Messages in this thread | | | From | Don Bowman <> | Date | Tue, 25 Apr 2017 21:08:28 -0400 | Subject | ipsec doesn't route TCP with 4.11 kernel |
| |
I'm not sure how to describe this.
4.11rc2 worked, after that, no.
My ipsec tunnel comes up ok. ICMP works. UDP works. But TCP, the sender [which is the ipsec client] does not reach the destination.
Its not a routing rule issue (since ICMP/UDP work). Its not a traffic selector just selecting TCP (I think) since ipsec status shows just a subnet, no protocol.
Using tcpdump: # iptables -t mangle -I PREROUTING -m policy --pol ipsec --dir in -j NFLOG --nflog-group 5 # iptables -t mangle -I POSTROUTING -m policy --pol ipsec --dir out -j NFLOG --nflog-group 5 # tcpdump -s 0 -n -i nflog:5
I see that it thinks it is sending the TCP packet, but the server end does not receive.
Does anyone have any suggestion to try?
strongswan is 5.5.1 [on ubuntu 17.04] kernel is 4.11.0-041100rc8-generic
My rightsubnet is rightsubnet = 192.168.128.0/17,10.0.0.0/8
so no specific protocol selected, the result is: CHILD_SA sv{1} established with SPIs c05f1b6c_i 0d58815a_o and TS 192.168.130.4/32 === 10.0.0.0/8 192.168.128.0/17
I tried changing charondebug net=3, but i'm not sure how to interpret the output:
Apr 25 21:06:34 office charon: 04[NET] received packet: from 64.7.137.180[4500] to 172.16.0.8[4500] (80 bytes) Apr 25 21:06:34 office charon: 04[ENC] parsed INFORMATIONAL request 4 [ ] Apr 25 21:06:34 office charon: 04[ENC] generating INFORMATIONAL response 4 [ ] Apr 25 21:06:34 office charon: 04[NET] sending packet: from 172.16.0.8[4500] to 64.7.137.180[4500] (80 bytes)
| |