<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Tobias,<div class=""><br class=""></div><div class="">The only difference between the VMs is the Ubuntu distribution, as I cloned and did a release upgrade (sudo do-release-upgrade).</div><div class=""><br class=""></div><div class="">All 3 VPN clients were assigned the same IP and are connected in parallel and dropping packets obviously, don't know what to tell you but maybe someone can test this?</div><div class=""><br class=""></div><div class="">Here are the steps to reproduce:</div><div class="">Install Ubuntu Server 16.04 LTS from ISO </div><div class="">apt-get the necessary strongswan packages, </div><div class="">install let's encrypt certificate</div><div class="">configure ipsec.conf and ipsec.secrets</div><div class="">Connect more than 1 client to verify everything is working (works fine here)</div><div class="">Upgrade from 16.04 LTS to 18.04 LTS</div><div class=""><div class="">Connect more than 1 client to verify everything is working (did not work for me)</div></div><div class=""><div class="">Upgrade from 18.04 LTS to 20.04 LTS</div><div class=""></div></div><div class=""><div class="">Connect more than 1 client to verify everything is working (still not working for me)</div><div class=""></div></div><div class=""><br class=""></div><div class="">ipsec.secrets:</div><div class=""><div class=""><font face="Menlo" class=""><FQDN> : RSA "/etc/ipsec.d/private/server-key.pem"</font></div><div class=""><font face="Menlo" class="">testuser : EAP "testpassword"</font></div></div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Magnus<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On December 1, 2020, at 08:58, Tobias Brunner <<a href="mailto:tobias@strongswan.org" class="">tobias@strongswan.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Magnus,<br class=""><br class=""><blockquote type="cite" class="">root@vpn:~# ipsec leases<br class="">Leases in pool '10.0.214.220-10.0.214.250', usage: 1/31, 1 online<br class=""> 10.0.214.220 online ‘/userid/'<br class="">root@vpn:~#<br class=""></blockquote><br class="">This output makes no sense if three clients are concurrently connected<br class="">(online leases are not reassigned). Check the output of `ipsec<br class="">statusall`, are there really three clients online (with duplicate<br class="">traffic selectors)? Or do you have uniqueids enabled and clients just<br class="">got the same offline lease assigned after the existing IKE_SA was closed<br class="">(check the log)?<br class=""><br class=""><blockquote type="cite" class="">*If I change:*<br class="">*rightsourceip=10.0.214.220-10.0.214.250*<br class=""><br class="">*to:*<br class="">rightsourceip=10.0.214.0/24<br class=""><br class="">The VPN server then hands out unique IPs in both 18.04 LTS and 20.04 LTS<br class=""></blockquote><br class="">That makes even less sense because other than how the address pool is<br class="">constructed (i.e. how the size and base address are determined) there is<br class="">no difference in the implementation. There is even a unit test that<br class="">uses the same identity to request multiple (different) addresses from a<br class="">range-based address pool.<br class=""><br class="">Regards,<br class="">Tobias<br class=""></div></div></blockquote></div><br class=""></div></body></html>