Finally I figured out why.<br><br>1. eroute empty after successful SA.<br>This is very strange , using openswan v2.6.31 and v2.6.32, if I set protostack=auto, and modprobe ipsec, the tunnel can be brought up, but eroute entry will be empty.<br>
set protostack=klips explicitly, and restart ipsec service, then eroute entry will show up.<br><br>2. packet arrive via tunnel but no response come back.<br>This was caused by kernel Reverse Path Filtering, disable rp_filter, problem gone.<br>
for i in /proc/sys/net/ipv4/*/rp_filter; do echo 0 > $i; done<br>or<br>set<br>========================== <br>net.ipv4.conf.default.rp_filter=0<br>net.ipv4.conf.all.rp_filter=0<br>=========================<br>in sysctl.conf<br>
<br><br> <div class="gmail_quote">2011/1/31 Curu Wong <span dir="ltr"><<a href="mailto:prinbra@gmail.com">prinbra@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Problem: I create a host to host vpn tunnel, when use the native netkey stack, the tunnel works perfectly without any problem, but when I change the stack from netkey to klips on one end, the tunnel can be successfully bulit, but it can't send packet back to the other end.<br>
<br>Here is my setup:<br>hostA(192.168.2.128) ---->GW(192.168.2.129,no NAT,10.1.1.1)--->10.1.1.10(hostB)<br><br></blockquote></div>