[strongSwan] Please help: Cannot route (statically) through the Strongswan tunnel

Martin Willi martin at strongswan.org
Fri Oct 4 12:04:46 CEST 2013

>          leftsubnet=,
>          rightsubnet=,

These subnets include the directly attached subnets, but not the other
ones (I assume you do no NAT on your internal routers?).

If you want to tunnel all the subnets, use something like:


This is IPsec, you can (and have to) explicitly control what goes in and
out of a tunnel.

Also, what's the reason to include the gateways external address in the
IPsec policy? This is usually not needed, unless the clients/gateways
use IPsec secured services reachable on the external gateway interface.


More information about the Users mailing list