[Openswan Users] VPN tunnel up but traffic will not pass

[Ryan Slick]

Hi guys, I have phase 1 and 2 up on both sides. logs look good. But I cannot ping from either end.
One side is openswan, the other is Juniper firewall.

Traceroute from the juniper to the internal address shows the first hop failing, traceroute from openswan shows the traffic going out into the realms of the internet. It would appear openswan is not routing the traffic correctly. Juniper has permit any any rules on all interfaces.  


Any help would be appreciated!



conn netconn7
        authby="secret"
        left=%defaultroute
        leftsubnet=192.168.10.0/24
        leftid=@routerA
        right=111.69.xx.xx
        rightsubnet=192.168.1.0/24
        rightid=@srx
        pfs=off
        salifetime=28800s
        ikelifetime=3600s
        auth=esp
        ike=aes128-sha1;modp768
        phase2alg=aes128-sha1;modp768
        dpdaction=restart
        dpddelay=10
        dpdtimeout=60
        aggrmode=yes
        auto=add

iptables:

oot:/etc# iptables -L -v -n
hain INPUT (policy ACCEPT 204 packets, 9136 bytes)
pkts bytes target     prot opt in     out     source               destination

   5   145 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0

 266 16806 macipport_filter_inbound  all  --  *      *       0.0.0.0/0
  0.0.0.0/0
 266 16806 macipport_filter  all  --  *      *       0.0.0.0/0            0.0.0
0/0
 266 16806 filter     all  --  *      *       0.0.0.0/0            0.0.0.0/0


hain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination

   0     0 macipport_filter_forward  all  --  *      *       0.0.0.0/0
  0.0.0.0/0
   0     0 ipport_filter_forward  all  --  *      *       0.0.0.0/0
.0.0.0/0
   0     0 macipport_filter  all  --  *      *       0.0.0.0/0            0.0.0
0/0
   0     0 filter_forward  all  --  *      *       0.0.0.0/0            0.0.0.0
0

hain OUTPUT (policy ACCEPT 195 packets, 30949 bytes)
pkts bytes target     prot opt in     out     source               destination

 197 31007 macipport_filter_outbound  all  --  *      *       0.0.0.0/0
   0.0.0.0/0

hain filter (1 references)
pkts bytes target     prot opt in     out     source               destination

   0     0 ACCEPT     icmp --  wwan0  *       0.0.0.0/0            0.0.0.0/0
       icmp type 8
   0     0 ACCEPT     tcp  --  wwan0  *       0.0.0.0/0            192.168.10.1
       tcp dpt:80
   0     0 DROP       tcp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
       tcp dpt:80
   0     0 ACCEPT     tcp  --  wwan0  *       0.0.0.0/0            192.168.10.1
       tcp dpt:443
   0     0 DROP       tcp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
       tcp dpt:443
   0     0 ACCEPT     tcp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
       tcp dpt:23
   0     0 ACCEPT     tcp  --  wwan0  *       0.0.0.0/0            192.168.10.1
       tcp dpt:22
   0     0 DROP       tcp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
       tcp dpt:22
   7  1171 ACCEPT     udp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
       udp dpt:500
   0     0 ACCEPT     udp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
       udp dpt:4500
   0     0 ACCEPT     esp  --  wwan0  *       0.0.0.0/0            0.0.0.0/0

   0     0 ACCEPT     ah   --  wwan0  *       0.0.0.0/0            0.0.0.0/0

   0     0 ACCEPT     all  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
       state RELATED,ESTABLISHED
   0     0 DROP       all  --  wwan0  *       0.0.0.0/0            0.0.0.0/0


hain filter_forward (1 references)
pkts bytes target     prot opt in     out     source               destination

   0     0 ACCEPT     all  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
       mark match 0x1
   0     0 ACCEPT     all  --  wwan0  *       0.0.0.0/0            0.0.0.0/0
       state RELATED,ESTABLISHED
   0     0 DROP       all  --  wwan0  *       0.0.0.0/0            0.0.0.0/0


hain ipport_filter_forward (1 references)
pkts bytes target     prot opt in     out     source               destination



root:/etc# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         49.226.157.41   0.0.0.0         UG        0 0          0 wwan0
49.226.157.40   0.0.0.0         255.255.255.252 U         0 0          0 wwan0
192.168.10.0    0.0.0.0         255.255.255.0   U         0 0          0 br0
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openswan.org/pipermail/users/attachments/20141010/e1f62368/attachment.html>