<div dir="ltr">To check your routing tables, you can use `ip route get SOME_IP_ADDRESS`.<div><br></div><div>You can also inspect the routing tables with `ip route`. One non-obvious thing is strongswan may install an additional route table. You can see all the tables that exist with `ip rule`. The one strongswan makes is called simply "220". `ip route` will show the main table, and the 220 table can be show with `ip route list table 220`. With the usual way the rules are set (ip rule), anything in table 220 will override the main table.</div><div><br></div><div>In my case I found it best to disable strongswan's management of the route table and ip addresses with the `charon.install_routes = no` and `charon.install_virtual_ip = no` settings. I handle all of it in my own networking scripts.</div>
</div><br><div class="gmail_quote"><div dir="ltr">On Thu, May 24, 2018 at 11:24 AM Gilles Printemps <<a href="mailto:gprintemps@gmail.com">gprintemps@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Some updates.<div>I'm now able to create the vti interface and I have an address assigned to the vti</div><div><br></div><div>Result of "ifconfig"</div><div>vti0 Link encap:IPIP Tunnel HWaddr<br></div><div><div> inet addr:10.3.188.149 P-t-P:10.3.188.149 Mask:255.255.255.255</div><div> UP POINTOPOINT RUNNING NOARP MTU:1332 Metric:1</div><div> RX packets:0 errors:0 dropped:0 overruns:0 frame:0</div><div> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0</div><div> collisions:0 txqueuelen:1</div><div> RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)</div></div><div><br></div><div>Can someone confirm I have now to route all the marked packets to this interface to go through the VPN?</div><div>if the address assigned to the vti can be seen as a gateway for the VPN?</div><div><br></div><div><br></div><div>FYI, following files have been updated. </div><div><br></div><div>[/etc/ipsec.conf]<br></div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"></blockquote></div></div><div dir="ltr"><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><font color="#3d85c6">conn VPN<br></font><font color="#3d85c6"> keyexchange=ike<br></font><font color="#3d85c6"> dpdaction=clear<br></font><font color="#3d85c6"> dpddelay=300s<br></font></blockquote></div></div><div dir="ltr"><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><font color="#3d85c6"> leftupdown=/etc/<a href="http://ipsec.script.sh" target="_blank">ipsec.script.sh</a><br></font><font color="#3d85c6"> left=%defaultroute<br></font><font color="#3d85c6"> leftsourceip=%config4<br></font><font color="#3d85c6"> leftauth=eap-mschapv2<br></font><font color="#3d85c6"> eap_identity=gprintemps<br></font><font color="#3d85c6"> right=<a href="http://free-nl.hide.me" target="_blank">free-nl.hide.me</a><br></font><font color="#3d85c6"> rightauth=pubkey<br></font><font color="#3d85c6"> rightid=%any<br></font><font color="#3d85c6"> rightsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br></font><font color="#3d85c6"> auto=route<br></font><font color="#3d85c6"> mark=2</font></blockquote></div><div><br></div><div>[<font color="#000000">/etc/<a href="http://ipsec.script.sh" target="_blank">ipsec.script.sh</a>]</font><br></div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"></blockquote></div></div><div dir="ltr"><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><font color="#3d85c6">#!/bin/bash</font><font color="#3d85c6"><br></font><font color="#3d85c6">set -o nounset<br></font><font color="#3d85c6">set -o errexit<br></font><font color="#3d85c6">VTI_IF="vti0"</font><font color="#3d85c6"><br></font><font color="#3d85c6">case "${PLUTO_VERB}" in<br></font><font color="#3d85c6"> up-client)<br></font><font color="#3d85c6"> ip tunnel add "${VTI_IF}" local "${PLUTO_ME}" remote "${PLUTO_PEER}" mode vti \<br></font><font color="#3d85c6"> okey "${PLUTO_MARK_OUT%%/*}" ikey "${PLUTO_MARK_IN%%/*}"<br></font><font color="#3d85c6"> ip link set "${VTI_IF}" up<br></font><font color="#3d85c6"> sysctl -w "net.ipv4.conf.${VTI_IF}.disable_policy=1"<br></font><font color="#3d85c6"> ip addr add ${PLUTO_MY_SOURCEIP} dev "${VTI_IF}"<br></font><font color="#3d85c6"> ;;<br></font><font color="#3d85c6"> down-client)<br></font><font color="#3d85c6"> ip tunnel del "${VTI_IF}"<br></font><font color="#3d85c6"> ;;<br></font><font color="#3d85c6">esac</font></blockquote></div></div><div dir="ltr"><div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, May 24, 2018 at 12:15 PM, Gilles Printemps <span dir="ltr"><<a href="mailto:gprintemps@gmail.com" target="_blank">gprintemps@gmail.com</a>></span> wrote:</div><div class="gmail_quote"><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>I already prepared the next step (after fixing the current issue), I've created the following script</div><div><br></div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><font color="#3d85c6">#! /bin/bash</font><font color="#3d85c6"><br></font><font color="#3d85c6">export TABLE_ID="vpn"<br></font><font color="#3d85c6">export VPN_USER="vpn"<br></font><font color="#3d85c6">export VPN_INTERFACE="vti0"<br></font><font color="#3d85c6">export LAN="<a href="http://10.211.55.0/24" target="_blank">10.211.55.0/24</a>"</font><font color="#3d85c6"><br></font><font color="#3d85c6"><br></font><font color="#3d85c6"># Flush iptables rules<br></font><font color="#3d85c6">iptables -F -t nat<br></font><font color="#3d85c6">iptables -F -t mangle<br></font><font color="#3d85c6">iptables -F -t filter</font><font color="#3d85c6"><br></font><font color="#3d85c6"># Mark packets from $VPN_USER<br></font><font color="#3d85c6">iptables -t mangle -A OUTPUT ! --dest $LAN -m owner --uid-owner $VPN_USER -j MARK --set-mark 0x1<br></font><font color="#3d85c6">iptables -t mangle -A OUTPUT ! --src $LAN -j MARK --set-mark 0x1</font><font color="#3d85c6"><br></font><font color="#3d85c6"># Deny $VPN_USER to access other interfaces than lo<br></font><font color="#3d85c6">iptables -A OUTPUT ! -o lo -m owner --uid-owner $VPN_USER -J DROP</font><font color="#3d85c6"><br></font><font color="#3d85c6"># Allow $VPN_USER to access lo and VPN interfaces<br></font><font color="#3d85c6">iptables -A OUTPUT -o lo -m owner --uid-owner $VPN_USER -j ACCEPT<br></font><font color="#3d85c6">iptables -A OUTPUT -o $VPN_INTERFACE -m owner --uid-owner $VPN_USER -j ACCEPT</font><font color="#3d85c6"><br></font><font color="#3d85c6"><br></font><font color="#3d85c6"># Allow response from $VPN_INTERFACE<br></font><font color="#3d85c6">iptables -A INPUT -i $VPN_INTERFACE -m conntrack --ctstate ESTABLISHED -j ACCEPT</font><font color="#3d85c6"><br></font><font color="#3d85c6"># Masquarade packets on $VPN_INTERFACE<br></font><font color="#3d85c6">iptables -t nat -A POSTROUTING -o $VPN_INTERFACE -j MASQUERADE</font><font color="#3d85c6"><br></font><font color="#3d85c6"><br></font><font color="#3d85c6"># Routing rules<br></font><font color="#3d85c6">ip route replace default via $GATEWAY table $TABLE_ID<br></font><font color="#3d85c6">ip route append default via 127.0.0.1 dev lo table $TABLE_ID<br></font><font color="#3d85c6">ip route flush cache</font></blockquote></div><div><br></div><div>Purpose to is mark all packets from VPN_USER and to redirect them to the ipsec interface created by the the configuration</div><div>I'm planning to do it with the following command:</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><font color="#3d85c6">ip rule add from all fwmark 0x1 lookup vpn</font></blockquote><div><br></div><div>Best Regards,</div><div>Gilles</div><br class="m_3449799082806001358gmail-m_-4573027745512867484gmail-Apple-interchange-newline" style="color:rgb(0,0,0);font-family:-webkit-standard"></div>
</blockquote></div><br></div></div></blockquote></div>