[strongSwan] ipsec policy priority

Max Avramenko a_max at avramenko.me
Tue Oct 15 15:31:57 CEST 2013

Have some questions

and tunnels

As result have policy:
 >src dst
 >        dir out priority 1859
 >        tmpl src dst
 >                proto esp reqid 16412 mode tunnel
 >src dst
 >        dir out priority 1859
 >        tmpl src 77.xx.xx.xx dst 109.yy.yy.yy
 >               proto esp reqid 16416 mode tunnel

Problem 1:
trafic to local IP are forwarded in tunnel. I'm manualy add several 
policy for workaround:
 >src dst
 >        dir out priority 100
 >src dst
 >        dir fwd priority 100
 >src dst
 >        dir in priority 100

Problem 2:
Sometime the priority of policy to is below that And traffic for are forwarded in tunnel 

Please give smart tips on how to proceed in solving the second problem. 
And, perhaps, there is a right decision for the first one?

More information about the Users mailing list