[lkml]   [2017]   [Apr]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subjectipsec doesn't route TCP with 4.11 kernel
I'm not sure how to describe this.

4.11rc2 worked, after that, no.

My ipsec tunnel comes up ok. ICMP works. UDP works. But TCP, the
sender [which is the ipsec client] does not reach the destination.

Its not a routing rule issue (since ICMP/UDP work).
Its not a traffic selector just selecting TCP (I think) since ipsec
status shows just a subnet, no protocol.

Using tcpdump:
# iptables -t mangle -I PREROUTING -m policy --pol ipsec --dir in -j
NFLOG --nflog-group 5
# iptables -t mangle -I POSTROUTING -m policy --pol ipsec --dir out -j
NFLOG --nflog-group 5
# tcpdump -s 0 -n -i nflog:5

I see that it thinks it is sending the TCP packet, but the server end
does not receive.

Does anyone have any suggestion to try?

strongswan is 5.5.1 [on ubuntu 17.04]
kernel is 4.11.0-041100rc8-generic

My rightsubnet is
rightsubnet =,

so no specific protocol selected, the result is:
CHILD_SA sv{1} established with SPIs c05f1b6c_i 0d58815a_o and TS ===

I tried changing charondebug net=3, but i'm not sure how to interpret
the output:

Apr 25 21:06:34 office charon: 04[NET] received packet: from[4500] to[4500] (80 bytes)
Apr 25 21:06:34 office charon: 04[ENC] parsed INFORMATIONAL request 4 [ ]
Apr 25 21:06:34 office charon: 04[ENC] generating INFORMATIONAL response 4 [ ]
Apr 25 21:06:34 office charon: 04[NET] sending packet: from[4500] to[4500] (80 bytes)

 \ /
  Last update: 2017-04-26 03:20    [W:0.091 / U:2.560 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site