<HTML><BODY><div class="js-helper js-readmsg-msg">
<style type="text/css"></style>
<div>
<base target="_self" href="https://e.mail.ru/">
<div id="style_15224303720000000082_BODY">In case this comes up for someone in a search: SOLVED.<br>
Need this on the server:<br>
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 128<br>
<br>
<br>
>Вторник, 25 июля 2017, 20:24 +03:00 от strongswan_user@mail.ru:<br>
><br>
>Hello all!<br>
><br>
>I want the common "hide IP" feature of VPN. I (tried to) use the tunnel mode (no L2TP), IKEv2, and manually (and naively?) set the needed D/SNAT rules. It all basically works, but not for all web sites. All http seem to work (mostly..), and most https are fine too, while some https take forever, as if no reply from DNS (no errors; Firefox). I don't know anything about<br>
>TLS debugging, and I didn't try to actually debug it (yet).<br>
><br>
>Below are details of how I did it. Hopefully I'm just missing some simple setting, and somebody can spot it.. Or, alternatively, could you suggest some instructions how to set it up best?<br>
><br>
><br>
> .1.21 .1.20 .2.20 .2.21 .3.20 .3.21 .4.20 .4.21 .5.20 .5.21<br>
> Ca---------CG-----------I1-------------J1------+-----SG------------Sa<br>
>client: NAT these 2 hosts | NAT server<br>
>Firefox gateway simulate internet | gateway<br>
> |<br>
> |<br>
> |<br>
> Internet |.4.31<br>
> provider's tap2 - my real PC<br>
> real internet ----------- router ----------- eth0<br>
> 192.168.100.1 192.168.100.101<br>
><br>
>(copy-paste to a fixed-width editor to view it properly)<br>
><br>
>The upper part is in Qemu/KVM, strongSwan U5.5.1/K4.9.0-3-amd64. IP addresses are like 10.0.x.y, .x.y indicated. All Qemus and my PC are Debian 9 Stretch. The bottom is real hardware.<br>
><br>
>SG forwards (DNAT) all traffic to Sa:<br>
>iptables -t nat -A PREROUTING -p all ! -s 10.0.5.21 -d 10.0.4.21 \\<br>
>-m state --state NEW,ESTABLISHED,RELATED -j DNAT --to 10.0.5.21<br>
><br>
>Assume below:<br>
>CLIENT_PRIVATE_IP="10.0.1.23";<br>
>SERV_PUBLIC_IP="10.0.4.21"<br>
>SERV_PRIVATE_IP="10.0.5.21"<br>
><br>
>Main magic for the VPN feature I want, on Sa:<br>
>iptables -t nat -A POSTROUTING -s $CLIENT_PRIVATE_IP -j SNAT --to-source $SERV_PRIVATE_IP<br>
>iptables -t nat -A PREROUTING -d $SERV_PRIVATE_IP \\<br>
>-m state --state NEW,ESTABLISHED,RELATED -j DNAT --to $CLIENT_PRIVATE_IP<br>
><br>
>The host (real PC) masquerades all packets coming from tap2:<br>
>iptables -t nat -A POSTROUTING -s 10.0.4.0/24 -j MASQUERADE<br>
><br>
>Default gateway for J1 is my host's tap2 address - 10.0.4.31<br>
><br>
>Server Sa:<br>
><br>
>/etc/ipsec.conf :<br>
>config setup<br>
>conn %default<br>
> keyexchange=ikev2<br>
>conn vpn1<br>
> leftsubnet=0.0.0.0/0<br>
> right=%any<br>
> rightid=$CLIENT_PRIVATE_IP<br>
> rightsubnet=$CLIENT_PRIVATE_IP/32<br>
> auto=route<br>
> authby=secret<br>
><br>
>/etc/ipsec.secrets :<br>
>$CLIENT_PRIVATE_IP : PSK 0x123<br>
><br>
>Client Ca:<br>
><br>
>/etc/ipsec.conf :<br>
>config setup<br>
>conn %default<br>
> keyexchange=ikev2<br>
>conn vpn1<br>
> right=$SERV_PUBLIC_IP<br>
> rightid=$SERV_PRIVATE_IP<br>
> rightsubnet=0.0.0.0/0<br>
> auto=start<br>
> authby=secret<br>
><br>
>/etc/ipsec.secrets :<br>
>$SERV_PRIVATE_IP : PSK 0x123<br>
><br>
>(strongSwan config files not touched, default)<br>
><br>
>I tried to reduce MTU to 1280 (from 1500) on Sa - no luck.<br>
><br>
>Thank you - whoever replies with some hints.<br>
<br>
--<br>
</div>
<base target="_self" href="https://e.mail.ru/">
</div>
</div></BODY></HTML>