[strongSwan] Why can I only see incoming un-encrypted traffic ? Outgoing cleartext traffic is not visible on the strongswan box.

[Noel Kuntze]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hello Charles,

That is an anonamly of how tcpdump captures on interfaces.
Use nflog rules in iptables to capture traffic and make tcpdump/wireshark
log packets on the nflog socket.

- -A INPUT -m policy --pol ipsec --dir in -j NFLOG --nflog-group 5
- -A FORWARD -m policy --pol ipsec --dir in -j NFLOG --nflog-group 5
- -A OUTPUT -m policy --pol ipsec --dir out -j NFLOG --nflog-group 5

Tadaaa.

- -- 

Mit freundlichen Grüßen/Kind Regards,
Noel Kuntze

GPG Key ID: 0x63EC6658
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJV3ypUAAoJEDg5KY9j7GZY7y8P/Ard/07mnnF2bQxpN8+SWMC1
Kn+NH/FApRwoPeZrXTESI8ligJ4ThPLKrAS2HYrczKJs4hX5FKZOcG65DsLz7bMe
5z7/N0JPF4RYYYe1ixn/VeIIl8emHm0GpmMBlvXlqb9XI02EvA8jqTVNnRd/Cif/
9pRKBGezQiFnkMrWLnznTBy02JR1saKVnvJdX2dlBXW10TX7VY+g+xLsXbOF0yje
nQ/0JFeQNh8x0MAC5cbwrGXsFbX4zZ6dUBCDurX5AxluOqVEuZ/4eEnjOBs26gl+
wzo7pxcKrc4gBYFd9Z5BCDTomlWlzhyEbZssxL0ZeGm1q2zPr8bQVBKpwnwYJ9R/
qe4dMZiIT6WpPlAS5FNVLLmDMr0vDmFwhF84j9agHahBdY8tVaU3jUK93xnPQHaO
hd39CoRmxOcltBlCmaxEM3skgJ+00aCMmIO3cihEmqE20Rx2+R43el6m820Gor0e
V8+yUk5RzyGBYWwfsCCk0g6W7+/lULL7Ai3cMiOREhVs4bG43UzY3iKaGBfoWuPC
2cDAZbqCmAowHqXA82qK5Qf7BNIK7h0I40j+IiZLDrEeKsIkAUDRlYpnxbqQKvzx
JHPjb9lnpSGrfOYibw9xN7PIIx+tD1x3DaqIcM3brmp5i8S6lOtZ5PNLj3AuhMIQ
wip6QPWQnQ7aMpsQHvSc
=S8K4
-----END PGP SIGNATURE-----