[strongSwan] Unable to ping machines on the remote network

[Guillaume Stritmatter]

Hello,

I am running strongswan on a machine on an OVH openstack. The goal is to
access the network from a TheGreenBow client. I am able to up the tunnel
but from a windows terminal, I am not able to ping a machine on the remote
network.

                                          Gateway
            Internet                   NAT       WindowsClient
[192.168.161.15]<---->[192.168.161.201]<---->[Router]<----------------->[Router]<---->[192.168.1.32]

*strongswan configuration :*

conn ikev2-vpn
        auto=add
        compress=no
        type=tunnel
        keyexchange=ikev2
        fragmentation=yes
        leftfirewall=no
        authby=secret
        left=%any
        leftsubnet=192.168.161.0/24
        rightsourceip=10.3.0.0/24
        right=%any
        mark=43

*ip address : *

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group
default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
UP group default qlen 1000
    link/ether fa:16:3e:07:3e:5c brd ff:ff:ff:ff:ff:ff
    inet 192.168.171.12/24 brd 192.168.171.255 scope global dynamic eth0
       valid_lft 252228sec preferred_lft 252228sec
    inet6 fe80::f816:3eff:fe07:3e5c/64 scope link
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
UP group default qlen 1000
    link/ether fa:16:3e:5d:8b:a6 brd ff:ff:ff:ff:ff:ff
    inet 192.168.161.201/24 brd 192.168.161.255 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::f816:3eff:fe5d:8ba6/64 scope link
       valid_lft forever preferred_lft forever

*ip route show table all :*

10.3.0.1 via 192.168.171.1 dev eth0 table 220 proto static src
192.168.161.201
192.168.2.0/24 via 192.168.171.1 dev eth0 table 220 proto static src
192.168.161.201
default via 192.168.171.1 dev eth0
169.254.169.254 via 192.168.171.1 dev eth0 proto static
192.168.161.0/24 dev eth1 proto kernel scope link src 192.168.161.201
192.168.171.0/24 dev eth0 proto kernel scope link src 192.168.171.12
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src
127.0.0.1
broadcast 192.168.161.0 dev eth1 table local proto kernel scope link src
192.168.161.201
local 192.168.161.201 dev eth1 table local proto kernel scope host src
192.168.161.201
broadcast 192.168.161.255 dev eth1 table local proto kernel scope link src
192.168.161.201
broadcast 192.168.171.0 dev eth0 table local proto kernel scope link src
192.168.171.12
local 192.168.171.12 dev eth0 table local proto kernel scope host src
192.168.171.12
broadcast 192.168.171.255 dev eth0 table local proto kernel scope link src
192.168.171.12
unreachable default dev lo proto kernel metric 4294967295 error -101 pref
medium
unreachable ::/96 dev lo metric 1024 error -113 pref medium
unreachable ::ffff:0.0.0.0/96 dev lo metric 1024 error -113 pref medium
unreachable 2002:a00::/24 dev lo metric 1024 error -113 pref medium
unreachable 2002:7f00::/24 dev lo metric 1024 error -113 pref medium
unreachable 2002:a9fe::/32 dev lo metric 1024 error -113 pref medium
unreachable 2002:ac10::/28 dev lo metric 1024 error -113 pref medium
unreachable 2002:c0a8::/32 dev lo metric 1024 error -113 pref medium
unreachable 2002:e000::/19 dev lo metric 1024 error -113 pref medium
unreachable 3ffe:ffff::/32 dev lo metric 1024 error -113 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev eth1 proto kernel metric 256 pref medium
unreachable default dev lo proto kernel metric 4294967295 error -101 pref
medium
local ::1 dev lo table local proto unspec metric 0 pref medium
local fe80:: dev lo table local proto unspec metric 0 pref medium
local fe80:: dev lo table local proto unspec metric 0 pref medium
local fe80::f816:3eff:fe07:3e5c dev lo table local proto unspec metric 0
pref medium
local fe80::f816:3eff:fe5d:8ba6 dev lo table local proto unspec metric 0
pref medium
ff00::/8 dev eth0 table local metric 256 pref medium
ff00::/8 dev eth1 table local metric 256 pref medium
unreachable default dev lo proto kernel metric 4294967295 error -101 pref
medium

*ip rule :*

0:      from all lookup local
220:    from all lookup 220
32766:  from all lookup main
32767:  from all lookup default

*sysctl -A | grep -E "ipv4.*(\.forwarding|ip_forward)" : *

net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth1.forwarding = 1
net.ipv4.conf.lo.forwarding = 1
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_use_pmtu = 0

Someone has an idea ?

Thanks !

Guillaume
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20200723/5259c3de/attachment.html>