<div dir="ltr"><div>Hello,</div><div><br></div><div>Here is some more info regarding the issue I am having with my test. Like I mentioned I am trying to resolve an issue I have with overlapping subnets connecting to my Strongswan VPN Hub.</div><div><br></div><div>The closest example to my issue is:</div><div><br></div><div><a href="https://www.strongswan.org/uml/testresults/ikev2/nat-rw-mark/index.html">https://www.strongswan.org/uml/testresults/ikev2/nat-rw-mark/index.html</a><br></div><div><br></div><div>I copied the _updown script to /etc/ and renamed it mark_updown. It is root:root and has 761 permissions. </div><div><br></div><div>Once the marks are introduced to ipsec.conf the packet that used to leave the kernel and hit my ens224 destined for <a href="http://172.31.0.0/16">172.31.0.0/16</a> network can not be found. How to I troubleshoot what is going on in kernel space?</div><div><br></div><div>This is is a copy of my daemon.log for the scenario I am trying get up and running. Basically as far as I can tell the mark_updown script is not executing. I don't see anything in the daemon logs to indicate why the script does not execute.<br></div><div><br></div><div><div><div>Aug 7 10:51:12 VPNGWServer charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-89-generic, x86_64)</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] disabling load-tester plugin, not configured</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[LIB] plugin 'load-tester': failed to load - load_tester_plugin_create returned NULL</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[KNL] known interfaces and IP addresses:</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[KNL] ens192</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[KNL] 67.102.243.141</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[KNL] fe80::20c:29ff:fe2d:c1c4</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loading unbound resolver config from '/etc/resolv.conf'</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loading unbound trust anchors from '/etc/ipsec.d/dnssec.keys'</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] dnscert plugin is disabled</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loading unbound resolver config from '/etc/resolv.conf'</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loading unbound trust anchors from '/etc/ipsec.d/dnssec.keys'</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] ipseckey plugin is disabled</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] attr-sql plugin: database URI not set</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loaded RSA private key from '/etc/ipsec.d/private/vpn-server-key.pem'</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loaded IKE secret for 67.102.243.141 108.48.47.116</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] sql plugin: database URI not set</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] opening triplet file /etc/ipsec.d/triplets.dat failed: No such file or directory</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] eap-simaka-sql database URI missing</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] loaded 0 RADIUS server configurations</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] no threshold configured for systime-fix, disabled</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[CFG] coupling file path unspecified</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[LIB] loaded plugins: charon test-vectors unbound ldap pkcs11 aes rc2 sha1 sha2 md4 md5 rdrand random nonce x509 revocation constraints acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey dnscert ipseckey pem openssl gcrypt af-alg fips-prf gmp agent chapoly xcbc cmac hmac ctr ccm gcm ntru bliss curl soup mysql sqlite attr kernel-netlink resolve socket-default connmark farp stroke updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-pam xauth-noauth tnc-tnccs tnccs-20 tnccs-11 tnccs-dynamic dhcp whitelist lookip error-notify certexpire led radattr addrblock unity</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[LIB] dropped capabilities, running as uid 0, gid 0</div><div>Aug 7 10:51:12 VPNGWServer charon: 00[JOB] spawning 16 worker threads</div><div>Aug 7 10:51:12 VPNGWServer charon: 02[NET] waiting for data on sockets</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] received stroke: add connection 'StrongSWAN'</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] conn StrongSWAN</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] left=67.102.243.141</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] leftsubnet=<a href="http://172.31.0.0/16">172.31.0.0/16</a></div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] leftauth=psk</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] leftid=67.102.243.141</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] leftupdown=/etc/mark_updown</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] right=%any</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] rightsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a></div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] rightauth=psk</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] ike=aes256-sha256-modp4096,aes192-sha256-modp4096,aes128-sha256-modp4096,aes256-sha256-modp2048,aes192-sha256-modp2048,aes128-sha256-modp2048,aes256-sha256-modp1536,aes192-sha256-modp1536,aes128-sha256-modp1536,aes256-sha1-modp4096,aes192-sha1-modp4096,aes128-sha1-modp4096,aes256-sha1-modp2048,aes192-sha1-modp2048,aes128-sha1-modp2048,aes256-sha1-modp1536,aes192-sha1-modp1536,aes128-sha1-modp1536!</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] esp=aes256-sha256-modp4096,aes192-sha256-modp4096,aes128-sha256-modp4096,aes256-sha256-modp2048,aes192-sha256-modp2048,aes128-sha256-modp2048,aes256-sha256-modp1536,aes192-sha256-modp1536,aes128-sha256-modp1536,aes256-sha1-modp4096,aes192-sha1-modp4096,aes128-sha1-modp4096,aes256-sha1-modp2048,aes192-sha1-modp2048,aes128-sha1-modp2048,aes256-sha1-modp1536,aes192-sha1-modp1536,aes128-sha1-modp1536!</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] dpddelay=300</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] dpdtimeout=150</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] dpdaction=1</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] mediation=no</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] keyexchange=ikev2</div><div>Aug 7 10:51:12 VPNGWServer charon: 03[CFG] added configuration 'StrongSWAN'</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] received stroke: add connection 'IRIS'</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] conn IRIS</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] left=67.102.243.141</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] leftsubnet=<a href="http://172.31.0.0/16">172.31.0.0/16</a></div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] leftauth=psk</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] leftid=67.102.243.141</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] leftupdown=/etc/mark_updown</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] right=%any</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] rightsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a></div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] rightauth=psk</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] rightid=<a href="mailto:scourtney@evolenthealth.com">scourtney@evolenthealth.com</a></div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] ike=aes256-sha256-modp4096,aes192-sha256-modp4096,aes128-sha256-modp4096,aes256-sha256-modp2048,aes192-sha256-modp2048,aes128-sha256-modp2048,aes256-sha256-modp1536,aes192-sha256-modp1536,aes128-sha256-modp1536,aes256-sha1-modp4096,aes192-sha1-modp4096,aes128-sha1-modp4096,aes256-sha1-modp2048,aes192-sha1-modp2048,aes128-sha1-modp2048,aes256-sha1-modp1536,aes192-sha1-modp1536,aes128-sha1-modp1536!</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] esp=aes256-sha256-modp4096,aes192-sha256-modp4096,aes128-sha256-modp4096,aes256-sha256-modp2048,aes192-sha256-modp2048,aes128-sha256-modp2048,aes256-sha256-modp1536,aes192-sha256-modp1536,aes128-sha256-modp1536,aes256-sha1-modp4096,aes192-sha1-modp4096,aes128-sha1-modp4096,aes256-sha1-modp2048,aes192-sha1-modp2048,aes128-sha1-modp2048,aes256-sha1-modp1536,aes192-sha1-modp1536,aes128-sha1-modp1536!</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] dpddelay=300</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] dpdtimeout=150</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] dpdaction=1</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] mediation=no</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] keyexchange=ikev2</div><div>Aug 7 10:51:12 VPNGWServer charon: 07[CFG] added configuration 'IRIS'</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] received stroke: add connection 'Jeff'</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] conn Jeff</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] left=67.102.243.141</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] leftsubnet=<a href="http://172.31.0.0/16">172.31.0.0/16</a></div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] leftauth=psk</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] leftid=67.102.243.141</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] leftupdown=/etc/mark_updown</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] right=%any</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] rightsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a></div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] rightauth=psk</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] rightid=<a href="mailto:jbalderson@evolenthealth.com">jbalderson@evolenthealth.com</a></div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] ike=aes256-sha256-modp4096,aes192-sha256-modp4096,aes128-sha256-modp4096,aes256-sha256-modp2048,aes192-sha256-modp2048,aes128-sha256-modp2048,aes256-sha256-modp1536,aes192-sha256-modp1536,aes128-sha256-modp1536,aes256-sha1-modp4096,aes192-sha1-modp4096,aes128-sha1-modp4096,aes256-sha1-modp2048,aes192-sha1-modp2048,aes128-sha1-modp2048,aes256-sha1-modp1536,aes192-sha1-modp1536,aes128-sha1-modp1536!</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] esp=aes256-sha256-modp4096,aes192-sha256-modp4096,aes128-sha256-modp4096,aes256-sha256-modp2048,aes192-sha256-modp2048,aes128-sha256-modp2048,aes256-sha256-modp1536,aes192-sha256-modp1536,aes128-sha256-modp1536,aes256-sha1-modp4096,aes192-sha1-modp4096,aes128-sha1-modp4096,aes256-sha1-modp2048,aes192-sha1-modp2048,aes128-sha1-modp2048,aes256-sha1-modp1536,aes192-sha1-modp1536,aes128-sha1-modp1536!</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] dpddelay=300</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] dpdtimeout=150</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] dpdaction=1</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] mediation=no</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] keyexchange=ikev2</div><div>Aug 7 10:51:12 VPNGWServer charon: 09[CFG] added configuration 'Jeff'</div><div>Aug 7 10:51:21 VPNGWServer charon: 02[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500]</div><div>Aug 7 10:51:21 VPNGWServer charon: 02[NET] waiting for data on sockets</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500] (464 bytes)</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] looking for an ike config for 67.102.243.141...108.48.47.116</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] candidate: 67.102.243.141...%any, prio 1052</div><div>Aug 7 10:51:21 VPNGWServer charon: message repeated 2 times: [ 08[CFG] candidate: 67.102.243.141...%any, prio 1052]</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] found matching ike config: 67.102.243.141...%any with prio 1052</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[IKE] 108.48.47.116 is initiating an IKE_SA</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[IKE] IKE_SA (unnamed)[1] state change: CREATED => CONNECTING</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] selecting proposal:</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] no acceptable DIFFIE_HELLMAN_GROUP found</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] selecting proposal:</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] no acceptable ENCRYPTION_ALGORITHM found</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] selecting proposal:</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] no acceptable ENCRYPTION_ALGORITHM found</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] selecting proposal:</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] proposal matches</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_4096, IKE:AES_CBC_192/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_4096, IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_4096, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_192/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:AES_CBC_192/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_4096, IKE:AES_CBC_192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_4096, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_4096, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC_192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536, IKE:AES_CBC_192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) N(MULT_AUTH) ]</div><div>Aug 7 10:51:21 VPNGWServer charon: 08[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500] (456 bytes)</div><div>Aug 7 10:51:21 VPNGWServer charon: 04[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500]</div><div>Aug 7 10:51:21 VPNGWServer charon: 02[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500]</div><div>Aug 7 10:51:21 VPNGWServer charon: 02[NET] waiting for data on sockets</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500] (288 bytes)</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH N(ESP_TFC_PAD_N) SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] looking for peer configs matching 67.102.243.141[67.102.243.141]...108.48.47.116[<a href="mailto:scourtney@evolenthealth.com">scourtney@evolenthealth.com</a>]</div><div>Aug 7 10:51:21 VPNGWServer kernel: [ 1430.602846] audit: type=1400 audit(1502117481.870:27): apparmor="DENIED" operation="open" profile="/usr/lib/ipsec/charon" name="/proc/2751/fd/" pid=2751 comm="charon" requested_mask="r" denied_mask="r" fsuid=0 ouid=0</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] candidate "StrongSWAN", match: 20/1/1052 (me/other/ike)</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] candidate "IRIS", match: 20/20/1052 (me/other/ike)</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] selected peer config 'IRIS'</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[IKE] authentication of '<a href="mailto:scourtney@evolenthealth.com">scourtney@evolenthealth.com</a>' with pre-shared key successful</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[IKE] authentication of '67.102.243.141' (myself) with pre-shared key</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[IKE] successfully created shared key MAC</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[IKE] IKE_SA IRIS[1] established between 67.102.243.141[67.102.243.141]...108.48.47.116[<a href="mailto:scourtney@evolenthealth.com">scourtney@evolenthealth.com</a>]</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[IKE] IKE_SA IRIS[1] state change: CONNECTING => ESTABLISHED</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[IKE] scheduling reauthentication in 28569s</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[IKE] maximum IKE_SA lifetime 28749s</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] looking for a child config for <a href="http://172.31.0.0/16">172.31.0.0/16</a> === <a href="http://10.46.17.0/24">10.46.17.0/24</a></div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] proposing traffic selectors for us:</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] <a href="http://172.31.0.0/16">172.31.0.0/16</a></div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] proposing traffic selectors for other:</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] <a href="http://0.0.0.0/0">0.0.0.0/0</a></div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] candidate "IRIS" with prio 5+1</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] found matching child config "IRIS" with prio 6</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] selecting proposal:</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] proposal matches</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] received proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_4096/NO_EXT_SEQ, ESP:AES_CBC_192/HMAC_SHA2_256_128/MODP_4096/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA2_256_128/MODP_4096/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_192/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_1536/NO_EXT_SEQ, ESP:AES_CBC_192/HMAC_SHA2_256_128/MODP_1536/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA2_256_128/MODP_1536/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA1_96/MODP_4096/NO_EXT_SEQ, ESP:AES_CBC_192/HMAC_SHA1_96/MODP_4096/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA1_96/MODP_4096/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_192/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ, ESP:AES_CBC_192/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA1_96/MODP_1536/NO_EXT_SEQ</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] got SPI c6df706d</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] selecting traffic selectors for us:</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] config: <a href="http://172.31.0.0/16">172.31.0.0/16</a>, received: <a href="http://172.31.0.0/16">172.31.0.0/16</a> => match: <a href="http://172.31.0.0/16">172.31.0.0/16</a></div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] selecting traffic selectors for other:</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[CFG] config: <a href="http://0.0.0.0/0">0.0.0.0/0</a>, received: <a href="http://10.46.17.0/24">10.46.17.0/24</a> => match: <a href="http://10.46.17.0/24">10.46.17.0/24</a></div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] adding SAD entry with SPI c6df706d and reqid {1} (mark 10/0xffffffff)</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] using encryption algorithm AES_CBC with key size 256</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] using integrity algorithm HMAC_SHA2_256_128 with key size 256</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] using replay window of 32 packets</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] adding SAD entry with SPI cfd3131e and reqid {1} (mark 10/0xffffffff)</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] using encryption algorithm AES_CBC with key size 256</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] using integrity algorithm HMAC_SHA2_256_128 with key size 256</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] using replay window of 32 packets</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] adding policy <a href="http://172.31.0.0/16">172.31.0.0/16</a> === <a href="http://10.46.17.0/24">10.46.17.0/24</a> out (mark 10/0xffffffff)</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] adding policy <a href="http://10.46.17.0/24">10.46.17.0/24</a> === <a href="http://172.31.0.0/16">172.31.0.0/16</a> in (mark 10/0xffffffff)</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] adding policy <a href="http://10.46.17.0/24">10.46.17.0/24</a> === <a href="http://172.31.0.0/16">172.31.0.0/16</a> fwd (mark 10/0xffffffff)</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] getting a local address in traffic selector <a href="http://172.31.0.0/16">172.31.0.0/16</a></div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] no local address found in traffic selector <a href="http://172.31.0.0/16">172.31.0.0/16</a></div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] policy <a href="http://172.31.0.0/16">172.31.0.0/16</a> === <a href="http://10.46.17.0/24">10.46.17.0/24</a> out (mark 10/0xffffffff) already exists, increasing refcount</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] updating policy <a href="http://172.31.0.0/16">172.31.0.0/16</a> === <a href="http://10.46.17.0/24">10.46.17.0/24</a> out (mark 10/0xffffffff)</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] policy <a href="http://10.46.17.0/24">10.46.17.0/24</a> === <a href="http://172.31.0.0/16">172.31.0.0/16</a> in (mark 10/0xffffffff) already exists, increasing refcount</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] updating policy <a href="http://10.46.17.0/24">10.46.17.0/24</a> === <a href="http://172.31.0.0/16">172.31.0.0/16</a> in (mark 10/0xffffffff)</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] policy <a href="http://10.46.17.0/24">10.46.17.0/24</a> === <a href="http://172.31.0.0/16">172.31.0.0/16</a> fwd (mark 10/0xffffffff) already exists, increasing refcount</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] updating policy <a href="http://10.46.17.0/24">10.46.17.0/24</a> === <a href="http://172.31.0.0/16">172.31.0.0/16</a> fwd (mark 10/0xffffffff)</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] getting a local address in traffic selector <a href="http://172.31.0.0/16">172.31.0.0/16</a></div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] no local address found in traffic selector <a href="http://172.31.0.0/16">172.31.0.0/16</a></div><div>Aug 7 10:51:21 VPNGWServer charon: 09[IKE] CHILD_SA IRIS{1} established with SPIs c6df706d_i cfd3131e_o and TS <a href="http://172.31.0.0/16">172.31.0.0/16</a> === <a href="http://10.46.17.0/24">10.46.17.0/24</a></div><div>Aug 7 10:51:21 VPNGWServer charon: 09[KNL] 67.102.243.141 is on interface ens192</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[ENC] generating IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(AUTH_LFT) ]</div><div>Aug 7 10:51:21 VPNGWServer charon: 09[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500] (224 bytes)</div><div>Aug 7 10:51:21 VPNGWServer charon: 04[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500]</div><div>Aug 7 10:51:31 VPNGWServer charon: 02[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500]</div><div>Aug 7 10:51:31 VPNGWServer charon: 02[NET] waiting for data on sockets</div><div>Aug 7 10:51:31 VPNGWServer charon: 14[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500] (80 bytes)</div><div>Aug 7 10:51:31 VPNGWServer charon: 14[ENC] parsed INFORMATIONAL request 2 [ ]</div><div>Aug 7 10:51:31 VPNGWServer charon: 14[ENC] generating INFORMATIONAL response 2 [ ]</div><div>Aug 7 10:51:31 VPNGWServer charon: 14[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500] (80 bytes)</div><div>Aug 7 10:51:31 VPNGWServer charon: 04[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500]</div><div>Aug 7 10:51:42 VPNGWServer charon: 02[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500]</div><div>Aug 7 10:51:42 VPNGWServer charon: 02[NET] waiting for data on sockets</div><div>Aug 7 10:51:42 VPNGWServer charon: 14[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500] (80 bytes)</div><div>Aug 7 10:51:42 VPNGWServer charon: 14[ENC] parsed INFORMATIONAL request 3 [ ]</div><div>Aug 7 10:51:42 VPNGWServer charon: 14[ENC] generating INFORMATIONAL response 3 [ ]</div><div>Aug 7 10:51:42 VPNGWServer charon: 14[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500] (80 bytes)</div><div>Aug 7 10:51:42 VPNGWServer charon: 04[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500]</div><div>Aug 7 10:51:52 VPNGWServer charon: 02[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500]</div><div>Aug 7 10:51:52 VPNGWServer charon: 02[NET] waiting for data on sockets</div><div>Aug 7 10:51:52 VPNGWServer charon: 15[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500] (80 bytes)</div><div>Aug 7 10:51:52 VPNGWServer charon: 15[ENC] parsed INFORMATIONAL request 4 [ ]</div><div>Aug 7 10:51:52 VPNGWServer charon: 15[ENC] generating INFORMATIONAL response 4 [ ]</div><div>Aug 7 10:51:52 VPNGWServer charon: 15[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500] (80 bytes)</div><div>Aug 7 10:51:52 VPNGWServer charon: 04[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500]</div><div>Aug 7 10:52:02 VPNGWServer charon: 02[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500]</div><div>Aug 7 10:52:02 VPNGWServer charon: 02[NET] waiting for data on sockets</div><div>Aug 7 10:52:02 VPNGWServer charon: 14[NET] received packet: from 108.48.47.116[500] to 67.102.243.141[500] (80 bytes)</div><div>Aug 7 10:52:02 VPNGWServer charon: 14[ENC] parsed INFORMATIONAL request 5 [ ]</div><div>Aug 7 10:52:02 VPNGWServer charon: 14[ENC] generating INFORMATIONAL response 5 [ ]</div><div>Aug 7 10:52:02 VPNGWServer charon: 14[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500] (80 bytes)</div><div>Aug 7 10:52:02 VPNGWServer charon: 04[NET] sending packet: from 67.102.243.141[500] to 108.48.47.116[500]</div></div><div><br></div><div>Here is my routing table:</div><div><br></div><div>ip route:</div><div><br></div><div><div>default via 67.102.243.137 dev ens192 onlink</div><div><a href="http://10.32.4.0/24">10.32.4.0/24</a> dev ens160 proto kernel scope link src 10.32.4.15</div><div><a href="http://10.32.8.224/30">10.32.8.224/30</a> dev ens224 proto kernel scope link src 10.32.8.225</div><div><a href="http://10.32.8.236/30">10.32.8.236/30</a> dev ens256 proto kernel scope link src 10.32.8.237</div><div><a href="http://67.102.243.136/29">67.102.243.136/29</a> dev ens192 proto kernel scope link src 67.102.243.141</div><div><a href="http://172.16.0.0/16">172.16.0.0/16</a> via 10.32.4.1 dev ens160</div><div><a href="http://172.24.0.0/20">172.24.0.0/20</a> via 10.32.8.238 dev ens256</div><div><a href="http://172.31.0.0/16">172.31.0.0/16</a> via 10.32.8.226 dev ens224</div></div><div><br></div><div>route:</div><div><div>Kernel IP routing table</div><div>Destination Gateway Genmask Flags Metric Ref Use Iface</div><div>default h-67-102-243-13 0.0.0.0 UG 0 0 0 ens192</div><div>10.32.4.0 * 255.255.255.0 U 0 0 0 ens160</div><div>10.32.8.224 * 255.255.255.252 U 0 0 0 ens224</div><div>10.32.8.236 * 255.255.255.252 U 0 0 0 ens256</div><div>67.102.243.136 * 255.255.255.248 U 0 0 0 ens192</div><div>172.16.0.0 10.32.4.1 255.255.0.0 UG 0 0 0 ens160</div><div>172.24.0.0 10.32.8.238 255.255.240.0 UG 0 0 0 ens256</div><div>172.31.0.0 10.32.8.226 255.255.0.0 UG 0 0 0 ens224</div></div><div><br></div><div><br></div><div>Here is my xfrm state:</div><div><br></div><div><div>root@VPNGWServer:/etc# ip -s xfrm state</div><div>src 67.102.243.141 dst 108.48.47.116</div><div> proto esp spi 0xc08667b8(3230033848) reqid 1(0x00000001) mode tunnel</div><div> replay-window 32 seq 0x00000000 flag af-unspec (0x00100000)</div><div> mark 0xa/0xffffffff</div><div> auth-trunc hmac(sha256) 0x8ec496bffdb53b77a11282535817350134695864511e2c93d4e3039ba4b89dd2 (256 bits) 128</div><div> enc cbc(aes) 0xe7326d57a123fe6457e43258b4a4f885052123f66f220e03844e1da7cc258de1 (256 bits)</div><div> anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</div><div> lifetime config:</div><div> limit: soft (INF)(bytes), hard (INF)(bytes)</div><div> limit: soft (INF)(packets), hard (INF)(packets)</div><div> expire add: soft 3275(sec), hard 3600(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:12:44 use -</div><div> stats:</div><div> replay-window 0 replay 0 failed 0</div><div>src 108.48.47.116 dst 67.102.243.141</div><div> proto esp spi 0xc7a70ce0(3349613792) reqid 1(0x00000001) mode tunnel</div><div> replay-window 32 seq 0x00000000 flag af-unspec (0x00100000)</div><div> mark 0xa/0xffffffff</div><div> auth-trunc hmac(sha256) 0xc9951f3220a4b0c842ee3b240c268dc122cd98ef5ff83c76f7a59973bc91c496 (256 bits) 128</div><div> enc cbc(aes) 0xcb36a9a8a062bca6c5ea3fe8c67515eae5ac16449d2a80b2a715803ba3c82cb8 (256 bits)</div><div> anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000</div><div> lifetime config:</div><div> limit: soft (INF)(bytes), hard (INF)(bytes)</div><div> limit: soft (INF)(packets), hard (INF)(packets)</div><div> expire add: soft 3375(sec), hard 3600(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:12:44 use -</div><div> stats:</div><div> replay-window 0 replay 0 failed 0</div></div><div><br></div><div>Here is my xfrm policy:</div><div><br></div><div><br></div><div><div>root@VPNGWServer:/etc# ip -s xfrm policy</div><div>src <a href="http://10.46.17.0/24">10.46.17.0/24</a> dst <a href="http://172.31.0.0/16">172.31.0.0/16</a> uid 0</div><div> dir fwd action allow index 82 priority 2915 share any flag (0x00000000)</div><div> lifetime config:</div><div> limit: soft (INF)(bytes), hard (INF)(bytes)</div><div> limit: soft (INF)(packets), hard (INF)(packets)</div><div> expire add: soft 0(sec), hard 0(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:12:44 use -</div><div> mark 0xa/0xffffffff</div><div> tmpl src 108.48.47.116 dst 67.102.243.141</div><div> proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel</div><div> level required share any</div><div> enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff</div><div>src <a href="http://10.46.17.0/24">10.46.17.0/24</a> dst <a href="http://172.31.0.0/16">172.31.0.0/16</a> uid 0</div><div> dir in action allow index 72 priority 2915 share any flag (0x00000000)</div><div> lifetime config:</div><div> limit: soft (INF)(bytes), hard (INF)(bytes)</div><div> limit: soft (INF)(packets), hard (INF)(packets)</div><div> expire add: soft 0(sec), hard 0(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:12:44 use -</div><div> mark 0xa/0xffffffff</div><div> tmpl src 108.48.47.116 dst 67.102.243.141</div><div> proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel</div><div> level required share any</div><div> enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff</div><div>src <a href="http://172.31.0.0/16">172.31.0.0/16</a> dst <a href="http://10.46.17.0/24">10.46.17.0/24</a> uid 0</div><div> dir out action allow index 65 priority 2915 share any flag (0x00000000)</div><div> lifetime config:</div><div> limit: soft (INF)(bytes), hard (INF)(bytes)</div><div> limit: soft (INF)(packets), hard (INF)(packets)</div><div> expire add: soft 0(sec), hard 0(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:12:44 use -</div><div> mark 0xa/0xffffffff</div><div> tmpl src 67.102.243.141 dst 108.48.47.116</div><div> proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel</div><div> level required share any</div><div> enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff</div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> uid 0</div><div> socket in action allow index 59 priority 0 share any flag (0x00000000)</div><div> lifetime config:</div><div> limit: soft 0(bytes), hard 0(bytes)</div><div> limit: soft 0(packets), hard 0(packets)</div><div> expire add: soft 0(sec), hard 0(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:11:21 use -</div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> uid 0</div><div> socket out action allow index 52 priority 0 share any flag (0x00000000)</div><div> lifetime config:</div><div> limit: soft 0(bytes), hard 0(bytes)</div><div> limit: soft 0(packets), hard 0(packets)</div><div> expire add: soft 0(sec), hard 0(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:11:21 use -</div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> uid 0</div><div> socket in action allow index 43 priority 0 share any flag (0x00000000)</div><div> lifetime config:</div><div> limit: soft 0(bytes), hard 0(bytes)</div><div> limit: soft 0(packets), hard 0(packets)</div><div> expire add: soft 0(sec), hard 0(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:11:21 use 2017-08-07 11:41:16</div><div>src <a href="http://0.0.0.0/0">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0">0.0.0.0/0</a> uid 0</div><div> socket out action allow index 36 priority 0 share any flag (0x00000000)</div><div> lifetime config:</div><div> limit: soft 0(bytes), hard 0(bytes)</div><div> limit: soft 0(packets), hard 0(packets)</div><div> expire add: soft 0(sec), hard 0(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:11:21 use 2017-08-07 11:41:16</div><div>src ::/0 dst ::/0 uid 0</div><div> socket in action allow index 27 priority 0 share any flag (0x00000000)</div><div> lifetime config:</div><div> limit: soft 0(bytes), hard 0(bytes)</div><div> limit: soft 0(packets), hard 0(packets)</div><div> expire add: soft 0(sec), hard 0(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:11:21 use -</div><div>src ::/0 dst ::/0 uid 0</div><div> socket out action allow index 20 priority 0 share any flag (0x00000000)</div><div> lifetime config:</div><div> limit: soft 0(bytes), hard 0(bytes)</div><div> limit: soft 0(packets), hard 0(packets)</div><div> expire add: soft 0(sec), hard 0(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:11:21 use -</div><div>src ::/0 dst ::/0 uid 0</div><div> socket in action allow index 11 priority 0 share any flag (0x00000000)</div><div> lifetime config:</div><div> limit: soft 0(bytes), hard 0(bytes)</div><div> limit: soft 0(packets), hard 0(packets)</div><div> expire add: soft 0(sec), hard 0(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:11:21 use -</div><div>src ::/0 dst ::/0 uid 0</div><div> socket out action allow index 4 priority 0 share any flag (0x00000000)</div><div> lifetime config:</div><div> limit: soft 0(bytes), hard 0(bytes)</div><div> limit: soft 0(packets), hard 0(packets)</div><div> expire add: soft 0(sec), hard 0(sec)</div><div> expire use: soft 0(sec), hard 0(sec)</div><div> lifetime current:</div><div> 0(bytes), 0(packets)</div><div> add 2017-08-07 11:11:21 use -</div></div><div><br></div><div><br></div><div>Any help is much appreciated.</div><div><br></div><div>Thanks,</div><div>Sean</div><div><br></div><div><div><br></div>-- <br><div class="gmail_signature">Sean Courtney<br>Ph - 410 878 7833</div>
</div></div></div>