[strongSwan] unable to ping local gateway in roadwarrior configuration

[Mihai Ordean]

Hey Martin

Thanks for your prompt reply.

Status of IKE charon daemon (strongSwan 5.1.2, Linux 3.10.17-g86ce428, armv7l):

> -----Original Message-----
> You probably won't need ESP/AH forwarding rules, as in your NAT situation all traffic is UDP encapsulated over ports 500/4500.

You are right, there the traffic does get encapsulated. 


> > and ipsec statusall is:
> > Security Associations (0 up, 0 connecting):
> 
> Your "ipsec statusall" shows no active connections. No client currently connected?

I am appending below the "ipsec statusall" with a client connected:

malloc: sbrk 1216512, mmap 0, used 214312, free 1002200
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 5
  loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pkcs1 pkcs7 pkcs8 pkcs12 pem openssl xcbc cmac hmac ctr ccm gcm attr kernel-netlink resolve socket-default farp stroke updown eap-identity eap-mschapv2 xauth-generic dhcp addrblock
Listening IP addresses:
  192.168.7.1
Connections:
roadwarrior-eap:  %any...%any  IKEv2
roadwarrior-eap:   local:  [dnsname.com] uses public key authentication
roadwarrior-eap:    cert:  "C=UK, O= dnsname.com, CN= dnsname.com"
roadwarrior-eap:   remote: uses EAP_MSCHAPV2 authentication with EAP identity '%any'
roadwarrior-eap:   child:  0.0.0.0/0 === dynamic TUNNEL
Security Associations (1 up, 0 connecting):
roadwarrior-eap[2]: ESTABLISHED 20 seconds ago, 192.168.7.1[dnsname.com]...147.188.254.202[10.8.50.4]
roadwarrior-eap[2]: Remote EAP identity: some.identity
roadwarrior-eap[2]: IKEv2 SPIs: b42cd00ab10b4a49_i 397b754c1c6e59fb_r*, public key reauthentication in 2 hours
roadwarrior-eap[2]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
roadwarrior-eap{2}:  INSTALLED, TUNNEL, ESP in UDP SPIs: cdc15832_i 462cf18a_o
roadwarrior-eap{2}:  AES_CBC_256/HMAC_SHA1_96, 51187 bytes_i (384 pkts, 0s ago), 14072 bytes_o (132 pkts, 1s ago), rekeying in 42 minutes
roadwarrior-eap{2}:   0.0.0.0/0 === 192.168.7.58/32
 


> > The problem that I have is that I am able to ping the network
> > computers (i.e. 192.168.7.5) but I am unable to ping the gateway
> > itself (192.168.7.1).
> 
> If pinging the LAN hosts works, your IPsec policies get negotiated correctly. Likely that your routing or firewall configuration drops
> packets.
> 
> If you ping your internal gateway address, do you see incoming packets when sniffing on your gateway? Do you see ESP packets
> leaving?
> 
> > 192.168.7.0    *  255.255.255.0      U       0      0        0 br-lan
> 
> strongSwan installs a route to table 220 (ip route show table 220), which should go over your Sky router. It overrides the LAN route to
> your DHCP-assigned road-warrior IP. Can you confirm this route gets installed correctly?


"ip route show table 220" returns empty. I guess the problem is here that the route does not get installed. DO you have any suggestions about fixing this?


Thanks
Mihai