Answer the question
In order to leave comments, you need to log in
StrongSwan forwarding local networks of clients, VPS as a router?
Good day! There is a VPN network built on VPS and StrongSwan. VPS is needed because one client has a gray ip.
Clients are located on virtual machines in subnets 192.168.10-20, connect to the VPS, receive addresses from it, routes are prescribed, etc. VPN rises, clients 10.1.22.1-2 see each other, like everyone is happy except me))
I it is necessary that there was access to local networks of each client, the father-in-law to networks 192.168.10-20.
I was able to configure the clients to send traffic to the destination 192.168.10-20 in the tunnel, but the VPS server is dumb.
Traceroute 192.168.10-20, I see that the packet reaches the VPS (local ip 172.26.13.11) and then flies to the Internet (probably to the default gateway).
The server began to torment that I did not try to register a separate conn, Left\right set 192.168.10-20, alternately 10.1.22.1-2 and 192.168.10-20, to no avail. It still goes online.
Tried to write policies:
ip xfrm policy add src 0.0.0.0/0 dst 192.168.10.0/24 dir out tmpl src 172.26.13.11 dst <Public IP Клиента 1> proto esp reqid "2" mode tunnel
ip xfrm policy add src 192.168.10.0/24 dst 0.0.0.0/0 dir in tmpl src <Public IP Клиента 1> dst 172.26.13.11 proto esp reqid "2" mode tunnel
ip xfrm policy add src 192.168.10.0/24 dst 0.0.0.0/0 dir fwd tmpl src <Public IP Клиента 1> dst 172.26.13.11 proto esp reqid "2" mode tunnel
ip xfrm policy add src 0.0.0.0/0 dst 192.168.10.0/24 dir out tmpl src 172.26.13.11 dst 10.1.22.1 proto esp reqid "2" mode tunnel
ip xfrm policy add src 192.168.10.0/24 dst 0.0.0.0/0 dir in tmpl src 10.1.22.1 dst 172.26.13.11 proto esp reqid "2" mode tunnel
ip xfrm policy add src 192.168.10.0/24 dst 0.0.0.0/0 dir fwd tmpl src 10.1.22.1 dst 172.26.13.11 proto esp reqid "2" mode tunnel
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question