<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">Hi Tobias,
</span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">First of all, THANKS for replying and clarifying some
<span style="font-size:11pt;background-color:rgba(0, 0, 0, 0)">settings.</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">I have
<span style="font-size:11pt;background-color:rgba(0, 0, 0, 0)">completely</span> disabled the bypass-lan plugin since I do not have a use for it right now.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff"><span><span style="color:#000000;background-color:#ffffff">[root@arch-linux
~]# cat /etc/strongswan.conf</span></span><br>
</span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff">...<br>
</span></span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff"> plugins {
</span><br>
include strongswan.d/charon/*.conf <br>
bypass-lan { <br>
load = no <br>
} <br>
...</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">And, I have moved the route for the VTI to table 220 because it seems to be the right way to config routed based IPSec VPN.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff">[root@arch-linux ~]# ip rule
</span><br>
0: from all lookup local <br>
220: from all lookup 220 <br>
32766: from all lookup main <br>
32767: from all lookup default</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff">[root@arch-linux ~]# ip r s t 220
</span><br>
10.10.10.0/30 via 10.10.10.2 dev ip_vti1 src 10.10.10.2</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff">[root@arch-linux ~]# ip route
</span><br>
default via 192.168.45.1 dev ens18 <br>
192.168.45.0/24 dev ens18 proto kernel scope link src 192.168.45.30</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">I am going to add some more details of my configs because the TX Errors NoRoute are still present.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff">7:
</span><span style="color:#18b2b2;background-color:#ffffff">ip_vti1@NONE: </span>
<span style="color:#000000;background-color:#ffffff"><POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1436 qdisc noqueue state UNKNOWN group default qlen 1000
</span></span></span><br>
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"></span></span>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"> link/ipip
<span style="color:#b26818;background-color:#ffffff">192.168.45.30</span><span style="color:#000000;background-color:#ffffff"> peer
</span><span style="color:#b26818;background-color:#ffffff">192.168.45.10</span><span style="color:#000000;background-color:#ffffff"> promiscuity 0 minmtu 0 maxmtu 0 </span><br>
vti remote 192.168.45.10 local 192.168.45.30 ikey 0.0.0.42 okey 0.0.0.42 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 <br>
inet <span style="color:#b218b2;background-color:#ffffff">10.10.10.2</span><span style="color:#000000;background-color:#ffffff"> peer
</span><span style="color:#b218b2;background-color:#ffffff">10.10.10.1</span><span style="color:#000000;background-color:#ffffff">/32 scope global ip_vti1
</span><br>
valid_lft forever preferred_lft forever <br>
inet6 <span style="color:#1818b2;background-color:#ffffff">fe80::5efe:c0a8:2d1e</span><span style="color:#000000;background-color:#ffffff">/64 scope link </span><br>
valid_lft forever preferred_lft forever</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">I can also see that the IPSec added some rules to MARK packets in my iptables.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff">-A PREROUTING -d 10.10.10.0/30 -c 2352
230776 -j MARK --set-xmark 0x2a/0xffffffff</span><br>
</span><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff">-A OUTPUT -d 10.10.10.0/30 -c 3605 336028 -j MARK --set-xmark 0x2a/0xffffffff</span><br>
</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">The counters confirms that the packets are being marked. I am not sure if I should keep the MARK in iptables or remove it allowing
routing decisions to send the packets to the VTI device that will MARK the packets but according to my understanding it should not matter.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff">[root@arch-linux ~]# ip xfrm policy
</span><br>
src 0.0.0.0/0 dst 0.0.0.0/0 <br>
socket in priority 0 ptype main <br>
src 0.0.0.0/0 dst 0.0.0.0/0 <br>
socket out priority 0 ptype main <br>
src 0.0.0.0/0 dst 0.0.0.0/0 <br>
socket in priority 0 ptype main <br>
src 0.0.0.0/0 dst 0.0.0.0/0 <br>
socket out priority 0 ptype main <br>
src ::/0 dst ::/0 <br>
socket in priority 0 ptype main <br>
src ::/0 dst ::/0 <br>
socket out priority 0 ptype main <br>
src ::/0 dst ::/0 <br>
socket in priority 0 ptype main <br>
src ::/0 dst ::/0 <br>
socket out priority 0 ptype main</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">Above are the policies installed. Again, because it is a routed base VPN seems correct.
<br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff">[root@arch-linux ~]# ip xfrm state
</span><br>
src 192.168.45.30 dst 192.168.45.10 <br>
proto esp spi 0xc2239b57 reqid 1 mode tunnel <br>
replay-window 0 flag af-unspec <br>
mark 0x2a/0xffffffff <br>
aead rfc4106(gcm(aes)) 0x264acee3119a4e523af2fbf5905b50c5acc1f7be9079ff23ffa2c6473a9c507fe1ae936b 128
<br>
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 <br>
src 192.168.45.10 dst 192.168.45.30 <br>
proto esp spi 0xc661b9e5 reqid 1 mode tunnel <br>
replay-window 32 flag af-unspec <br>
aead rfc4106(gcm(aes)) 0x69a86fa6ca9448bece6ffdff77893f0e9ce5ebef604040f681b5cdd2d5976438ed005df1 128
<br>
anti-replay context: seq 0x656, oseq 0x0, bitmap 0xffffffff</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">I have added a few more NFLOG captures into my iptables and I am a bit confused with the results.
<br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">A tcpdump capture in the VTI interface with a ping from the remote ( pfSense - 10.10.10.1 ) shows :</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">No Time Source Destination<br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: monospace; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">1 0.000000 10.10.10.1 10.10.10.2 ICMP 84 Echo (ping) request id=0x9877, seq=471/55041, ttl=64 (reply in 2)</span><span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: monospace; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">2 0.000038 10.10.10.2 > 10.10.10.1 ICMP 84 Echo (ping) reply id=0x9877, seq=471/55041, ttl=64 (request in 1)</span><span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">I do not see the IPSec MARK in these packets.
<br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">The reply packets end up in the OUTPUT chain marked but not encrypted as an ESP packet. By the way I do not see the replies
even being encapsulated at all by IPSec.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">Also, the NAT chain is not having packets passing through it.<br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff">[root@arch-linux ~]# snat
</span><br>
-P PREROUTING ACCEPT -c 0 0 <br>
-P INPUT ACCEPT -c 0 0 <br>
-P OUTPUT ACCEPT -c 0 0 <br>
-P POSTROUTING ACCEPT -c 0 0 <br>
-A PREROUTING -c 0 0 -j NFLOG --nflog-group 9</span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">That is odd cause I am not able to manipulate the packets.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">I will run a ping from the local Linux (10.10.10.2) and see how the packets are flowing through the iptables chains and will
update in another email.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: calibri, helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);">In the meantime, if someone sees something that I am missing. Please let me know.</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Many Thanks.<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Tobias Brunner <tobias@strongswan.org><br>
<b>Sent:</b> Tuesday, August 31, 2021 5:51 AM<br>
<b>To:</b> Tiago Stoco <tmsblink@msn.com>; users@lists.strongswan.org <users@lists.strongswan.org><br>
<b>Subject:</b> Re: [strongSwan] IPSec route based VPN - VTI interface TX Errors NoRoute</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi Tiago,<br>
<br>
> Pings from the Linux system are being seem as errors NoRoute by the tunnel. > ...<br>
> Shunted Connections:<br>
> Bypass LAN 10.10.10.0/30: 10.10.10.0/30 === 10.10.10.0/30 PASS<br>
<br>
The reason is most likely this passthrough IPsec policy installed by the <br>
bypass-lan plugin for the subnet that is reachable (according to the <br>
main routing table) via ip_vti1. For a ping from 10.10.10.2 to <br>
10.10.10.1, the VTI interface won't find an IPsec policy to protect the <br>
packet (the passthrough policy has a higher priority), so it gets dropped.<br>
<br>
To avoid that, either install the routes via VTI in table 220 (which is <br>
ignored by the bypass-lan plugin automatically), exclude the VTI <br>
interface explicitly via charon.plugins.bypass-lan.interfaces_ignore, or <br>
just disable the bypass-lan plugin completely if you don't need it.<br>
<br>
Regards,<br>
Tobias<br>
</div>
</span></font></div>
</body>
</html>