<div dir="ltr"><div><div><div>Hello Andreas<br><br></div>Thanks for the help..<br><br></div>Yes!!! It works!....I did just as mentioned in the example shown by you....</div><div><br></div><div><br></div><div>======================================================================<br>root@lssimgw2:/usr/local/etc#<br>root@lssimgw2:/usr/local/etc#<br>root@lssimgw2:/usr/local/etc# ipsec statusall<br>Status of IKE charon daemon (weakSwan 5.5.1, Linux 4.4.0-31-generic, i686):<br> uptime: 20 seconds, since Nov 20 22:20:41 2017<br> malloc: sbrk 2449408, mmap 0, used 315904, free 2133504<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 4<br> loaded plugins: charon ldap aes des blowfish rc2 sha2 sha1 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt fips-prf gmp xcbc cmac hmac ctr ccm gcm sqlite attr kernel-netlink resolve socket-default forecast farp stroke vici updown eap-identity eap-sim eap-aka eap-simaka-pseudonym eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-pam xauth-noauth tnc-tnccs dhcp lookip error-notify unity<br>Listening IP addresses:<br> 2.2.2.59<br> 192.168.110.25<br> 192.168.24.25<br> 10.232.90.125<br> 192.168.33.25<br> 172.17.1.25<br> 192.168.25.1<br>Connections:<br> togw1: 2.2.2.59...97.1.1.201 IKEv1, dpddelay=30s<br> togw1: local: [2.2.2.59] uses pre-shared key authentication<br> togw1: remote: [97.1.1.201] uses pre-shared key authentication<br> togw1: child: <a href="http://192.168.25.0/24">192.168.25.0/24</a> === <a href="http://192.168.22.0/24">192.168.22.0/24</a> TUNNEL, dpdaction=clear<br>Routed Connections:<br> togw1{1}: ROUTED, TUNNEL, reqid 1<br> togw1{1}: <a href="http://192.168.25.0/24">192.168.25.0/24</a> === <a href="http://192.168.22.0/24">192.168.22.0/24</a><br>Security Associations (1 up, 0 connecting):<br> togw1[1]: ESTABLISHED 8 seconds ago, 2.2.2.59[2.2.2.59]...97.1.1.201[97.1.1.201]<br> togw1[1]: IKEv1 SPIs: 61cc45661e76b9e7_i 9182e288ae7b2058_r*, pre-shared key reauthentication in 23 hours<br> togw1[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br> togw1{2}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: c4c01d32_i c25a27dc_o<br> togw1{2}: AES_CBC_128/HMAC_SHA1_96, 168 bytes_i (2 pkts, 7s ago), 168 bytes_o (2 pkts, 7s ago), rekeying in 17 hours<br> togw1{2}: <a href="http://192.168.25.0/24">192.168.25.0/24</a> === <a href="http://192.168.22.0/24">192.168.22.0/24</a><br>root@lssimgw2:/usr/local/etc#<br>root@lssimgw2:/usr/local/etc#<br>root@lssimgw2:/usr/local/etc#<br>root@lssimgw2:/usr/local/etc#<br>root@lssimgw2:/usr/local/etc# iptables -nvL<br>Chain INPUT (policy ACCEPT 116 packets, 19111 bytes)<br> pkts bytes target prot opt in out source destination<br> 2 168 ACCEPT all -- eth0 * <a href="http://192.168.22.0/24">192.168.22.0/24</a> <a href="http://192.168.25.0/24">192.168.25.0/24</a> policy match dir in pol ipsec reqid 1 proto 50<br><br>Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)<br> pkts bytes target prot opt in out source destination<br> 0 0 ACCEPT all -- eth0 * <a href="http://192.168.22.0/24">192.168.22.0/24</a> <a href="http://192.168.25.0/24">192.168.25.0/24</a> policy match dir in pol ipsec reqid 1 proto 50<br> 0 0 ACCEPT all -- * eth0 <a href="http://192.168.25.0/24">192.168.25.0/24</a> <a href="http://192.168.22.0/24">192.168.22.0/24</a> policy match dir out pol ipsec reqid 1 proto 50<br><br>Chain OUTPUT (policy ACCEPT 70 packets, 10236 bytes)<br> pkts bytes target prot opt in out source destination<br> 2 168 ACCEPT all -- * eth0 <a href="http://192.168.25.0/24">192.168.25.0/24</a> <a href="http://192.168.22.0/24">192.168.22.0/24</a> policy match dir out pol ipsec reqid 1 proto 50<br>root@lssimgw2:/usr/local/etc#<br>root@lssimgw2:/usr/local/etc# cat ipsec.conf<br># /etc/ipsec.conf - strongSwan IPsec configuration file<br><br>config setup<br> strictcrlpolicy=no<br> charondebug="ike 1,chd 1,knl 1,cfg 1"<br><br>conn %default<br> ikelifetime=24h<br> keylife=18h<br> mobike=no<br> dpddelay=30s<br> dpdtimeout=90s<br> dpdaction=clear<br> rightfirewall=yes<br> righthostaccess=yes<br><br>conn togw1<br> right=2.2.2.59<br> left=97.1.1.201<br> leftsubnet=<a href="http://192.168.22.0/24">192.168.22.0/24</a><br> rightsubnet=<a href="http://192.168.25.0/24">192.168.25.0/24</a><br> leftauth=psk<br> rightauth=psk<br> type=tunnel<br> keyexchange=ikev1<br> ike=aes128-sha1-modp1024!<br> esp=aes128-sha1!<br> auto=route<br>root@lssimgw2:/usr/local/etc#<br>=====================================================</div><div><br></div><div><br>Never expected or rather never knew that we could swap the left/right roles too...Its just what you assign...<br><div><br></div><div>Thank you...learnt something worthwhile today</div><div><br></div><div>regards</div><div>Rajiv</div><div><br></div><div><br></div></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Nov 20, 2017 at 8:59 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Rajiv,<br>
<br>
if "left" is local and "right" is remote then only<br>
leftfirewall and lefthostaccess are defined.<br>
<br>
rightfirewall and righthostaccess are used when<br>
"right" is local and "left" is remote as in the<br>
following scenario where sides are swapped:<br>
<br>
<br>
<a href="https://www.strongswan.net/testing/testresults/ikev2/config-payload-swapped/" rel="noreferrer" target="_blank">https://www.strongswan.net/tes<wbr>ting/testresults/ikev2/config-<wbr>payload-swapped/</a><br>
<br>
Regards<br>
<br>
Andreas<br>
<br>
On 20.11.2017 15:15, Rajiv Kulkarni wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi<br>
<br>
I have a ipsec tunnel deployed/configured as below:<br>
<br>
PC1----(lan)[GW1](wan)=====IPS<wbr>EC====(wan)[GW2](lan)---PC2<br>
<br>
PC1-ipaddr: 192.168.22.x<br>
PC2-ipaddr: 192.168.25.x<br>
<br>
GW1-lan-ipaddr: 192.168.22.1<br>
GW2-lan-ipaddr: 192.168.25.1<br>
<br>
<br>
I see that to allow access to 192.168.22.1 from PC2 (via the ipsec<br>
tunnel) i should use the options "lefthostaccess=yes" (and also<br>
leftfirewall=yes) on GW1<br>
<br>
And when we use the options..we have the following iptable rules added<br>
on GW1 (thru the updown script automatically whenever the tunnel is UP)<br>
<br>
------------------------------<wbr>------------------------------<wbr>------------------------------<wbr>---------<br>
root@lssimgw1:/usr/local/etc# iptables -nvL<br>
Chain INPUT (policy ACCEPT 52 packets, 4680 bytes)<br>
pkts bytes target prot opt in out source<br>
destination<br>
0 0 ACCEPT all -- eth0 * <a href="http://192.168.22.0/24" rel="noreferrer" target="_blank">192.168.22.0/24</a><br>
<<a href="http://192.168.22.0/24" rel="noreferrer" target="_blank">http://192.168.22.0/24</a>> <a href="http://192.168.25.0/24" rel="noreferrer" target="_blank">192.168.25.0/24</a> <<a href="http://192.168.25.0/24" rel="noreferrer" target="_blank">http://192.168.25.0/24</a>><br>
policy match dir in pol ipsec reqid 1 proto 50<br>
<br>
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)<br>
pkts bytes target prot opt in out source<br>
destination<br>
0 0 ACCEPT all -- eth0 * <a href="http://192.168.22.0/24" rel="noreferrer" target="_blank">192.168.22.0/24</a><br>
<<a href="http://192.168.22.0/24" rel="noreferrer" target="_blank">http://192.168.22.0/24</a>> <a href="http://192.168.25.0/24" rel="noreferrer" target="_blank">192.168.25.0/24</a> <<a href="http://192.168.25.0/24" rel="noreferrer" target="_blank">http://192.168.25.0/24</a>><br>
policy match dir in pol ipsec reqid 1 proto 50<br>
0 0 ACCEPT all -- * eth0 <a href="http://192.168.25.0/24" rel="noreferrer" target="_blank">192.168.25.0/24</a><br>
<<a href="http://192.168.25.0/24" rel="noreferrer" target="_blank">http://192.168.25.0/24</a>> <a href="http://192.168.22.0/24" rel="noreferrer" target="_blank">192.168.22.0/24</a> <<a href="http://192.168.22.0/24" rel="noreferrer" target="_blank">http://192.168.22.0/24</a>><br>
policy match dir out pol ipsec reqid 1 proto 50<br>
<br>
Chain OUTPUT (policy ACCEPT 40 packets, 3976 bytes)<br>
pkts bytes target prot opt in out source<br>
destination<br>
0 0 ACCEPT all -- * eth0 <a href="http://192.168.25.0/24" rel="noreferrer" target="_blank">192.168.25.0/24</a><br>
<<a href="http://192.168.25.0/24" rel="noreferrer" target="_blank">http://192.168.25.0/24</a>> <a href="http://192.168.22.0/24" rel="noreferrer" target="_blank">192.168.22.0/24</a> <<a href="http://192.168.22.0/24" rel="noreferrer" target="_blank">http://192.168.22.0/24</a>><br>
policy match dir out pol ipsec reqid 1 proto 50<br>
root@lssimgw1:/usr/local/etc#<br>
------------------------------<wbr>------------------------------<wbr>------------------------------<wbr>--------------<br>
<br>
- so once we have the above fw rules in place in the INPUT/OUTPUT<br>
chain,..we can access the GW1-lan-ip from PC2 via the ipsec tunnel<br>
successfully...<br>
- The similar observation is also made for using the lefthostaccess<br>
option on GW2 too..<br>
<br>
<br>
<br>
Now if i use "righthostaccess=yes"...i dont see any rules getting added<br>
in the INPUT/OUTPUT chain...neither in GW1 or in GW2<br>
<br>
- So my query is: whats the use of the option<br>
"righthostaccess=yes"...where and when do we use this option?<br>
<br>
<br>
thanks & regards<br>
Rajiv<br>
<br>
<br>
<br><span class="HOEnZb"><font color="#888888">
</font></span></blockquote><span class="HOEnZb"><font color="#888888">
<br>
-- <br>
==============================<wbr>==============================<wbr>==========<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.<wbr>org</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" rel="noreferrer" target="_blank">www.strongswan.org</a><br>
Institute for Networked Solutions<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
==============================<wbr>=============================[<wbr>INS-HSR]==<br>
<br>
</font></span></blockquote></div><br></div>