<html><head></head><body>*immediate from-mobile contradiction*<br><br>Policies will be applied before any route based VPN are in play. So in your examples the policy will be applied. Take care that strongSwan is configured to insert the routes. Otherwise source IP selection can be a problem.<br><br>Kind regards<br><br>Noel<br><br>Sent from mobile<br><br><div class="gmail_quote">Am December 20, 2019 4:56:51 PM UTC schrieb Michael Schwartzkopff <ms@sys4.de>:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">On 20.12.19 17:42, Marco Berizzi wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Hello everyone,<br><br> I need to setup a 0.0.0.0/0 to 0.0.0.0/0 ipsec tunnel.<br> I was thinking to setup it with the new xfrm interfaces:<br> I don't need route all the 0.0.0.0/0 throught this vpn.<br><br> My question is how 'route based' and 'policies based'<br> VPNs will coexist on the same linux box.<br><br> For example, if I'm going to implement a 0.0.0.0/0 to<br> 0.0.0.0/0 vpn with the xfrm interfaces and then I will<br> route the traffic only for the 155.192.168.0/24 network<br> throught the ipsec0 device (for example), and then I<br> implement a classic policy based vpn (without the xfrm<br> interface) with the following traffic selectors<br> 166.172.16.0/24 and 177.16.172.0/24, what will happen?<br> Will the linux kernel process the packets for the<br> 166.172.16.0/24 and 177.16.172.0/24 into the right ipsec<br> policy?<br><br> Thanks<br><br> Marco<br></blockquote><br>I think mixing policy and route based VPNs on the same machine with<br>overlapping network ranges will cause trouble. I'd change to only<br>route-based VPNs in that case.<br><br><br>Mit freundlichen Grüßen,<br></pre></blockquote></div></body></html>