[strongSwan] Help with packet forwarding/NAT

Thomas Nyberg twn+mailinglist-strongswan at thomasnyberg.com
Fri Mar 8 09:13:56 CET 2019


I'm new to Strongswan (and to networking/VPNs in general) so I suspect 
this is a standard problem with answers all of the internet which I am 
unable to find due to my inexperience. If so, feel free to yell at me 
about better places to look and I can move on. :)

My basic setup is that I have a Linux HOST that connects to a VPN. 
Inside the VPN the HOST is assigned another address. Inside the network 
there is static routing between the internal address and another 
internal subnet that I would like to reach from the outside. I'll put 
some numbers in to make it concrete:

	* VPN Server IP: (don't think this is important for my 
	* External HOST IP:
	* Internal VPN IP:
	* Internal Target Subnet:

So I think what I want is for packets originating on HOST with source IP and target IP (say) to get sent over the 
tunnel, the source IP to be changed to, then forwarded 
through by regular routing, and finally I want the same thing to happen 
in reverse. I have tried many different settings, one example being the 
following (I removed settings that I think aren't relevant):


The connection starts up fine, but when I try something like

	telnet 5000

then it just times out. I have tried many other variations of various 
settings, but I think I'm just sort of throwing things at the wall 
hoping they will stick (a strategy of questionable wisdom).

I believe my problem is that I am incorrectly setting up routing/NAT. 
Can anyone here see easily what I'm doing wrong? Is this sort of thing 
something that I can setup out of the box with Strongswan or would I 
need to do some NAT by hand? (I believe that I can do something similar 
here with iptables, but like I said I'm new to all this stuff.)

Let me know if my question is unclear. Thanks a lot for any help!


More information about the Users mailing list