I am trying to setup a stronSwan server on Debian buster following a guide I wrote for stretch.
The connection to the server works fine but clients cannot access the internet.
What am I missing?
cat /etc/ipsec.conf
config setup
charondebug="ike 1, knl 1, cfg 0"
uniqueids=never
conn ikev2
auto=add
compress=no
type=tunnel
keyexchange=ikev2
fragmentation=yes
forceencaps=yes
ike=aes256gcm16-sha384-modp3072!
esp=aes256gcm16-sha384-modp3072!
dpdaction=clear
dpddelay=300s
rekey=no
left=%any
leftid=example.net
leftcert=server.crt
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=eap-tls
rightdns=1.1.1.1,1.0.0.1
rightsourceip=10.0.2.0/24
rightsendcert=never
eap_identity=%identity
iptables-save
# Generated by xtables-save v1.8.2 on Wed Apr 15 15:26:32 2020
*filter
:INPUT DROP [87:4831]
:FORWARD DROP [0:0]
:OUTPUT DROP [9:720]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A FORWARD -s 10.0.2.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A FORWARD -d 10.0.2.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Apr 15 15:26:32 2020
# Generated by xtables-save v1.8.2 on Wed Apr 15 15:26:32 2020
*nat
:PREROUTING ACCEPT [1800:60571]
:INPUT ACCEPT [12:768]
:POSTROUTING ACCEPT [24:1586]
:OUTPUT ACCEPT [15:1122]
-A POSTROUTING -s 10.0.2.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -s 10.0.2.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Apr 15 15:26:32 2020
# Generated by xtables-save v1.8.2 on Wed Apr 15 15:26:32 2020
*mangle
:PREROUTING ACCEPT [2413:113771]
:INPUT ACCEPT [701:58267]
:FORWARD ACCEPT [22:1424]
:OUTPUT ACCEPT [432:58684]
:POSTROUTING ACCEPT [445:59388]
-A FORWARD -s 10.0.2.0/24 -o eth0 -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
COMMIT
# Completed on Wed Apr 15 15:26:32 2020
sysctl -p
net.ipv4.ip_forward = 1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
