[strongSwan] unable to install source route if node has two WAN ports
simon.chan3 at yahoo.ca
Thu Jul 28 05:30:52 CEST 2011
Back in Dec 2009 Johannes RuBek wrote:
>I've nailed the problem down to our second "wan" interface.
>We have two interfaces connected to the internet and therefore two
>eth4 which is connected via SDSL and ppp0 which is connected to ADSL.
>eth4 is the default route, ppp0 adds a default route to table 210, which
>is used for policy routes based on firewall marks.
>the ip on eth4 is what we have in left=.
>If i take down ppp0, strongswan installs source routes as expected.
>If ppp0 is there, strongswan gets the "Network is unreachable" error.
>I think strongswan might be confused by the two default gateways here..
>Is it possible that strongswan uses the wrong gateway as nexthop on the
>Do you have any suggestions for a case like that?
Two years later I am facing the exact same problem on Ubuntu 10.10 with Strongswan 4.5.1. Where do I go to report bug in Strongswan?
Overview of the setup:
a.. Tunnel is between 192.168.1.0 and 192.168.2.0 subnets. Tunnel can only pass traffic one way, from 192.168.1.0 to 2.0 but not the other way around.
b.. 192.168.2.1 is the end with problem. It has two WAN interfaces (call them 184.108.40.206 and 220.127.116.11). So ip route list table main shows two default routes. Also ip route list table 220 is empty.
c.. When charon tries to setup the route, it calls get_nexthop() for 18.104.22.168. The function returns gw of 22.214.171.124 instead of gateway for 126.96.36.199.
d.. Following that charon complains "received netlink error: no such process" and "unable to install source route for 192.168.2.1".
e.. If I use "ip route del" to remove default routes involving the second WAN interface, charon can install the route successfully and the tunnel passes traffic both ways.
f.. A minor detail: the route "default via 6.6.6.x dev eth2" appears twice, one in main table and another in a user table. I have to delete both of them.
Below are the specifics and syslog.
charon: 05[KNL] getting a local address in traffic selector 192.168.2.0/24
charon: 05[KNL] using host 192.168.2.1
charon: 05[KNL] getting address to reach 188.8.131.52
charon: 05[KNL] getting interface name for 184.108.40.206
charon: 05[KNL] 220.127.116.11 is on interface eth1
charon: 05[KNL] installing route: 192.168.1.0/24 via 18.104.22.168 src 192.168.2.1 dev eth1
charon: 05[KNL] getting iface index for eth1
charon: 05[KNL] received netlink error: No such process (3)
charon: 05[KNL] unable to install source route for 192.168.2.1
# The primary network interface
iface eth1 inet static
iface eth1:1 inet static
# LAN interface
iface eth0 inet static
# Extra interface 1
iface eth2 inet dhcp
ip route list table 220 is empty
(expecting: 192.168.1.0/24 via 22.214.171.124 dev eth1 proto static src 192.168.2.1)
ip route list table main
126.96.36.199/29 dev eth1 proto kernel scope link src 188.8.131.52
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.1
184.108.40.206/22 dev eth2 proto kernel scope link src 220.127.116.11
default via 18.104.22.168 dev eth1 metric 90
default via 22.214.171.124 dev eth2 metric 100
extra info: there is another pair of default routes
involving the two wan ports
ip rule list
0: from all lookup local
220: from all lookup 220
10101: from 126.96.36.199/29 lookup wan1
10102: from 188.8.131.52/22 lookup wan2
32766: from all lookup main
32767: from all lookup default
ip route list table wan1
default via 184.108.40.206 dev eth1
ip route list table wan2
default via 220.127.116.11 dev eth2
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Users