<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Rescued from the spam bucket. Please remember to subscribe to the mailing list before posting to it.<div class="">Sorry for the delay, I was on vacation.</div><div><br class=""><div class=""><div class=""><span class="" style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif; color: rgb(127, 127, 127);"><b class="">From: </b></span><span class="" style="font-family: -webkit-system-font, 'Helvetica Neue', Helvetica, sans-serif;">Julien T <<a href="mailto:julien.t43@gmail.com" class="">julien.t43@gmail.com</a>></span></div><div class=""><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(127, 127, 127, 1.0);" class=""><b class="">Subject: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><b class="">openswan tunnel and transport conflict?</b><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(127, 127, 127, 1.0);" class=""><b class="">Date: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">December 28, 2015 at 10:20:08 PM EST<br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(127, 127, 127, 1.0);" class=""><b class="">To: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><a href="mailto:users@lists.openswan.org" class="">users@lists.openswan.org</a><br class=""></span></div><br class=""><br class=""><div dir="ltr" class="">Hello,<div class=""><br class=""></div><div class="">I'm trying to setup an ipsec tunnel between a linux and an operator modem.</div><div class="">Linux is Ubuntu trusty based with openswan. no iptables currently</div><div class="">Operator box is proprietary, ipsec only (no xl2tpd)</div><div class=""><br class=""></div><div class="">I started doing my setup with the following ansible role</div><div class=""><a href="https://github.com/ahelal/ansible-l2tp_ipsec" class="">https://github.com/ahelal/ansible-l2tp_ipsec</a><br class=""></div><div class="">I customized it to operate as tunnel mode without l2tp part.</div><div class=""><br class=""></div><div class="">Tunnel established correctly (got the 'STATE_QUICK_R2: IPsec SA established tunnel mode')and sometime, it works/pings fine... but most of the time, it seems there is a routing issue</div><div class="">why?</div><div class="">because I see packets coming one way with tcpdump but not leaving the linux box</div><div class=""><br class=""></div><div class="">also 'ip xfrm policy' returns both tunnel and transport link for one src-dst couple...</div><div class=""><div class="">+ ip xfrm policy</div><div class="">src 10.x.y.0/24 dst 192.168.z.0/24</div><div class=""> dir out priority 2344</div><div class=""> tmpl src a.b.c.202 dst e.f.g.12</div><div class=""> proto comp reqid 16386 mode tunnel</div><div class=""> tmpl src 0.0.0.0 dst 0.0.0.0</div><div class=""> proto esp reqid 16385 mode transport</div><div class="">src 192.168.z.0/24 dst 10.x.y.0/24</div><div class=""> dir fwd priority 2344</div><div class=""> tmpl src e.f.g.12 dst a.b.c.202</div><div class=""> proto comp reqid 16386 mode tunnel</div><div class=""> level use</div><div class=""> tmpl src 0.0.0.0 dst 0.0.0.0</div><div class=""> proto esp reqid 16385 mode transport</div></div><div class=""><br class=""></div><div class="">See config and some extra output here</div><div class=""><a href="http://pastebin.com/UkwP9ery" class="">http://pastebin.com/UkwP9ery</a><br class=""></div><div class=""><br class=""></div><div class="">linux also has an openvpn server but it is not supposed to impact ip xfrm policy.</div><div class="">I'm positive that I was using the same config at some moment it was working.</div><div class="">I don't know what else outside of openswan can affect ip xfrm</div><div class=""><br class=""></div><div class="">I also tried to remove manually this policy but don't find the right command</div><div class=""><div class=""># ip xfrm policy delete tmpl in src <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a></div><div class="">Error: argument "tmpl" is wrong: unknown</div><div class=""># ip xfrm policy delete dir in src <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a> dst <a href="http://0.0.0.0/0" class="">0.0.0.0/0</a></div><div class="">RTNETLINK answers: No such file or directory</div></div><div class=""><br class=""></div><div class="">any pointers?</div><div class=""><br class=""></div><div class="">Thanks</div><div class=""><br class=""></div><div class="">J</div></div>
<br class=""><br class=""></div></div></div><br class=""></body></html>