<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.E-MailFormatvorlage20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.E-MailFormatvorlage21
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1726490436;
mso-list-type:hybrid;
mso-list-template-ids:-1691585918 -324106816 67567619 67567621 67567617 67567619 67567621 67567617 67567619 67567621;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:Calibri;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hello Noel and list,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">yes I’ll try to provide all informations.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Problem: IPv6 tunnel and IPv4 traffic – no routing entries and no ping LAN<->LAN possible<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Setup: Linux with strongSwan 5.8.0 , site-2-site VPN to another strongSwan 5.8.0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Config below: <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">eth0 = Interface with IPv6 for tunnel connection<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">eth2 = LAN <o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">daemon start:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:14 strongswan charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.8.0, Linux 4.4.0-142-generic, i686)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:14 strongswan kernel: [ 209.226536] Initializing XFRM netlink socket<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:14 strongswan charon: 00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:14 strongswan charon: 00[CFG] loading aa certificates from '/usr/local/etc/ipsec.d/aacerts'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:14 strongswan charon: 00[CFG] loading ocsp signer certificates from '/usr/local/etc/ipsec.d/ocspcerts'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:14 strongswan charon: 00[CFG] loading attribute certificates from '/usr/local/etc/ipsec.d/acerts'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:14 strongswan charon: 00[CFG] loading crls from '/usr/local/etc/ipsec.d/crls'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:14 strongswan charon: 00[CFG] loading secrets from '/usr/local/etc/ipsec.secrets'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:14 strongswan charon: 00[LIB] loaded plugins: charon rc2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf xcbc cmac
attr kernel-netlink resolve socket-default farp stroke vici updown eap-identity eap-md5 eap-mschapv2 dhcp counters<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:14 strongswan charon: 00[JOB] spawning 16 worker threads<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:18 strongswan charon: 10[CFG] loaded IKE shared key with id 'ike1' for: 'vpnserver1', 'digibox1'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:18 strongswan charon: 04[CFG] added vici connection: conn1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:32 strongswan charon: 00[DMN] signal of type SIGINT received. Shutting down<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:36 strongswan charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.8.0, Linux 4.4.0-142-generic, i686)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:36 strongswan charon: 00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:36 strongswan charon: 00[CFG] loading aa certificates from '/usr/local/etc/ipsec.d/aacerts'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:36 strongswan charon: 00[CFG] loading ocsp signer certificates from '/usr/local/etc/ipsec.d/ocspcerts'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:36 strongswan charon: 00[CFG] loading attribute certificates from '/usr/local/etc/ipsec.d/acerts'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:36 strongswan charon: 00[CFG] loading crls from '/usr/local/etc/ipsec.d/crls'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:36 strongswan charon: 00[CFG] loading secrets from '/usr/local/etc/ipsec.secrets'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:36 strongswan charon: 00[LIB] loaded plugins: charon rc2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf xcbc cmac
attr kernel-netlink resolve socket-default farp stroke vici updown eap-identity eap-md5 eap-mschapv2 dhcp counters<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:36 strongswan charon: 00[JOB] spawning 16 worker threads<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:42 strongswan charon: 07[CFG] loaded IKE shared key with id 'ike1' for: 'vpnserver1', 'digibox1'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Jan 29 13:17:42 strongswan charon: 11[CFG] added vici connection: conn1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Connection up:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">root@strongswan:/home/rudt/projects/vpn-server# swanctl -i --ike conn1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[IKE] initiating IKE_SA conn1[1] to 2003:ec:efff:c93:5ee2:8cff:fe9b:c4c0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[NET] sending packet: from 2003:a:769:4100:1::200[500] to 2003:ec:efff:c93:5ee2:8cff:fe9b:c4c0[500] (750 bytes)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[NET] received packet: from 2003:ec:efff:c93:5ee2:8cff:fe9b:c4c0[500] to 2003:a:769:4100:1::200[500] (38 bytes)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[ENC] parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[IKE] peer didn't accept DH group ECP_256, it requested MODP_2048<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[IKE] initiating IKE_SA conn1[1] to 2003:ec:efff:c93:5ee2:8cff:fe9b:c4c0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[NET] sending packet: from 2003:a:769:4100:1::200[500] to 2003:ec:efff:c93:5ee2:8cff:fe9b:c4c0[500] (942 bytes)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[NET] received packet: from 2003:ec:efff:c93:5ee2:8cff:fe9b:c4c0[500] to 2003:a:769:4100:1::200[500] (462 bytes)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[CFG] selected proposal: IKE:AES_GCM_16_128/PRF_AES128_XCBC/MODP_2048<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[IKE] authentication of 'vpnserver1' (myself) with pre-shared key<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[NET] sending packet: from 2003:a:769:4100:1::200[500] to 2003:ec:efff:c93:5ee2:8cff:fe9b:c4c0[500] (147 bytes)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[NET] received packet: from 2003:ec:efff:c93:5ee2:8cff:fe9b:c4c0[500] to 2003:a:769:4100:1::200[500] (97 bytes)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[ENC] parsed IKE_AUTH response 1 [ IDr AUTH ]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[IKE] authentication of 'digibox1' with pre-shared key successful<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[IKE] IKE_SA conn1[1] established between 2003:a:769:4100:1::200[vpnserver1]...2003:ec:efff:c93:5ee2:8cff:fe9b:c4c0[digibox1]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[IKE] scheduling reauthentication in 9940s<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[IKE] maximum IKE_SA lifetime 11020s<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">initiate completed successfully<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">VPN config:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">connections {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> conn1 {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> local_addrs = %any<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> remote_addrs = <IPv6_DYNDNS_NAME><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> local {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> auth = psk<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> id = vpnserver1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> remote {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> auth = psk<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> id = digibox1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> children {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> child1 {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> local_ts = 10.10.10.0/24<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> remote_ts = 192.168.2.0/24<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> updown = /usr/libexec/ipsec/_updown iptables<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> rekey_time = 5400<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> rekey_bytes = 500000000<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> rekey_packets = 1000000<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> version = 2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> mobike = no<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> reauth_time = 10800<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">secrets {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> ike1 {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> id1 = vpnserver1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> id2 = digibox1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> secret = <PASSWORD><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Status:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Status of IKE charon daemon (strongSwan 5.8.0, Linux 4.4.0-142-generic, i686):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> uptime: 12 minutes, since Jan 29 13:17:35 2020<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> malloc: sbrk 1208320, mmap 0, used 180120, free 1028200<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> loaded plugins: charon rc2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf xcbc cmac attr kernel-netlink resolve socket-default
farp stroke vici updown eap-identity eap-md5 eap-mschapv2 dhcp counters<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Listening IP addresses:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> 192.168.0.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> 2003:a:769:4100:1::200<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> 10.10.10.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Connections:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> conn1: %any...dbzyvpnt1.dynv6.net IKEv2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> conn1: local: [vpnserver1] uses pre-shared key authentication<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> conn1: remote: [digibox1] uses pre-shared key authentication<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> child1: child: 10.10.10.0/24 === 192.168.2.0/24 TUNNEL<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Security Associations (1 up, 0 connecting):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> conn1[1]: ESTABLISHED 9 minutes ago, 2003:a:769:4100:1::200[vpnserver1]...2003:ec:efff:c93:5ee2:8cff:fe9b:c4c0[digibox1]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> conn1[1]: IKEv2 SPIs: 7166966c8917ccac_i* 9ef970b95e825009_r, pre-shared key reauthentication in 2 hours<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> conn1[1]: IKE proposal: AES_GCM_16_128/PRF_AES128_XCBC/MODP_2048<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Firewall:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"># Generated by iptables-save v1.4.21 on Wed Jan 29 13:34:58 2020<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">*filter<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">:INPUT ACCEPT [7:633]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">:FORWARD ACCEPT [0:0]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">:OUTPUT ACCEPT [4:544]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">COMMIT<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"># Completed on Wed Jan 29 13:34:58 2020<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Ip6tables-save no output, but there is also all flushed and all policies ACCEPT<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Routing:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">default via 192.168.0.240 dev eth0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">10.10.10.0/24 dev eth2 proto kernel scope link src 10.10.10.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">broadcast 10.10.10.0 dev eth2 table local proto kernel scope link src 10.10.10.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">local 10.10.10.1 dev eth2 table local proto kernel scope host src 10.10.10.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">broadcast 10.10.10.255 dev eth2 table local proto kernel scope link src 10.10.10.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">broadcast 192.168.0.0 dev eth0 table local proto kernel scope link src 192.168.0.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">local 192.168.0.1 dev eth0 table local proto kernel scope host src 192.168.0.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">broadcast 192.168.0.255 dev eth0 table local proto kernel scope link src 192.168.0.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">unreachable default dev lo table unspec proto kernel metric 4294967295 error -101<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">2003:a:769:4100:1::200 dev eth0 proto kernel metric 256<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">2003:a:769:4100::/56 dev eth0 proto kernel metric 256 expires 2591939sec<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">fe80::/64 dev eth0 proto kernel metric 256<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">fe80::/64 dev eth2 proto kernel metric 256<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">default via 2003:a:769:4100:1::240 dev eth0 metric 1024<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">default via fe80::178:1 dev eth0 proto ra metric 1024 expires 1739sec hoplimit 64<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">unreachable default dev lo table unspec proto kernel metric 4294967295 error -101<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">local ::1 dev lo table local proto none metric 0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">local 2003:a:769:4100:1::200 dev lo table local proto none metric 0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">local fe80::a00:27ff:fe15:5da0 dev lo table local proto none metric 0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">local fe80::a00:27ff:fef0:ec33 dev lo table local proto none metric 0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">ff00::/8 dev eth0 table local metric 256<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">ff00::/8 dev eth2 table local metric 256<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">unreachable default dev lo table unspec proto kernel metric 4294967295 error -101<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">IP addresses:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> inet 127.0.0.1/8 scope host lo<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> valid_lft forever preferred_lft forever<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> inet6 ::1/128 scope host<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> valid_lft forever preferred_lft forever<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> link/ether 08:00:27:f0:ec:33 brd ff:ff:ff:ff:ff:ff<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> inet 192.168.0.1/24 brd 192.168.0.255 scope global eth0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> valid_lft forever preferred_lft forever<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> inet6 2003:a:769:4100:1::200/128 scope global<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> valid_lft forever preferred_lft forever<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> inet6 fe80::a00:27ff:fef0:ec33/64 scope link<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> valid_lft forever preferred_lft forever<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> link/ether 08:00:27:ec:04:ec brd ff:ff:ff:ff:ff:ff<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> link/ether 08:00:27:15:5d:a0 brd ff:ff:ff:ff:ff:ff<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> inet 10.10.10.1/24 brd 10.10.10.255 scope global eth2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> valid_lft forever preferred_lft forever<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> inet6 fe80::a00:27ff:fe15:5da0/64 scope link<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> valid_lft forever preferred_lft forever<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Test:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">ping 192.168.2.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Result:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">tcpdump -i eth0 host 192.168.2.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">13:40:25.989010 IP 192.168.0.1 > 192.168.2.1: ICMP echo request, id 1382, seq 31, length 64<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Test:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">ping -s 10.10.10.1 192.168.2.1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Result:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Same as above<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Expected result:<o:p></o:p></span></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l0 level1 lfo1"><span style="mso-fareast-language:EN-US">at least one routing entry in table 220<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l0 level1 lfo1"><span style="mso-fareast-language:EN-US">IPv6 ESP packets going out, not unencrypted traffic<o:p></o:p></span></li></ul>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Please, any hint/help what is wrong ?<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thomas<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>Von:</b> Noel Kuntze <noel.kuntze+strongswan-users-ml@thermi.consulting>
<br>
<b>Gesendet:</b> Mittwoch, 29. Januar 2020 11:22<br>
<b>An:</b> Thomas Rudolph <rudt@teleconnect.de>; users@lists.strongswan.org<br>
<b>Betreff:</b> Re: [strongSwan] IPv6 tunnel and IPv4 traffic: no routing entries in table 220 ?<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>Hello Thomas, <o:p></o:p></p>
<p>Routes are added when traffic needs to be sent to another destination than the main routing table or existing routes in table 220 do. It's all in C code.<o:p></o:p></p>
<p>Please provide all information as shown on he HelpRequests page on the wiki if you want any actionable advice.
<o:p></o:p></p>
<p>Kind regards <o:p></o:p></p>
<p>Noel <o:p></o:p></p>
<p>Am 29.01.20 um 11:18 schrieb Thomas Rudolph: <br>
> Hello, <br>
> <br>
> <br>
> <br>
> I wonder how the routing entries are written to table 220, and which are neccesary. Is there any place , like _updown for firewall rules, where I can see how and what is done ?<o:p></o:p></p>
<p>> <br>
> <br>
> <br>
> My problem: <br>
> <br>
> <br>
> <br>
> If I use IPv4 tunnel and traffic, it’s all ok, rules in table 220 appear and VPN works from LAN to LAN.
<br>
> <br>
> If I use IPv6 tunnel and IPv4 traffic, nothing appears in table 220. What can be the reason for such behavior ?
<br>
> <br>
> <br>
> <br>
> And, I was not able to find myself a rule that works, I tried to add to table 220 rules like
<br>
> <br>
> <br>
> <br>
> ip route add 192.168.2.0/24 proto static scope global dev eth0 src 192.168.0.1 table 220
<br>
> <br>
> <br>
> <br>
> with REMOTE_LAN_NET src LOCAL_LAN_ADDRESS <br>
> <br>
> <br>
> <br>
> (derived from strongSwan example <a href="https://www.strongswan.org/testing/testresults/ipv6/net2net-ip4-in-ip6-ikev2/">
https://www.strongswan.org/testing/testresults/ipv6/net2net-ip4-in-ip6-ikev2/</a> )
<br>
> <br>
> <br>
> <br>
> <br>
> <br>
> but it dont’t work. VPN connection is up, but no ping from LAN to LAN, it seems the traffic is not thrown into tunnel (policy based VPN).<o:p></o:p></p>
<p>> <br>
> <br>
> <br>
> <br>
> <br>
> ? <br>
> <br>
> <br>
> <br>
> Can anyone please give a hint ? <br>
> <br>
> <br>
> <br>
> <br>
> <br>
> Regards, <br>
> <br>
> <br>
> <br>
> Thomas <br>
<br>
<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
</div>
</body>
</html>