Issue with Traffic to LAN when Road Warrior Connect to strongSwan via IKEv2

[ww9rivers]

System:

• OS: Ubuntu 24.04.1 LTS
• Kernel version: 6.8.0-51-generic
• strongSwan version: 5.9.13-2ubuntu4
• Tested/confirmed with the latest version: no

Describe the bug

When a Windows 10 client connects to the strongSwan server, all traffic to the local network stop. For example, ping from the VPN server to LAN would report all packets lost. Ping to outside (e.g. 8.8.8.8) remains functioning. When the VPN client disconnects, all would resume.

To Reproduce
Steps to reproduce the behavior:

• Both the server and clients are behind NAT, but the server's UDP ports 500 and 4500 are mapped to a public IP.
• Use the IKEve-setup script to setup the VPN server.
• Added links in swanctl configuration to the Letsencrypt generated key, cert and CA cert.
• Added one client credential in /etc/ipsec.secrets.
• Create IKEv2 connection on a Windows 10 PC using the instructions provided by the IKEv2-setup script.
• Connect the Windows 10 client to the server via VPN.
• SSH to the VPN server and ping another device on the LAN.

What happened

• In the SSH session on the VPN server, ping to LAN would report all packets lost for about an hour.
• At the same time, ping to the outside (e.g. 8.8.8.8) remains functioning.
• If the VPN client disconnects, ping to LAN would resume.
• No traffic from the Windows 10 client to LAN can be observed either.

Expected behavior
The purpose of the VPN server is to allow remote user to connect to the office LAN: So ping from both the client and the VPN server should reach other devices on the LAN.

I suspect that the iptables rules are the cause of the problem. Here is an output from iptables --list:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere             state NEW recent: UPDATE seconds: 300 hit_count: 60 name: DEFAULT side: source mask: 255.255.255.255
           all  --  anywhere             anywhere             state NEW recent: SET name: DEFAULT side: source mask: 255.255.255.255
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere             state INVALID
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     udp  --  anywhere             anywhere             udp dpt:isakmp
ACCEPT     udp  --  anywhere             anywhere             udp dpt:ipsec-nat-t
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  10.1.10.0/24         10.1.10.0/24
ACCEPT     all  --  10.101.0.0/16        anywhere             policy match dir in pol ipsec proto esp
ACCEPT     all  --  anywhere             10.101.0.0/16        policy match dir out pol ipsec proto esp
DROP       all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

where 10.1.10.0/24 is the LAN.

Thanks in advance for any help!!

[tobiasbrunner]

Does your server have more than one interface?

Added links in swanctl configuration to the Letsencrypt generated key, cert and CA cert.

Hm, I don't get that. The script seems to use the old config backend exclusively, so how is swanctl involved?

Anyway, might be something with the script (I saw some similar issues there), or maybe something specific to your server (which would require more information, see #196).

[ww9rivers]

The server has only one interface (enp1s0) that is active. It does have a built-in Wi-Fi interface (wlp2s0) which is disconnected.

As a newbie to strongSwan, the script was very helpful to get me started. But I had error connecting the Windows 10 client to the server (IKE Authentication credentials are unacceptable). Adding the swanctl configs got me over that.

What I want to set up is:

• Allow users to connect to the VPN from home and get the 10.101.0.0/16 address;
• Traffic to office LAN (10.1.10.0/24) is routed through the VPN server and NAT'ed;
• Split-tunnel: Users' access to the rest of the Internet do not go through the VPN.

Here is my ipsec.conf:

config setup
  strictcrlpolicy=yes
  uniqueids=never

conn roadwarrior
  auto=add
  compress=no
  type=tunnel
  keyexchange=ikev2
  fragmentation=yes
  forceencaps=yes

  ike=aes256gcm16-prfsha384-ecp384,aes256gcm16-prfsha256-ecp256!
  esp=aes256gcm16-ecp384!

  dpdaction=clear
  dpddelay=900s
  rekey=no
  left=%any
  leftid=@_vpn-hostnmae_
  leftcert=cert.pem
  leftsendcert=always
  leftsubnet=0.0.0.0/0
  right=%any
  rightid=%any
  rightauth=eap-mschapv2
  eap_identity=%any
  rightdns=10.1.10.1,1.1.1.1
  rightsourceip=10.101.0.0/16
  rightsubnet=10.1.10.0/24
  rightsendcert=never

Also, here is the iptables --list -t nat:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  10.101.0.0/16        anywhere             policy match dir out pol ipsec
MASQUERADE  all  --  10.101.0.0/16        anywhere
ACCEPT     all  --  10.1.10.0/24         10.1.10.0/24

Thank you for your insights!

[tobiasbrunner]

But I had error connecting the Windows 10 client to the server (IKE Authentication credentials are unacceptable). Adding the swanctl configs got me over that.

What exactly did you add? And which config backend (stroke or vici) and which daemon (charon or charon-systemd) are you using then? Or do you maybe have both daemons active (which is not a good idea at all, see the note regarding Debian/Ubuntu packages here)?

Split-tunnel: Users' access to the rest of the Internet do not go through the VPN.

That's kinda tricky with Windows clients. In particular if the virtual IP is not from the remote subnet. Might require manually setting up routes via Add-VpnConnectionRoute.