Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using strongswan 4.6.4 to connect road warriors to my server (ubuntu 13.10), which is natted behind a firewall.


The "leftsubnet" is also dedicated VPN service network, the server itself is on the network and has IP addresses in both networks ( and %defaultroute points to

The vpn itself is working and if the ufw firewall is not running, then access from the road warrior clients to the server is working. tcpdump shows traffic from to

Now when ufw firewall is started, tunnel creation still works but the traffic which is comming from the road warriors is source and destination natted.

Which means tcpdump shows as source IP the public IP of the client instead of the virtual ip and as destination IP instead of

Of course, there are no nat rules in iptables.

How can I nail down the problem? AFAIK ufw just maintains iptables rules. Where does the nat happen when ufw is active?

Many thanks!

share|improve this question
Although I still don't have an answer where any why the NAT is happening - the problem went away after upgrading to strongswan 5.1.1. – Martin Mar 15 '14 at 18:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.