime: 0(s) validtime: 0(s)</div><div> spid=1681 seq=6 pid=103981</div><div> refcnt=1</div></div><div><br></div><div><div><br></div></div><div>Questions:</div><div>1) I'd like a transport type IPsec session for all non-ICMP traffic between client and server. As soon as I specify "passthrough" policy, my IPsec session changes to type "tunnel" from output of ipsec status. Clearly I am not specifying passthrough policy correctly.</div><div><br></div><div>1) Do I need to specify left/right for my "skip" passthrough conn? If I do NOT specify left and right for skip connection, I see the IPsec type remains transport (which is good and what I want), I do see shunted policies in "ipsec status" but I still see ping packets are encrypted.</div><div><br></div><div>Thank you for any help!</div><div>Piyush</div><div><br></div>On Monday, May 22, 2017 at 12:19:17 PM UTC-7, Noel Kuntze wrote:<blockquote class="gmail_quote" style="margin: 0;margin-left: 0.8ex;border-left: 1px #ccc solid;padding-left: 1ex;"><div>Add a passthrough policy for the protocol.<br><br><div class="gmail_quote">Am 22. Mai 2017 19:09:03 MESZ schrieb Piyush Agarwal <<a href="javascript:" target="_blank" gdf-obfuscated-mailto="fByXyOrfAQAJ" rel="nofollow" onmousedown="this.href='javascript:';return true;" onclick="this.href='javascript:';return true;">agarwa...@gmail.com</a>>:<blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">Hi,<div>Reading through the left|rightsubnet, it seems like there is no way to *exclude* a protocol from getting encrypted? </div><div><br></div><div>I have a host to host tunnel and I want to encrypt everything between these except ICMP since I'd like to do out-of-tunnel ping/traceroute.</div><div><br></div><div>Prior to using strongswan, I was using racoon where I could use setkey to manually update the SPD to exclude icmp alone.</div><div><br></div><div>Please advise if there is any way to achieve this with strongswan.</div><div><br></div><div>Thanks.<br clear="all"><div><br></div>-- <br><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><span style="font-size:12.8px">Piyush Agarwal</span><br></div><div><span style="color:rgb(17,17,17)"><font face="arial, helvetica, sans-serif" size="2">Life can only be understood backwards; but it must be lived forwards.</font></span><br></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div></div>
</blockquote></div><br>
-- <br>
Sent from mobile</div></blockquote></div></div>