<html><head></head><body bgcolor="#ffffff" text="#3d3d3d" link="#19b6ee" vlink="#3d3d3d"><div>On Sun, 2018-07-29 at 07:53 -0600, James Lay wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>On Wed, 2018-07-25 at 18:33 -0600, James Lay wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>On Wed, 2018-07-25 at 06:53 -0600, James Lay wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><pre>On 2018-07-24 06:51, Tobias Brunner wrote:</pre><pre></pre><pre>Hi James,</pre><pre><br></pre><pre></pre><pre>So I moved to Strongswan 5.6.2 during a distribution upgrade.</pre><pre><br></pre><pre>What distribution? What was the previous version? Do you still have</pre><pre>the same plugins installed and enabled?</pre><pre><br></pre><pre></pre><pre>My simple</pre><pre>setup no longer routes back to the client (I can see the incoming </pre><pre>pings</pre><pre>on the server, but nothing goes back). I establish a tunnel fine...my</pre><pre>setup looks like this:</pre><pre><br></pre><pre><br></pre><pre>external_IP_nic2 <-> 192.168.1.1_nic2 192.168.1.0/24 subnet</pre><pre><br></pre><pre>all I need is to have a connected device able to access</pre><pre>192.168.1.1...and it's only a single user.</pre><pre><br></pre><pre>Please read [1]. From the involved IPs I guess you used the farp </pre><pre>plugin</pre><pre>before, so make sure you still have that installed and loaded.</pre><pre><br></pre><pre>Regards,</pre><pre>Tobias</pre><pre><br></pre><pre>[1]</pre><pre><a href="https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling">https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling</a></pre><pre><br></pre><pre>Thanks Tobias...I have access to the old server so I'll see what's </pre><pre>there...I don't recall installing any other plugins, but we shall see. </pre><pre>I'll report my findings soon..thanks again.</pre><pre><br></pre><pre>James</pre><pre><br></pre></blockquote><div><br></div><div>So now I'm super confused. I changed to the below:</div><div><br></div><div style="white-space: normal;"><font face="monospace" size="3">conn rw </font></div><div style="white-space: normal;"><font face="monospace" size="3">leftsubnet=192.168.1.0/24</font></div><div style="white-space: normal;"><font face="monospace" size="3">leftcert=StrongSwanHostCert.pem</font></div><div style="white-space: normal;"><font face="monospace" size="3">right=%any</font></div><div style="white-space: normal;"><font face="monospace" size="3">rightsourceip=172.16.0.1</font></div><div style="white-space: normal;"><font face="monospace" size="3">auto=add </font></div><div><font face="monospace" size="3"><br></font></div><div><br></div><div>and added the below top 2 postrouting nat rules:</div><div><font face="monospace" size="3"> pkts bytes target prot opt in out source destination </font></div><div><font face="monospace" size="3"> 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 policy match dir out pol ipsec</font></div><div><font face="monospace" size="3"> 0 0 MASQUERADE all -- * enp0s31f6 172.16.0.1 0.0.0.0/0 </font></div><div><font face="monospace" size="3">24519 1646K MASQUERADE all -- * ppp0 192.168.1.0/24 0.0.0.0/0 </font></div><div><font face="monospace" size="3"><br></font></div><div>However when I attempt to ping, I see the ping on the ppp0 interface, and the source isn't 172.16.0.1:</div><div>2<font face="monospace" size="3">018-07-25 18:26:37.085194521 8.0.0.1 → 192.168.1.1 ICMP 100 Echo (ping) request id=0x0004, seq=1/256, ttl=64</font></div><div><font face="monospace" size="3"><br></font></div><div>Not exactly sure where to go next. I did install the extra plugins that include farp as well. Thank you.</div><div><br></div><div>James</div><div><div></div></div></blockquote><div><br></div><div><br></div><div>Anything on this? in testing I made this change:</div><div><br></div><div><font face="monospace" size="3">rightsourceip=10.10.10.0/24</font></div><div><br></div><div>Pinging from the client connected device gets me this:</div><div><br></div><div><font face="monospace" size="3">1 2018-07-29 07:50:27.606525877 8.0.10.1 → 192.168.1.1 ICMP 100 Echo (ping) request id=0x000f, seq=1/256, ttl=64</font></div><div><font face="monospace" size="3"><br></font></div><div>Something seems very broken. Thank you.</div><div><br></div><div>James</div></blockquote><div><br></div><div>And some startup and connect logs:</div><div><br></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.6.2, Linux 4.15.0-29-generic, x86_64)</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] PKCS11 module '<name>' lacks library path</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] disabling load-tester plugin, not configured</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[LIB] plugin 'load-tester': failed to load - load_tester_plugin_create returned NULL</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] dnscert plugin is disabled</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] ipseckey plugin is disabled</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] attr-sql plugin: database URI not set</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] loaded ca certificate "C=CH, O=strongSwan, CN=strongSwan Root CA" from '/etc/ipsec.d/cacerts/StrongSwanCACert.pem'</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] loaded RSA private key from '/etc/ipsec.d/private/StrongSwanHostKey.pem'</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] sql plugin: database URI not set</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] opening triplet file /etc/ipsec.d/triplets.dat failed: No such file or directory</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] eap-simaka-sql database URI missing</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] loaded 0 RADIUS server configurations</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] HA config misses local/remote address</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] no threshold configured for systime-fix, disabled</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[CFG] coupling file path unspecified</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[LIB] loaded plugins: charon test-vectors unbound ldap pkcs11 tpm aesni aes rc2 sha2 sha1 md4 md5 mgf1 rdrand random nonce x509 revocation constraints acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey dnscert ipseckey pem openssl gcrypt af-alg fips-prf gmp curve25519 agent chapoly xcbc cmac hmac ctr ccm gcm ntru bliss curl soup mysql sqlite attr kernel-netlink resolve socket-default connmark farp stroke updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-pam xauth-noauth tnc-tnccs tnccs-20 tnccs-11 tnccs-dynamic dhcp whitelist lookip error-notify certexpire led radattr addrblock unity counters</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[LIB] dropped capabilities, running as uid 0, gid 0</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 00[JOB] spawning 16 worker threads</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway ipsec[12353]: charon (12392) started after 100 ms</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway ipsec_starter[12353]: charon (12392) started after 100 ms</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 06[CFG] received stroke: add connection 'rw'</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 06[CFG] adding virtual IP address pool 172.16.0.1</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 06[CFG] loaded certificate "C=CH, O=strongSwan, CN=ns1.domain" from 'StrongSwanHostCert.pem'</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 06[CFG] id 'external_ip' not confirmed by certificate, defaulting to 'C=CH, O=strongSwan, CN=ns1.domain'</font></div><div><font face="monospace" size="3">Jul 29 07:29:44 gateway charon: 06[CFG] added configuration 'rw'</font></div><div><font face="monospace" size="3">Jul 29 07:30:13 gateway charon: 10[NET] received packet: from x.x.15.77[7388] to external_ip[500] (716 bytes)</font></div><div><font face="monospace" size="3">Jul 29 07:30:13 gateway charon: 10[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]</font></div><div><font face="monospace" size="3">Jul 29 07:30:13 gateway charon: 10[IKE] x.x.15.77 is initiating an IKE_SA</font></div><div><font face="monospace" size="3">Jul 29 07:30:13 gateway charon: 10[IKE] x.x.15.77 is initiating an IKE_SA</font></div><div><font face="monospace" size="3">Jul 29 07:30:13 gateway charon: 10[IKE] remote host is behind NAT</font></div><div><font face="monospace" size="3">Jul 29 07:30:13 gateway charon: 10[IKE] sending cert request for "C=CH, O=strongSwan, CN=strongSwan Root CA"</font></div><div><font face="monospace" size="3">Jul 29 07:30:13 gateway charon: 10[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ]</font></div><div><font face="monospace" size="3">Jul 29 07:30:13 gateway charon: 10[NET] sending packet: from external_ip[500] to x.x.15.77[7388] (297 bytes)</font></div><div><font face="monospace" size="3">Jul 29 07:30:15 gateway charon: 11[NET] received packet: from x.x.15.77[7380] to external_ip[4500] (1364 bytes)</font></div><div><font face="monospace" size="3">Jul 29 07:30:15 gateway charon: 11[ENC] parsed IKE_AUTH request 1 [ EF(1/4) ]</font></div><div><font face="monospace" size="3">Jul 29 07:30:15 gateway charon: 11[ENC] received fragment #1 of 4, waiting for complete IKE message</font></div><div><font face="monospace" size="3">Jul 29 07:30:15 gateway charon: 12[NET] received packet: from x.x.15.77[7380] to external_ip[4500] (1364 bytes)</font></div><div><font face="monospace" size="3">Jul 29 07:30:15 gateway charon: 12[ENC] parsed IKE_AUTH request 1 [ EF(2/4) ]</font></div><div><font face="monospace" size="3">Jul 29 07:30:15 gateway charon: 12[ENC] received fragment #2 of 4, waiting for complete IKE message</font></div><div><font face="monospace" size="3">Jul 29 07:30:15 gateway charon: 13[NET] received packet: from x.x.15.77[7380] to external_ip[4500] (1364 bytes)</font></div><div><font face="monospace" size="3">Jul 29 07:30:15 gateway charon: 13[ENC] parsed IKE_AUTH request 1 [ EF(3/4) ]</font></div><div><font face="monospace" size="3">Jul 29 07:30:15 gateway charon: 13[ENC] received fragment #3 of 4, waiting for complete IKE message</font></div><div><font face="monospace" size="3">Jul 29 07:30:15 gateway charon: 14[NET] received packet: from x.x.15.77[7380] to external_ip[4500] (1156 bytes)</font></div><div><font face="monospace" size="3">Jul 29 07:30:15 gateway charon: 14[ENC] parsed IKE_AUTH request 1 [ EF(4/4) ]</font></div></body></html>