I am trying to setup an OpenSwan(2.6.32) on CentOS 6.5 (final) to connect the remote VPC gateway on Amazon cloud. I got the tunnel up. However, only the traffic from/to the last ip range defined in leftsubnets is routed. The first one works for a brief second (maybe before the second tunnel was up), then no more routing. Below is my configuration.
conn aws-vpc
leftsubnets={10.43.4.0/24 10.43.6.0/24}
rightsubnet=10.43.7.0/24
auto=start
left=206.191.2.xxx
right=72.21.209.xxx
rightid=72.21.209.xxx
leftid=206.191.2.xxx
leftsourceip=10.43.6.128
authby=secret
ike=aes128-sha1;modp1024
phase2=esp
phase2alg=aes128-sha1;modp1024
aggrmode=no
ikelifetime=8h
salifetime=1h
dpddelay=10
dpdtimeout=40
dpdaction=restart
type=tunnel
forceencaps=yes
After start IPsec service:
# service ipsec status
IPsec running - pluto pid: 8601
pluto pid 8601
2 tunnels up
some eroutes exist
# ip xfrm policy
src 10.43.6.0/24 dst 10.43.7.0/24
dir out priority 2344 ptype main
tmpl src 206.191.2.xxx dst 72.21.209.xxx
proto esp reqid 16389 mode tunnel
src 10.43.7.0/24 dst 10.43.6.0/24
dir fwd priority 2344 ptype main
tmpl src 72.21.209.xxx dst 206.191.2.xxx
proto esp reqid 16389 mode tunnel
src 10.43.7.0/24 dst 10.43.6.0/24
dir in priority 2344 ptype main
tmpl src 72.21.209.xxx dst 206.191.2.xxx
proto esp reqid 16389 mode tunnel
src 10.43.4.0/24 dst 10.43.7.0/24
dir out priority 2344 ptype main
tmpl src 206.191.2.xxx dst 72.21.209.xxx
proto esp reqid 16385 mode tunnel
src 10.43.7.0/24 dst 10.43.4.0/24
dir fwd priority 2344 ptype main
tmpl src 72.21.209.xxx dst 206.191.2.xxx
proto esp reqid 16385 mode tunnel
src 10.43.7.0/24 dst 10.43.4.0/24
dir in priority 2344 ptype main
tmpl src 72.21.209.xxx dst 206.191.2.xxx
proto esp reqid 16385 mode tunnel
I don't think firewall plays any role here, as I turned it off entirely just to test out the connections. routes are working as expected too. If I define single network on the left side, individually on a separated test connection, I can reach either subnets. Only when I define leftsubets, then, whichever range comes last will get routed in the end. Whichever comes first, works for a brief second before it stopped routing.
I could not find anyone on the internet have the similar problem… can someone please enlighten me?
cheers,
bo
Best Answer
When you use
leftsubnets
, you have to userightsubnets
, notrightsubnet
. As stated on http://linux.die.net/man/5/ipsec.conf: