[strongSwan] Use tunnel to ocassionally proxy internet traffic

Wed Apr 22 12:00:43 CEST 2020

Hi list,

I have set up a tunnel using ikev2 and PSK to connect my home network (via a Draytek router/modem) and my internet server (public IP ranges, acting as web-/mail-/network server).
First goal is, to access the respective networks behind the gateways which works so far.
I'd further like to use the tunnel to proxy (internet) traffic from certain hosts in my home network via the responder to the internet.
So far, I did manage to route all (!) traffic from the home network via the responder to the internet, which is not the intended solution.
Side note: The Draytek router on the edge of the home network is able to set distinct routes based on source or destination IP(s) via certain interfaces (e.g. the VPN interface) and even can set definable gateways for this.
I could nail down the tunnel traffic by adding just the 192.168.200.1/24 as remote/right network on the Draytek config, but then I am not able to process the occasional traffic to the internet (if routing from a certain source via the tunnel is enabled on the Draytek) without a lot of manual modifications (iptables, ip xfrm policies).

The current IP schema looks as follows:

192.168.1.0/24 Home network
192.168.1.1 Draytek router
192.168.1.2 VPN IP on the home network (Draytek router)
192.168.1.12 Test VM

91.212.144.185/29 server network
91.212.144.188 IPSec server IP (left on the server)
192.168.200.1/24 private network IP on the server

Internet/WAN connect from the home network is currently set up via LTE (194.230.155.229 public IP / 10.148.130.88/32 DHCP IP from LTE provider)

ipsec.conf on the responder (server) side:

config setup
        #charondebug="ike 3, knl 3, cfg 3"
        uniqueids=no

conn %default
        compress=no
        keyexchange=ikev2
        fragmentation=yes
        forceencaps=yes
        ike=aes256-sha2_256-modp2048,aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024! # Win7 is aes256, sha-1, modp1024; iOS is aes256, sha-256, modp1024; macOS is 3DES, sha-1, modp1024
        esp=aes256-sha2_256,aes256-sha256,aes256-sha1,3des-sha1! # Win 7 is aes256-sha1, iOS is aes256-sha256, macOS is 3des-shal1
        dpdaction=restart
        dpddelay=30s
        dpdtimeout=120s
        keyingtries=%forever
        ikelifetime=28800s
        lifetime=3600s
        dpdtimeout=120s

conn draytek-s1
        auto=add
        type=tunnel
        authby=secret
        left=91.212.144.188
        leftid=server1
        leftsubnet=0.0.0.0/0
        leftfirewall=yes
        right=%any
        rightid=draytek
        rightsubnet=0.0.0.0/0

Output of ipsec statusall on the responder:

# ipsec statusall
Status of IKE charon daemon (strongSwan 5.2.1, Linux 3.16.0-4-amd64, x86_64):
  uptime: 12 hours, since Apr 21 23:34:17 2020
  malloc: sbrk 2408448, mmap 0, used 356384, free 2052064
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 73
  loaded plugins: charon aes rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default stroke updown
Virtual IP pools (size/online/offline):
  192.168.201.2: 1/0/0
Listening IP addresses:
  91.212.144.186
  192.168.200.1
  91.212.144.187
  91.212.144.188
  91.212.144.189 
Connections:
  draytek-s1:  91.212.144.188...%any  IKEv2, dpddelay=30s
  draytek-s1:   local:  [server1] uses pre-shared key authentication
  draytek-s1:   remote: [draytek] uses pre-shared key authentication
  draytek-s1:   child:  0.0.0.0/0 === 0.0.0.0/0 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 connecting):
  draytek-s1[64]: ESTABLISHED 6 minutes ago, 91.212.144.188[server1]...194.230.155.229[draytek]
  draytek-s1[64]: IKEv2 SPIs: 21a9d3bfe1b1f30a_i adaee24e252e33a2_r*, pre-shared key reauthentication in 7 hours
  draytek-s1[64]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
  draytek-s1{53}:  INSTALLED, TUNNEL, ESP in UDP SPIs: c000d8f9_i 2345e353_o
  draytek-s1{53}:  AES_CBC_256/HMAC_SHA2_256_128, 6964 bytes_i, 0 bytes_o, rekeying in 36 minutes
  draytek-s1{53}:   192.168.200.0/24 === 192.168.1.0/24

Config on the initiator side (currently web UI only)

I am not sure, if embedded graphics will be displayed on the list, so here comes the abstraction in text:
My WAN IP: 0.0.0.0
Remote Gateway IP: 0.0.0.0
Remote Network IP: 192.168.200.0
Remote Network Mask: 255.255.255.0 / 24
Local Network IP: 192.168.1.2
Local Network Mask: 255.255.255.0 / 24
RIP Direction: Disable
>From first subnet to remot network, you have to do: Route (NAT would be the other choice)
IPsec VPN with the Same Subnets : No ticked
Change default route to this VPN tunnel ( Only active if one single WAN is up ): Not ticked

On the responder side, I do not rely on the private network 192.168.200.0/24. Actually I only do need to connect certain services from the initiator on the responder through the VPN. Which means 192.168.1.0/24 needs to be reachable from 91.212.144.188 or its private networks at least.

Is there any advice/help on how to config the desired setup (to be able to occasionally route/proxy certain internet traffic from the home network through the responder)?

Cheers
Tobi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20200422/fc496af0/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 741-5EA01600-31-49AA2B80
Type: image/png
Size: 46338 bytes
Desc: not available
URL: <http://lists.strongswan.org/pipermail/users/attachments/20200422/fc496af0/attachment-0001.png>