<div dir="ltr"><div><div><div><div><div><div><div>Hello,<br><br></div>My setup is as follows:<br><br></div>(<a href="http://10.1.48.0/23" target="_blank">10.1.48.0/23</a>) R1<-(vlan)->R2<-(ipsec)->R3 (<a href="http://10.46.0.0/16" target="_blank">10.46.0.0/16</a>)<br><br></div>Traffic
from R1 that is destined for something behind R3 is correctly forwarded
by R2 through the ipsec vti tunnel but the return traffic is not
forwarded by R2 to R3 but instead it is forwarded back to R3. This
effectively causes lots of bouncing of traffic between R2 and R3.<br><br></div>I
am using a vti interface with marks to enable route based ipsec as I am
running BGP on all routers. It feels like R2 still uses the policies to
route traffic in and out of the vti tunnel as whenI change the
rightsubnet to <a href="http://10.46.0.0/16" target="_blank">10.46.0.0/16</a> it all works.<br><br></div>ipsec.conf:<br>config setup<br><br>conn %default<br> aggressive = no<br> closeaction = restart<br> compress = no<br> dpdaction = restart<br> dpddelay = 10s<br> dpdtimeout = 30s<br> esp = aes128-sha256-modp2048s256,aes<wbr>128-sha1-modp1024!<br> ike = aes256-sha256-modp2048s256,aes<wbr>128-sha1-modp1024!<br> ikelifetime = 28800s<br> installpolicy = yes<br> lifetime = 3600s<br> mobike = no<br> reauth = no<br> rekey = yes<br> leftauth = psk<br> rightauth = psk<br> leftsubnet = <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> rightsubnet = <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br> leftupdown = /etc/strongswan.d/ipsec-vti.sh<br><br>conn prod<br> auto = start<br> type = tunnel<br> mark = 991<br> left = 149.1.1.1<br> right = 51.1.1.1<br> keyexchange = ikev2<br><br><br></div>charon.conf:<br>charon {<br> install_routes = no<br>}<br><br></div>Other useful info:<br># iptables -nL -t mangle<br>Chain PREROUTING (policy ACCEPT)<br>target prot opt source destination <br><br>Chain INPUT (policy ACCEPT)<br>target prot opt source destination <br>MARK esp -- 51.1.1.1 149.1.1.1 MARK set 0x3df<br><br>Chain FORWARD (policy ACCEPT)<br>target prot opt source destination <br>TCPMSS tcp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> tcp flags:0x06/0x02 TCPMSS clamp to PMTU<br><br>Chain OUTPUT (policy ACCEPT)<br>target prot opt source destination <br><br>Chain POSTROUTING (policy ACCEPT)<br>target prot opt source destination <br><br><div><div># ifconfig vti1<br>vti1 Link encap:IPIP Tunnel HWaddr <br> inet addr:172.29.253.80 P-t-P:10.46.0.254 Mask:255.255.255.255<br> UP POINTOPOINT RUNNING NOARP MTU:1350 Metric:1<br> RX packets:5210 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:5201 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:1 <br> RX bytes:402059 (402.0 KB) TX bytes:405173 (405.1 KB)<br><br><br># cat /etc/strongswan.d/ipsec-vti.sh<br>#!/bin/bash<br>IP=$(which ip)<br>IPTABLES=$(which iptables)<br>SYSCTL=$(which sysctl)<br><br>case "$PLUTO_CONNECTION" in<br> prod)<br> VTI_INTERFACE=vti1<br> VTI_LOCALADDR=172.29.253.80<br> VTI_REMOTEADDR=10.46.0.254<br> MARK_IN=$(echo $PLUTO_MARK_IN | grep -o -E "^[0-9]+")<br> MARK_OUT=$(echo $PLUTO_MARK_OUT | grep -o -E "^[0-9]+")<br> ;;<br>esac<br><br>case "${PLUTO_VERB}" in<br> up-client)<br> echo "uping interface ${VTI_INTERFACE}"<br> $IP link add ${VTI_INTERFACE} type vti local ${PLUTO_ME} remote ${PLUTO_PEER} ikey ${MARK_IN} okey ${MARK_OUT}<br> $SYSCTL -w net.ipv4.conf.${VTI_INTERFACE}<wbr>.disable_policy=1<br> $SYSCTL -w net.ipv4.conf.${VTI_INTERFACE}<wbr>.rp_filter=2 || $SYSCTL -w net.ipv4.conf.${VTI_INTERFACE}<wbr>.rp_filter=0<br> $IP addr add ${VTI_LOCALADDR} remote ${VTI_REMOTEADDR} dev ${VTI_INTERFACE}<br> $IP link set ${VTI_INTERFACE} up mtu 1350<br> $IPTABLES -t mangle -I FORWARD -o ${VTI_INTERFACE} -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu<br> $IPTABLES -t mangle -I INPUT -p esp -s ${PLUTO_PEER} -d ${PLUTO_ME} -j MARK --set-xmark ${MARK_IN}<br> $IP route flush table 220<br> ;;<br> down-client)<br> echo "downing interface ${VTI_INTERFACE}"<br> $IP link del ${VTI_INTERFACE}<br> $IPTABLES -t mangle -D FORWARD -o ${VTI_INTERFACE} -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu<br> $IPTABLES -t mangle -D INPUT -p esp -s ${PLUTO_PEER} -d ${PLUTO_ME} -j MARK --set-xmark ${MARK_IN}<br> ;;<br>esac<br># Enable IPv4 forwarding<br>$SYSCTL -w net.ipv4.ip_forward=1<br>$SYSCTL -w net.ipv4.conf.ens5.disable_<wbr>xfrm=1<br>$SYSCTL -w net.ipv4.conf.ens5.disable_<wbr>policy=1<div class="gmail-yj6qo"></div><div class="gmail-adL"><br></div></div></div><br></div>