[strongSwan] Can't make routing work to pass Internet traffic

Phil Frost phil at postmates.com
Sun May 6 19:52:59 CEST 2018

On Sat, May 5, 2018 at 2:58 AM Arab Abdulla <arab666 at protonmail.com> wrote:

> Client 1 send the packet addressed for, and the server receives
> it. Now the server doesn't know about the routing tables on client 1: it
> only knows it has this packet addressed to How does the server
> know a packet for should go through client 2?
> It seems it's the root of the problem. Why the server does not know? Why
> gateway is not used? My routing on client 1 is:
> root at ubuntu1604:~# ip r g
> via dev ipsec2  src
>     cache
> So, IPSEC should incapsulate its destination and sends traffic to
>, is not it? But, instead, on server I see (49 is client 1 and 47
> is server):
> 19:38:57.180893 IP > UDP-encap:
> ESP(spi=0xc3d23f24,seq=0xc), length 120
> 19:38:57.180981 IP > ICMP echo request, id 13060, seq
> 12, length 64

That's simply not how IP works. Without any special options, the IP header
doesn't contain the path, but only the final destination. Nominally, the
path is determined independently by each router deciding what the next hop
is, and adjacent routers are on the same L2 network (which may be a
point-to-point ethernet link of only two hosts, or in your case, a virtual
one implemented as an IPsec tunnel.)

The canonical solution would be to have a route on the server (, I
think it was?). Other ideas involve an ipip tunnel between the clients
( and, or possibly you can do something with IP source
routing options.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20180506/322d8d8d/attachment.html>

More information about the Users mailing list