Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm creating an IPSec tunnel from a Linux box to a SonicWall firewall running standard firmware. The tunnel seems to be getting created just fine, but packets from the Linux box to the remote network are not being routed into the tunnel. Packets from the remote network seem to be fine. Attempts to ping from the Linux box to the secure remote network get routed via the normal routing table.

Looking at the routing table and cache, there are no entries for (the remote network). My expectation from the docs is that the tunnel policy would insert the route.

Any ideas appriciated.

Thanks, Brad

Here's my conf script:

#!/sbin/setkey -f
# Configuration for

# Flush the SAD and SPD

add ah 0x200 -m tunnel -A hmac-sha1
add ah 0x300 -m tunnel -A hmac-sha1

add esp 0x201 -m tunnel -E 3des-cbc
add esp 0x301 -m tunnel -E 3des-cbc

# Security policies
spdadd any -P out ipsec

spdadd any -P in ipsec

#Forward Policy
#DOH!  iptools > 0.5 do this automatically.
#spdadd any -P fwd ipsec
#           esp/tunnel/
#           ah/tunnel/;
share|improve this question
  • If your running the vpn on a box that isn't the Linux boxes default gateway, you will need to add routes on the Linux boxes pointing to the proper gateway.

  • Check your firewall rules. You don't want to MASQUERADE the traffic going through the VPN.

You've probably already taken a look at it, but take a look at the Linux IPsec how to.

You may also want to look into useing racoon, it can take some of the pain out if ipsec configuration.

share|improve this answer

1) You shouldn't need special routes. If you can communicate w/o IPSec, you should be in good shape.

2) Check your firewalls and IPtables. The protocols change from TCP to AH and ESP. This can be confusing (or was for me) because we're so used to thinking if TCP/IP only.

share|improve this answer

i had the same problem and don't know why. i've read somewhere that you shouldn't need routing entries because of the kernel directly taking care of it through the ipsec security associations (sa).

nevertheless, it should work (and worked for me) if you set up a static route like:

ip route add via
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.