Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an host in Amazon EC2 which is configured with an OpenVPN Access Server. The only client to this server is acting as a gateway from a private network. I installed StrongSWAN 5 on the same host to allow windows 7 and iOS clients to connect using IPSEC.

Both services works but what I cannot figure out is how to configure StrongSWAN to consider the OpenVPN tunnel endpoint as the only gateway available to clients.

Basically I want all the traffic that comes from IPSEC clients to be entirely forwarded to the OpenVPN tunnel.

The remote OpenVPN client that is exposing the private network has forwarding enabled and appropriate masquerading configured.

The only missing point is to have the OpenVPN tunnel as the gateway for IPsEC clients

share|improve this question

Seems you only forgot to set the appropriate routes :

1 - each client have to know the defaut router is the the Amazon host : if you issue a traceroute from a client to Google, you must see it going thru Amazon. If not, on each client : route add mask w.x.y.z with w.x.y.z = the IP address of the StrongSWAN endpoint on the Amazon host (or the IP address of the other endpoint, I don't know how StrongSWAN react).

2 - the Amazon host has to know the default router is the OpenVPN tunnel : set the default route to OpenVPN's endpoint

3 - the Amazon host also has to know the routes back to clients. StrongSWAN may take care of it. If not, you must add a route to each client with route add 192.168.x.0 mask w.x.y.z (the values are difficult to explain. If you have problem, give us an example with your addresses)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.