[strongSwan] Ping is not working after establishing a tunnel in strongswan
tobias at strongswan.org
Mon Apr 16 11:20:57 CEST 2012
> I have established a VPN tunnel between GW and VPN server using
Is the tunnel between those two hosts intended as host-host tunnel or as
host-net tunnel? What did you configure for left|rightsubnet?
If your SPD entries are any indication it seems you configured
rightsubnet=0.0.0.0/0 on GW. That is, you end up with this outbound
> 22.214.171.124[any] 0.0.0.0/0[any] any
> out prio high + 1073739901 ipsec
Which means that any packet leaving the host with a source address of
126.96.36.199 will be sent into this tunnel.
Now you'd assume that this won't apply for a ping sent from
172.31.114.230 to 172.31.114.231, but if you are using IKEv2 a source
route is installed which will force 188.8.131.52 as source for any packets
sent from GW (i.e. also for the ICMP replies). This route is installed
in routing table 220 by default (which is created with a priority of
220). The table and/or priority can be changed with the
charon.routing_table and charon.routing_table_prio strongswan.conf
options, respectively (or with the respective ./configure arguments).
To prevent the daemon from installing these routes altogether you can
set charon.install_routes=no in strongswan.conf.
More information about the Users