<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hey,<div class=""><br class=""></div><div class="">I have carefully read through previous archived posts on here about this topic and have also made it all the way to page 10 in Google search before giving up. So far I wasn't able to find anything that was able to help me.</div><div class=""><br class=""></div><div class="">I am trying to setup split tunneling in swanctl.conf server side, so on the responder end. I am struggling a bit with the terminology but I get better, please correct if I am wrong. The initiator is an iPhone running iOS 13.3.</div><div class=""><br class=""></div><div class="">In a previous E-Mail thread here I have stumbled onto this which has helped me in many ways:</div><div class=""><br class=""></div><div class=""><div class=""><i class="">The leftsubnet parameter controls what source addresses in an IP packet are valid for tunneling.</i></div><div class=""><i class="">The rightsubnet parameter controls what destination addresses in an IP packet are valid for tunneling.</i></div><div class=""><i class="">Those two constraints are used to find out what packets should go through the tunnel by checking</i></div><div class=""><i class="">the source and destination and seeing if both match.</i></div></div><div class=""><i class=""><br class=""></i></div><div class=""><br class=""></div><div class=""><span style="font-style: normal;" class="">I had a base config that is working great with my iPhone but it sends everything through the tunnel, with local_ts set to 0.0.0.0/0.</span></div><div class=""><span style="font-style: normal;" class="">In order to get my feet wet I figured I try to remove everything but the IP of my own web server and go from there, since I could watch the access logs and see the IP there as a form of verification (I have another server in another range that was watching as well). Setting that IP range in remote_ts leads to the iPhone being unable to establish any internet connections anymore</span></div><div class=""><span style="font-style: normal;" class=""><br class=""></span></div><div class=""><span style="font-style: normal;" class="">This is my current config. Commenting out the remote_ts line leads to a perfectly working connection again.</span></div><div class=""><span style="font-style: normal;" class=""><br class=""></span></div><div class=""><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">connections {</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> ikev2_iphoneos {</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> version = 2</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> proposals = aes256-sha384-ecp384,default</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> rekey_time = 0s</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> pools = dhcp_ipv4</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> fragmentation = yes</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> mobike = yes</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> encap = yes</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> send_cert = always</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> dpd_delay = 90s</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> local {</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> cert_gateway {</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> file = .crt</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> }</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> id = </div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> }</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> remote {</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> auth = eap-mschapv2</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> eap_id = %any</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> }</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> children {</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> ikev2_iphoneos {</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> mode = tunnel</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> local_ts = 0.0.0.0/0</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> remote_ts = 212.12.47.1/29, 8.8.0.0/16</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> rekey_time = 0s</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> dpd_action = clear</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> esp_proposals = aes256gcm16-ecp384,default</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> }</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> }</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> }</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">}</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">pools {</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> dhcp_ipv4 {</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> addrs = 10.99.0.0/16</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> dns = 8.8.4.4, 8.8.8.8</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> }</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">}</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">secrets {</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> ecdsa_gateway {</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> id = </div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> file = .key</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class=""> }</div><div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: "Helvetica Neue";" class="">}</div></div><div class=""><span style="font-style: normal;" class=""><br class=""></span></div><div class=""><span style="font-style: normal;" class=""><br class=""></span></div><div class=""><span style="font-style: normal;" class=""><br class=""></span></div><div class=""><span style="font-style: normal;" class="">I then tried setting local_ts to the public IPv4 address of my server which leads to a perfectly working connection but effectively nothing being tunneled anymore. My guess right now is that local_ts is always wrong and I can't use 0.0.0.0/0 since that would mean everything. I have tried setting it to the virtual IP range but that leads to errors being thrown server side (responder) while establishing the connection.</span></div><div class=""><span style="font-style: normal;" class=""><br class=""></span></div><div class=""><br class=""></div><div class="">Thank you very much for any help in advance!</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Best</div><div class=""><br class=""></div><div class="">CJ</div><div class=""><br class=""></div></body></html>