[strongSwan] Multiple connections same virtual pool without sharing FIXED

Tobias Brunner tobias at strongswan.org
Wed Oct 17 09:23:55 CEST 2018

Hi Marwan,

>> How does it do that?  Do you mean it allocates addresses from
>> to those clients?  (Without the server being aware of that,
>> which is not a good idea.)  Or does it NAT traffic from these devices to
>> the IP address it received from the VPN server?
> The idea is that the client has its connection configured with e.g.
> “leftsubnet=” and each device located on the
> subnet allocates a virtual IP address from

Then you definitely don't need virtual IPs managed by the VPN server.
Just use that leftsubnet configuration (and rightsubnet set accordingly
on the server) and get rid of left|rightsourceip.

>> So why not use distinct subnets?  Reaching these devices from other
>> hosts (e.g. behind the VPN server, or the server itself) could be tricky
>> if they have the same IP addresses assigned.  And depending on the
>> traffic selector on the server's side and whether you use marks this
>> will actually result in duplicate IPsec policies, which won't work.
> Many of our customers that are setting up these "clients" are already
> connected to a VPN when they wish to connect to the devices. To avoid
> conflicts, we thought the customer could select the virtual subnet. If
> it is possible to set up duplicate subnets, there is no need to check if
> a certain subnet is available for the customer to use.

OK, then you'll definitely want to use marks etc. to properly handle
duplicate subnets.

>> And are you sure this would be easier with a site-to-site setup instead
>> of using virtual IP pools in the first place?  The IP addresses used on
>> the client end could still be "virtual IPs", i.e. only usable inside the
>> VPN, but they wouldn't be assigned by the server (to use duplicate
>> subnets is still tricky, though).
> Yeah, any setup will do as long as we can duplicate the subnets. I was
> hoping that it could be done as I read in the Virtual IP wiki that it
> might have been possible before: “previously each connection would use
> it's own copy and the same virtual IP may have been handed out to
> different clients”.

But that's not your use case.  The devices behind each client won't
request virtual IPs from the VPN server, so these pools are irrelevant.


More information about the Users mailing list