[strongSwan] site 2 site does not work ...

Andreas Steffen andreas.steffen at strongswan.org
Wed Jun 6 17:37:06 CEST 2012


a normal net2net connection should do the trick:




Just make sure that in the network there is
a route to the net via the [default] gateway and in the network a route exists
which directs traffic for the network to

If gateway is NAT-ing traffic from the
network towards the Internet then you must exempt the traffic
to be tunneled from the NAT rule by inserting an IPsec
policy rule into your firewall:

iptables -A POSTROUTING -s -o eth0 -m policy \
            --dir out --pol ipsec --proto esp -j ACCEPT

iptables -A POSTROUTING -s -o eth0 -j MASQUERADE

assuming the is eth0.

Best regards


On 06/06/2012 02:41 PM, Dr.Peer-Joachim Koch wrote:
> Hi,
> I'm trying to find out how build something like a
> side2side connection using strongswan.
> We have an external host with a private subnet (
> This subnet should be visible from the gw host and all
> hosts within the subnet of gw host.
> Here is an overview
>            external host
> - 10.01.1
>            gw host
> -
> So how can I make the external network accessaible
> from our network ?
> I did not find any example (or did not look at the right place ..).
> The host-host connection is working fine, but a ping into the external
> network does not reach the destination, but can be seen in the log of
> the external host. Therefore the routing (in both directions) seems to
> be the problem.
> Any help would be welcome!

Andreas Steffen                         andreas.steffen at strongswan.org
strongSwan - the Linux VPN Solution!                www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)

More information about the Users mailing list