<html><body><p>Hi list,<br/><br/>I have set up a tunnel using ikev2 and PSK to connect my home network (via a Draytek router/modem) and my internet server (public IP ranges, acting as web-/mail-/network server).<br/>First goal is, to access the respective networks behind the gateways which works so far.<br/>I'd further like to use the tunnel to proxy (internet) traffic from certain hosts in my home network via the responder to the internet.<br/>So far, I did manage to route all (!) traffic from the home network via the responder to the internet, which is not the intended solution.<br/>Side note: The Draytek router on the edge of the home network is able to set distinct routes based on source or destination IP(s) via certain interfaces (e.g. the VPN interface) and even can set definable gateways for this.<br/>I could nail down the tunnel traffic by adding just the 192.168.200.1/24 as remote/right network on the Draytek config, but then I am not able to process the occasional traffic to the internet (if routing from a certain source via the tunnel is enabled on the Draytek) without a lot of manual modifications (iptables, ip xfrm policies).<br/><br/>The current IP schema looks as follows:<br/><br/>192.168.1.0/24 Home network<br/>192.168.1.1 Draytek router<br/>192.168.1.2 VPN IP on the home network (Draytek router)<br/>192.168.1.12 Test VM<br/><br/>91.212.144.185/29 server network<br/>91.212.144.188 IPSec server IP (left on the server)<br/>192.168.200.1/24 private network IP on the server<br/><br/>Internet/WAN connect from the home network is currently set up via LTE (194.230.155.229 public IP / 10.148.130.88/32 DHCP IP from LTE provider)<br/><br/>ipsec.conf on the responder (server) side:<br/><br/>config setup<br/> #charondebug="ike 3, knl 3, cfg 3"<br/> uniqueids=no<br/><br/>conn %default<br/> compress=no<br/> keyexchange=ikev2<br/> fragmentation=yes<br/> forceencaps=yes<br/> ike=aes256-sha2_256-modp2048,aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024! # Win7 is aes256, sha-1, modp1024; iOS is aes256, sha-256, modp1024; macOS is 3DES, sha-1, modp1024<br/> esp=aes256-sha2_256,aes256-sha256,aes256-sha1,3des-sha1! # Win 7 is aes256-sha1, iOS is aes256-sha256, macOS is 3des-shal1<br/> dpdaction=restart<br/> dpddelay=30s<br/> dpdtimeout=120s<br/> keyingtries=%forever<br/> ikelifetime=28800s<br/> lifetime=3600s<br/> dpdtimeout=120s<br/><br/>conn draytek-s1<br/> auto=add<br/> type=tunnel<br/> authby=secret<br/> left=91.212.144.188<br/> leftid=server1<br/> leftsubnet=0.0.0.0/0<br/> leftfirewall=yes<br/> right=%any<br/> rightid=draytek<br/> rightsubnet=0.0.0.0/0<br/><br/>Output of ipsec statusall on the responder:<br/><br/># ipsec statusall<br/>Status of IKE charon daemon (strongSwan 5.2.1, Linux 3.16.0-4-amd64, x86_64):<br/> uptime: 12 hours, since Apr 21 23:34:17 2020<br/> malloc: sbrk 2408448, mmap 0, used 356384, free 2052064<br/> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 73<br/> loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default stroke updown<br/>Virtual IP pools (size/online/offline):<br/> 192.168.201.2: 1/0/0<br/>Listening IP addresses:<br/> 91.212.144.186<br/> 192.168.200.1<br/> 91.212.144.187<br/> 91.212.144.188<br/> 91.212.144.189 <br/>Connections:<br/> draytek-s1: 91.212.144.188...%any IKEv2, dpddelay=30s<br/> draytek-s1: local: [server1] uses pre-shared key authentication<br/> draytek-s1: remote: [draytek] uses pre-shared key authentication<br/> draytek-s1: child: 0.0.0.0/0 === 0.0.0.0/0 TUNNEL, dpdaction=restart<br/>Security Associations (1 up, 0 connecting):<br/> draytek-s1[64]: ESTABLISHED 6 minutes ago, 91.212.144.188[server1]...194.230.155.229[draytek]<br/> draytek-s1[64]: IKEv2 SPIs: 21a9d3bfe1b1f30a_i adaee24e252e33a2_r*, pre-shared key reauthentication in 7 hours<br/> draytek-s1[64]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048<br/> draytek-s1{53}: INSTALLED, TUNNEL, ESP in UDP SPIs: c000d8f9_i 2345e353_o<br/> draytek-s1{53}: AES_CBC_256/HMAC_SHA2_256_128, 6964 bytes_i, 0 bytes_o, rekeying in 36 minutes<br/> draytek-s1{53}: 192.168.200.0/24 === 192.168.1.0/24<br/><br/>Config on the initiator side (currently web UI only)<br/><img src="cid:741-5EA01600-31-49AA2B80" type="image/png" alt="" style="width:888px;height:270px;margin-top:0px;margin-bottom:0px;margin-left:0px;margin-right:0px;border:0px solid black;" width="888" vspace="0" hspace="0" height="270" border="0"/><br/>I am not sure, if embedded graphics will be displayed on the list, so here comes the abstraction in text:<br/>My WAN IP: 0.0.0.0<br/>Remote Gateway IP: 0.0.0.0<br/>Remote Network IP: 192.168.200.0<br/>Remote Network Mask: 255.255.255.0 / 24<br/>Local Network IP: 192.168.1.2<br/>Local Network Mask: 255.255.255.0 / 24<br/>RIP Direction: Disable<br/>From first subnet to remot network, you have to do: Route (NAT would be the other choice)<br/>IPsec VPN with the Same Subnets : No ticked<br/>Change default route to this VPN tunnel ( Only active if one single WAN is up ): Not ticked<br/><br/>On the responder side, I do not rely on the private network 192.168.200.0/24. Actually I only do need to connect certain services from the initiator on the responder through the VPN. Which means 192.168.1.0/24 needs to be reachable from 91.212.144.188 or its private networks at least.<br/><br/>Is there any advice/help on how to config the desired setup (to be able to occasionally route/proxy certain internet traffic from the home network through the responder)?<br/><br/>Cheers<br/>Tobi</p></body></html>