<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-2">
</head>
<body>
<p><br>
</p>
<p> Hi,</p>
<p>I have a VPN server on a MikroTik router. I'm trying to connect
to it from strongswan client on Ubuntu 10.04.1 LTS.</p>
<p>This is how I installed strongswan:</p>
<p>apt install strongswan network-manager-strongswan strongswan-nm
libstrongswan-extra-plugins strongswan-swanctl</p>
<p>Then I used the network manager applet (GUI) to add a new VPN
connection. The server uses IKEv2 with server and client side
certificates for authentication.<br>
</p>
<p>My problem is that when I connect to the server, only the first
route is added.</p>
<p>For example, if I have this on the server:</p>
<pre><code>/ip ipsec mode-config
add address-pool=vpn.my.server.hu address-prefix-length=32 name="modeconf vpn.my.server.hu" split-include=192.168.13.0/24,</code><code><code>172.111.0.0/16</code>,10.0.88.0/24 static-dns=10.0.88.1 system-dns=no
</code></pre>
<p>Then I can see this in ip xfrm policy after the VPN server is
connected:<br>
</p>
<pre><code>
<b>src 10.0.88.100/32 dst 192.168.13.0/24 </b>
dir out priority 371327
tmpl src 192.168.14.2 dst 1.2.3.5
proto esp spi 0x0c51282e reqid 4 mode tunnel
<b>src 192.168.13.0/24 dst 10.0.88.100/32 </b>
dir fwd priority 371327
tmpl src 1.2.3.5 dst 192.168.14.2
proto esp reqid 4 mode tunnel
<b>src 192.168.13.0/24 dst 10.0.88.100/32 </b>
dir in priority 371327
tmpl src 1.2.3.5 dst 192.168.14.2
proto esp reqid 4 mode tunnel
</code>
</pre>
As you can see, 172.11.0.0/16 was not added. 10.0.88.0/24 was also
not added.
<p>If I change the order of the networks on the server, then the
first one takes precedence. For example this config:</p>
<pre><code>/ip ipsec mode-config
add address-pool=vpn.my.server.hu address-prefix-length=32 name="modeconf vpn.my.server.hu" split-include=</code><code><code>172.111.0.0/16</code>,</code><code><code>192.168.13.0/24</code>,10.0.88.0/24 static-dns=10.0.88.1 system-dns=no
</code></pre>
<p>Will add route for 172.111.0.0/16 on the client. But it won't add
192.168.13.0/24 nor 10.0.88.0/24.<br>
</p>
<p>The problem is not with the VPN server, because I can connect to
it from Windows 10, and all routes pushed by the server are
correctly added to the routing table.</p>
<p>There must be an option somewhere for this, but I just can't find
it.</p>
<p>Thanks,</p>
<p> Laszlo</p>
<p><br>
</p>
</body>
</html>