I am trying to set up a mobile VPN to a gateway on user1 and only use
this VPN for the user user1. I am using the test net2net-psk-dscp as guide.
My ipsec.conf:
conn gw1
left=%any
leftsourceipc=%config
leftauth=eap
right=10.1.1.2
rightsubnet=192.168.1.0/24
keyexchange=ikev2
auto=add
conn gw1-1
leftid=user1
mark=0x1
also=gw1
I then set the mark for connections of user1 by:
$ iptables -t mangle -A OUTPUT -m owner --uid-owner user1 -j MARK
--set-mark 1
$ iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
$ ip x s
src 10.1.1.1 dst 10.1.1.2
proto esp spi 0x46f4cfd8 reqid 1 mode tunnel
replay-window 32 flag af-unspec
mark 1/0xffffffff
auth-trunc hmac(sha1) 0xdbc93607662c2694bf5468faa65ef5145267b105 96
enc cbc(aes) 0x98f9e1f1773abd2b05c1ef2f079c7e89
src 10.1.1.2 dst 10.1.1.1
proto esp spi 0xc8fa3f15 reqid 1 mode tunnel
replay-window 32 flag af-unspec
mark 1/0xffffffff
auth-trunc hmac(sha1) 0x8732a029574e2a1ff80d814e80bcdfe9df450912 96
enc cbc(aes) 0x6544dceee1c91748f335d25931938a6c
$ ip x p
src 192.168.1.0/24 dst 192.168.1.127/32
dir fwd priority 1827
mark 1/0xffffffff
tmpl src 10.1.1.2 dst 10.1.1.1
proto esp reqid 1 mode tunnel
src 192.168.1.0/24 dst 192.168.1.127/32
dir in priority 1827
mark 1/0xffffffff
tmpl src 10.1.1.2 dst 10.1.1.1
proto esp reqid 1 mode tunnel
src 192.168.1.127/32 dst 192.168.1.0/24
dir out priority 1827
mark 1/0xffffffff
tmpl src 10.1.1.1 dst 10.1.1.2
proto esp reqid 1 mode tunnel
But when I ping a server behind the firewall with:
$ sudo -u user1 ping 192.168.1.5
I can see with tcpdump that the ESP packets get to the gateway, the
server 192.168.1.5 receives the ping request and answers it, ESP packets
are sent from the gateway to the client but the user1 ping is not
receiving them.
$ ipsec --version
Linux strongSwan U5.1.1/K3.11.0-17-generic
Am I doing something wrong?
_______________________________________________
Users mailing list
[email protected]
https://lists.strongswan.org/mailman/listinfo/users
