I have a site-to-site IPsec tunnel set up with strongSwan between my CentOS 7 virtual private server (public IP x.x.x.233 for subnet 172.25.10.0/24) and a customer's network (public IP y.y.y.24 for subnet 10.9.200.0/24). The tunnel seems to be connecting fine, but I can't get traffic to route over it. I'm trying to set up the 172.25.10.0/24 subnet on the same host that's acting as the gateway, which I assume I've done incorrectly.
The conn
section of the ipsec.conf
on the VPS is:
conn customer
esp=aes256-sha1-modp1024
ike=aes256-sha1-modp1024
keyexchange=ikev1
authby=psk
left=%defaultroute
leftsubnet=172.25.10.0/24
leftfirewall=yes
right=y.y.y.24
rightsubnet=10.9.200.0/24
auto=start
As far as I can tell, the tunnel itself is working fine. strongswan statusall
on the VPS shows:
Security Associations (1 up, 0 connecting):
customer[29]: ESTABLISHED 110 minutes ago, x.x.x.233[x.x.x.233]...y.y.y.24[y.y.y.24]
customer[29]: IKEv1 SPIs: 0123456789abcdef_i* 0123456789abcdef_r, pre-shared key reauthentication in 50 minutes
customer[29]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
customer{88}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: 01234567_i 01234567_o
customer{88}: AES_CBC_256/HMAC_SHA1_96/MODP_1024, 0 bytes_i, 0 bytes_o, rekeying in 7 minutes
customer{88}: 172.25.10.0/24 === 10.9.200.0/24
I set up a subnet IP (172.25.10.2) on the VPS on the same interface that holds the public IP (x.x.x.233) with:
ip addr add 172.25.10.2/32 dev eth0
But when I ping an IP on the remote network from the VPS, the ping is failing:
# ping -I 172.25.10.2 -c 3 10.9.200.254
PING 10.9.200.254 (10.9.200.254) from 172.25.10.2 : 56(84) bytes of data.
--- 10.9.200.254 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 1999ms
A tcpdump shows me that the IPsec tunnel is not being used:
# tcpdump -n host 10.9.200.254 or host y.y.y.24
03:51:07.193494 IP x.x.x.233 > 10.9.200.254: ICMP echo request, id 10193, seq 1, length 64
03:51:08.193449 IP x.x.x.233 > 10.9.200.254: ICMP echo request, id 10193, seq 2, length 64
03:51:09.193452 IP x.x.x.233 > 10.9.200.254: ICMP echo request, id 10193, seq 3, length 64
I'm guessing that just adding the 172.25.10.2 IP to eth0
is not sufficient for it to figure out that my traffic should be routed over the tunnel, but I'm not sure what the right way to do it is.
For what it's worth, I also ran the following commands before turning on strongSwan:
# echo "net.ipv4.ip_forward=1" > /etc/sysctl.conf
# sysctl -p
# firewall-cmd --zone=public --permanent --add-service="ipsec"
# firewall-cmd --zone=public --permanent --add-port=4500/udp
# firewall-cmd --zone=public --permanent --add-masquerade
# firewall-cmd --reload
Otherwise I haven't touched the machine's configuration / routing rules / etc.