<html><head></head><body><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div dir="ltr" data-setdir="false">Hello,</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">I am facing issue with strongswan on Android (version 8/10). </div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Strongswan is able to connect and establish first CHILD SA successfully. App also shows it is connected.</div><div dir="ltr" data-setdir="false"><span><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);">12[IKE] CHILD_SA android{1} established with SPIs a84e5850_i cd5ddffe_o and TS 172.5.0.16/32 === 192.168.124.0/24</span></span><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Route corresponding to this tunnel</div><div dir="ltr" data-setdir="false"><div><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);">ip route show table 0</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);">172.5.0.16 dev tun1 table 1181 proto static scope link</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);">192.168.124.0/24 dev tun1 table 1181 proto static scope link</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);">default via 10.117.198.1 dev rmnet0 table 1003 proto static</span></div><br></div><div dir="ltr" data-setdir="false">ifconfig tun</div><div dir="ltr" data-setdir="false"><div><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);">tun1 Link encap:UNSPEC</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"> inet addr:172.5.0.16 P-t-P:172.5.0.16 Mask:255.255.255.255</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"> UP POINTOPOINT RUNNING MTU:1500 Metric:1</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"> RX packets:0 errors:0 dropped:0 overruns:0 frame:0</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"> collisions:0 txqueuelen:500</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"> RX bytes:0 TX bytes:0</span></div><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">If I do ping to 192.168.124.100, it works well. Wireshark capture shows ESP request/response packets.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">However, if I open TCP connection for remote address as 192.168.124.100 port 6000, TCP packets are not going over tunnel interface, rather they go over wifi interface and I can see destination of SYN packet as 192.168.124.100 and source as wifi interface address.</div><div dir="ltr" data-setdir="false">netstat</div><div dir="ltr" data-setdir="false"><div><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);">Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program Name</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);">tcp 0 0 0.0.0.0:1467 0.0.0.0:* LISTEN -</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);">tcp 0 0 100.83.59.59:40979 216.239.36.135:443 ESTABLISHED -</span><br style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);"><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(34, 37, 41);">tcp 0 1 100.83.59.59:40642 192.168.124.100:6000 SYN_SENT -</span></div>No SYN ACK since packets are going directly on wifi interface.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">I also tried to bind TCP socket to my TUN interface IP but still same issue - SYN packet going directly out on the wifi interface.</div><div dir="ltr" data-setdir="false">netstat shows</div><div dir="ltr" data-setdir="false"><span><span style="color: rgb(209, 210, 211); font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; background-color: rgb(26, 29, 33);">tcp6 0 1 ::ffff:172.5.0.16:6002 ::ffff:192.168.124:6000 SYN_SENT -</span></span><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Configuration selected on Android app</div><div dir="ltr" data-setdir="false">IKEv2 EAP (Username/Password)</div><div dir="ltr" data-setdir="false">Andriod version 10 and tried on 8. Tried with emulator and Samsung Galaxy 10.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Please let me know what could be the possible issue.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Thanks,</div><div dir="ltr" data-setdir="false">Pankaj</div></div></body></html>