[strongSwan] Please help: Cannot route (statically) through the Strongswan tunnel

Martin Willi martin at strongswan.org
Fri Oct 4 10:00:05 CEST 2013

Hi Răzvan,

> I am unable to ping between,, 
> and (from each other).

How does your left/rightsubnet configuration look like? Have you
included all the subnets to tunnel? What shows "ipsec statusall"?

Does a ping from make it to the first gateway? To the
second? Does the reply get lost on the return path?

> After establishing the tunnel, I am unable to enter static routes in the 
> NAT gateways themselves, since Strongswan does not create any virtual 
> tunnel interface, to be used as the <interface> parameter in the command 
> line above.

Linux does not have IPsec interfaces, and they are not needed. You can
install routes nonetheless.

However, you won't have to install any routes. strongSwan magically
installs all the required routes for the negotiated IPsec policies.
These routes won't go into the main table, though, use "ip route show
table 220" to show them.


More information about the Users mailing list