<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-2">
</head>
<body>
<br>
<blockquote type="cite"
cite="mid:f4865b66-aa9c-1003-b5a3-b1a95ad39886@mess.hu">
<p>If I change the order of the networks on the server, then the
first one takes precedence. For example this config:</p>
<pre><code>/ip ipsec mode-config
add address-pool=vpn.my.server.hu address-prefix-length=32 name="modeconf vpn.my.server.hu" split-include=</code><code><code>172.111.0.0/16</code>,</code><code><code>192.168.13.0/24</code>,10.0.88.0/24 static-dns=10.0.88.1 system-dns=no
</code></pre>
<p>Will add route for 172.111.0.0/16 on the client. But it won't
add 192.168.13.0/24 nor 10.0.88.0/24.<br>
</p>
<p>The problem is not with the VPN server, because I can connect
to it from Windows 10, and all routes pushed by the server are
correctly added to the routing table.</p>
</blockquote>
<p>I found this: Split-Tunneling with IKEv2
<a class="moz-txt-link-freetext" href="https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling-with-IKEv2">https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling#Split-Tunneling-with-IKEv2</a></p>
<p>In particular, it says that "most remote access clients will
propose 0.0.0.0/0 as remote traffic selector, so split-tunneling
must be configured on the gateway" and "all strongswan based
clients support this kind of narrowing". It confirms that it
should work.</p>
<p>I have checked the logs again and I found this in it:</p>
<p>Dec 22 14:10:59 laci-ryzen charon-nm: 06[IKE] IKE_SA
<a class="moz-txt-link-abbreviated" href="mailto:laci@my.server.hu">laci@my.server.hu</a>[2] established between 192.168.14.2[C=HU,
ST=Heves, L=Eger, O=my.server.hu,
<a class="moz-txt-link-abbreviated" href="mailto:CN=laci@vpn.my.server.hu">CN=laci@vpn.my.server.hu</a>]...1.2.3.5[vpn.my.server.hu]<br>
Dec 22 14:10:59 laci-ryzen charon-nm: 06[IKE] scheduling rekeying
in 35488s<br>
Dec 22 14:10:59 laci-ryzen charon-nm: 06[IKE] maximum IKE_SA
lifetime 36088s<br>
Dec 22 14:10:59 laci-ryzen charon-nm: 06[CFG] handling
INTERNAL_IP4_NETMASK attribute failed<br>
Dec 22 14:10:59 laci-ryzen charon-nm: 06[CFG] handling
INTERNAL_IP4_SUBNET attribute failed<br>
Dec 22 14:10:59 laci-ryzen charon-nm: 06[CFG] handling
INTERNAL_IP4_SUBNET attribute failed<br>
Dec 22 14:10:59 laci-ryzen charon-nm: 06[IKE] installing new
virtual IP 10.0.88.100<br>
Dec 22 14:10:59 laci-ryzen avahi-daemon[1177]: Registering new
address record for 10.0.88.100 on enp5s0.IPv4.<br>
Dec 22 14:10:59 laci-ryzen charon: 05[KNL] 10.0.88.100 appeared on
enp5s0<br>
</p>
<p>I think that these "INTERNAL_IP4_SUBNET attribute failed"
messages are emitted because the client cannot add the policies
for the subnets. There are 3 subnets specified in split-include.
The first one is always added, and there are 2 error messages for
the remaining two. This is only a guess, I'm not sure.<br>
</p>
<p>But where is the error coming from? The "attribute handling
failed" message is not too useful for finding the root of the
problem.</p>
<p>It could be because lack of permissions - but that is unlikely.
It can always add the first subnet, probably the user has
permission many of them.</p>
<p>I'm clueless.</p>
<p><br>
</p>
</body>
</html>