Referencing the thread starting here:<br><br><b>Steve Zeng</b> 
    <a href="mailto:users%40openswan.org?Subject=Re:%20%5BOpenswan%20Users%5D%20ipsec%20verify%20reports%20%22IP%20forwarding%20failed%22&amp;In-Reply-To=%3C8B5C6F575422414AA91B46C454126B6CC888EB4E%40EXCHMVS.exchange.airg%3E" title="[Openswan Users] ipsec verify reports &quot;IP forwarding failed&quot;">SteveZ at airg.com
       </a><br>
    <i>Mon May 31 17:24:47 EDT 2010<br><br></i>I ran across the same thing using openswan on:<br>FC12, upgraded to 2.6.32.26<br>perl --version<br>This is perl, v5.10.0 built for i386-linux-thread-multi<br># ipsec --version<br>
Linux Openswan U2.6.29/K2.6.32.26-175.fc12.i686 (netkey)<br><br><br>I made a simple change that seems to fix the problem<br>to correctly report status of /proc/sys/net/ipv4/ip_forward<br>then check NAT and MASQUERADE unconditionally<br>
I tested it with  both states <br><br>echo 0 &gt; /proc/sys/net/ipv4/ip_forward<br>echo 1 &gt; /proc/sys/net/ipv4/ip_forward<br><br><br>/usr/libexec/ipsec/verify <br><br>sub my_tunnelchecks {<br>    open(&quot;dev&quot;, &quot;/proc/net/dev&quot;);<br>
    if((grep !/(ipsec|lo:|Inter|packets)/, &lt;dev&gt;) &gt; 1)<br>    {<br>        printfun &quot;Two or more interfaces found, checking IP forwarding&quot;;<br>        my ($data, $n);<br>        open FILE, &quot;/proc/sys/net/ipv4/ip_forward&quot; or die $!;<br>
        $n = read FILE, $data, 1;<br>        if($data == 1)<br>        {<br>             errchk &quot;1&quot;;<br>        }<br>        else<br>        {<br>             $reterr = 1;<br>             errchk &quot;0&quot;;<br>
        }<br><br>         printfun &quot;Checking NAT and MASQUERADEing&quot;;<br>         if( -e &quot;/proc/net/ip_conntrack&quot; )<br>         {<br>                run &quot;iptables -t nat -L -n&quot;;<br>                if(grep /(NAT|MASQ)/, @out)<br>
                {<br>                    printf &quot;\n&quot;;<br>                    open(&quot;cat&quot;, &quot;/proc/net/ipsec_eroute&quot;);<br>                    foreach(grep /tun0x/, &lt;cat&gt;)<br>                    {<br>
                        @eroute=split(&#39; &#39;,$_);<br>                        checktunnel $eroute[1], $eroute[3], $eroute[5];<br>                    }<br>                }<br>                else<br>                {<br>
                    errchk &quot;1&quot;;<br>                }<br>        }<br>        else<br>        {<br>                errchk &quot;&quot;,&quot;N/A&quot;;<br>        }<br>    }<br>}<br><br><br><br>