<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Clement,</p>
<p>I think, you can safely remove this route entry, since it's
handled by the policy.</p>
<p>Or (and I'd prefer this way) configure route-based VPN
(<a class="moz-txt-link-freetext" href="https://wiki.strongswan.org/projects/strongswan/wiki/RouteBasedVPN">https://wiki.strongswan.org/projects/strongswan/wiki/RouteBasedVPN</a>),
just to avoid confuses when using both routing and policy
switching at the same time.<br>
</p>
<div class="moz-cite-prefix">On 23.02.2021 12:37, Support SimpleRezo
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CALVu1vYz+avZnhEWam8B8V0-CJjeq=ckrU2GXhNPUX8Au5UcDw@mail.gmail.com">
<pre class="moz-quote-pre" wrap="">Hi
I have setup a StrongSWAN VPN IPsec tunnel between two hosts:
[LAN_A] <=> [HOST_A][PUBLIC_IP_A] <=> [PUBLIC_IP_B][HOST_B] <=> [LAN_B]
LAN_A: 192.168.1.0/24
LAN_B: 192.168.6.0/24
HOST_A route:
192.168.6.0/24 gw PUBLIC_IP_A
It's working: hosts on LAN_A can reach LAN_B hosts and vice-versa.
But, on the endpoints running StrongSWAN, I cannot reach remote LAN except if I
specify the source address of LAN.
host_A# ping 192.168.6.1
(no answer)
host_A# ping -S 192.168.1.254 192.168.6.1
(works)
That's seems logic to me, because by default packet sent to remote LAN are
using the route LAN_B gateway IP_PUBLIC_A, so kernel is using IP_PUBLIC_A
as source (checks by tcpdump).
What I need to setup to be able to reach the remote LAN from each peer
without specifying source IP address ?
Thanks for you help
--
Clement
SimpleRezo
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Volodymyr Litovka
"Vision without Execution is Hallucination." -- Thomas Edison</pre>
</body>
</html>