<html><head></head><body bgcolor="#ffffff" text="#3d3d3d" link="#19b6ee" vlink="#3d3d3d"><div>On Wed, 2018-07-25 at 18:33 -0600, James Lay wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>On Wed, 2018-07-25 at 06:53 -0600, James Lay wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><pre>On 2018-07-24 06:51, Tobias Brunner wrote:</pre><pre></pre><pre>Hi James,</pre><pre><br></pre><pre></pre><pre>So I moved to Strongswan 5.6.2 during a distribution upgrade.</pre><pre><br></pre><pre>What distribution? What was the previous version? Do you still have</pre><pre>the same plugins installed and enabled?</pre><pre><br></pre><pre></pre><pre>My simple</pre><pre>setup no longer routes back to the client (I can see the incoming </pre><pre>pings</pre><pre>on the server, but nothing goes back). I establish a tunnel fine...my</pre><pre>setup looks like this:</pre><pre><br></pre><pre><br></pre><pre>external_IP_nic2 <-> 192.168.1.1_nic2 192.168.1.0/24 subnet</pre><pre><br></pre><pre>all I need is to have a connected device able to access</pre><pre>192.168.1.1...and it's only a single user.</pre><pre><br></pre><pre>Please read [1]. From the involved IPs I guess you used the farp </pre><pre>plugin</pre><pre>before, so make sure you still have that installed and loaded.</pre><pre><br></pre><pre>Regards,</pre><pre>Tobias</pre><pre><br></pre><pre>[1]</pre><pre><a href="https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling">https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling</a></pre><pre><br></pre><pre>Thanks Tobias...I have access to the old server so I'll see what's </pre><pre>there...I don't recall installing any other plugins, but we shall see. </pre><pre>I'll report my findings soon..thanks again.</pre><pre><br></pre><pre>James</pre><pre><br></pre></blockquote><div><br></div><div>So now I'm super confused. I changed to the below:</div><div><br></div><div style="white-space: normal;"><font face="monospace" size="3">conn rw </font></div><div style="white-space: normal;"><font face="monospace" size="3">leftsubnet=192.168.1.0/24</font></div><div style="white-space: normal;"><font face="monospace" size="3">leftcert=StrongSwanHostCert.pem</font></div><div style="white-space: normal;"><font face="monospace" size="3">right=%any</font></div><div style="white-space: normal;"><font face="monospace" size="3">rightsourceip=172.16.0.1</font></div><div style="white-space: normal;"><font face="monospace" size="3">auto=add </font></div><div><font face="monospace" size="3"><br></font></div><div><br></div><div>and added the below top 2 postrouting nat rules:</div><div><font face="monospace" size="3"> pkts bytes target prot opt in out source destination </font></div><div><font face="monospace" size="3"> 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 policy match dir out pol ipsec</font></div><div><font face="monospace" size="3"> 0 0 MASQUERADE all -- * enp0s31f6 172.16.0.1 0.0.0.0/0 </font></div><div><font face="monospace" size="3">24519 1646K MASQUERADE all -- * ppp0 192.168.1.0/24 0.0.0.0/0 </font></div><div><font face="monospace" size="3"><br></font></div><div>However when I attempt to ping, I see the ping on the ppp0 interface, and the source isn't 172.16.0.1:</div><div>2<font face="monospace" size="3">018-07-25 18:26:37.085194521 8.0.0.1 → 192.168.1.1 ICMP 100 Echo (ping) request id=0x0004, seq=1/256, ttl=64</font></div><div><font face="monospace" size="3"><br></font></div><div>Not exactly sure where to go next. I did install the extra plugins that include farp as well. Thank you.</div><div><br></div><div>James</div><div><div></div></div></blockquote><div><br></div><div><br></div><div>Anything on this? in testing I made this change:</div><div><br></div><div><font face="monospace" size="3">rightsourceip=10.10.10.0/24</font></div><div><br></div><div>Pinging from the client connected device gets me this:</div><div><br></div><div><font face="monospace" size="3">1 2018-07-29 07:50:27.606525877 8.0.10.1 → 192.168.1.1 ICMP 100 Echo (ping) request id=0x000f, seq=1/256, ttl=64</font></div><div><font face="monospace" size="3"><br></font></div><div>Something seems very broken. Thank you.</div><div><br></div><div>James</div></body></html>