[strongSwan] Connecting two right subnets

Lars strongswan at chewie.de
Fri Nov 4 18:58:53 CET 2016

Hello all,

I've set up a gateway using StrongSwan 5.3 and IKEv1. Road-Warriors that 
connect to this gateway receive virtual IP addresses from the 
subnet. Additionally, two Routers with the subnets and are connected to the gateway. 
>From a road-warrior I can reach clients in all three subnets. What I can't do 
is reaching clients in the subnet from the 
subnet (and vice-versa). This makes sense because no child SA  for == is installed.
If I understand the documentation correctly, I will have to add something like 
this to the ipsec.conf

conn Net2Net

My problem is that LEFTIP and RIGHTIP are dynamic IPs (the routers initiate 
the connection), so I can't really fill in a IP addresses there. Does anybody 
of you know how I can tell strongswan to connect the two subnets once both 
routers have established their connection?

(I know that I might could use some kind of dyndns service to resolve the 
dynamic IP addresses. But I would like to be independent of external services 
if possible.)

Thanks for your help!

More information about the Users mailing list