Re: [Swan] Can't route back down ipsec tunnel from VPS

Fri, 05 Dec 2014 08:07:17 -0800

Hi Michael,
 
Yep, had both of those turned on already.
 
With the help of a colleague we've managed to resolve both our problems today. For posterity and future seekers of the truth here are the answers:
 
1. Not able to route back down the tunnel: Basically we removed the two lines leftprotoport=17/1701 and rightprotoport=17/%any. They were part of the default setup of the script we were using so I didn't give them much thought, but from previous discussions they're only relevant when using L2TP.
 
2. Couldn't forward packets to the internet: Changed left=<local subnet> to left=0.0.0.0/0. The server is happily sending on packets to the 'net and returning them to the correct host at the other end of the VPN.
 
Thanks all for the help.
 
Darren.
----------------------- Original Message -----------------------
  
From: Michael Hicks <[email protected]>
To: Darren Share <[email protected]>
Date: Fri, 5 Dec 2014 07:51:19 -0800
Subject: Re: [Swan] Can't route back down ipsec tunnel from VPS
  
Darren,

Two things that may be affecting your tunnel traffic.

1) Is IP packet forwarding turned on?  

/sbin/sysctl net.ipv4.ip_forward
Make sure it shows 1

if not, run 
/sbin/sysctl -w net.ipv4.ip_forward=1

and if that fixes the problem, make it persistent in /etc/sysctl

2) even if your VPS is forwarding the packets out the interface, if the source IP they are coming from is not something that DO knows to route back to your VPS you will need to Nat Masquerade the VPN traffic to the ip address on your VPS with iptables so that its something DO can route back to you.

tcpdump is your friend


Mike

On Dec 5, 2014, at 12:31 AM, Darren Share <[email protected]> wrote:

Thanks Paul, but I am using Digitial Ocean and the VPS has a public, static IP address on eth0.
----------------------- Original Message -----------------------
  
From: Paul Wouters ??<[email protected]>
To: Darren Share <[email protected]>
Date: Thu, 4 Dec 2014 23:11:33 -0500 (EST)
Subject: Re: [Swan] Can't route back down ipsec tunnel from VPS
  
On Thu, 4 Dec 2014, Darren Share wrote:

> Can you elaborate? The only use of "elastic IP" I'm aware of is regarding AWS, is that what you mean? I am using a VPS on DigitalOcean for this project if that helps.

Normally in AWS, you get a "static" elastic IP assigned. This public IP
is NAT'ed to your virtual machine. But your virtual machine only has
RFC1918 addresses configured on it. Because the AWS NAT router will
NAT it to your static elastic IP.

Now when you do a VPN in tunnel mode, the packet you are sending
needs to be "from" your public IP. But you don't have it configured
on your virtual machine itself. So you cannot create a source packet
with that IP. The usual solution is to configure it as an alias on
the loopback or ethernet interface.

See: https://libreswan.org/wiki/Interoperability#Amazon_EC2

Paul

______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
______________________________________________________________________

______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
______________________________________________________________________
_______________________________________________
Swan mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan


______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
______________________________________________________________________
_______________________________________________
Swan mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan

Reply via email to