I'm using strongswan 4.6.4 to connect road warriors to my server (ubuntu 13.10), which is natted behind a firewall.
left=%defaultroute leftsubnet=10.10.1.0/24 right=%any rightsubnet=10.11.1.0/24 rightsourceip=10.11.1.0/24
The "leftsubnet" 10.10.1.0/24 is also dedicated VPN service network, the server itself is on the network 192.168.1.0/24 and has IP addresses in both networks (192.168.1.2 and 10.10.1.2). %defaultroute points to 192.168.1.1.
The vpn itself is working and if the ufw firewall is not running, then access from the road warrior clients to the server is working. tcpdump shows traffic from 10.11.1.1 to 10.10.1.2.
Now when ufw firewall is started, tunnel creation still works but the traffic which is comming from the road warriors is source and destination natted.
Which means tcpdump shows as source IP the public IP of the client instead of the virtual ip 10.11.1.1 and as destination IP 192.168.1.2 instead of 10.10.1.2.
Of course, there are no nat rules in iptables.
How can I nail down the problem? AFAIK ufw just maintains iptables rules. Where does the nat happen when ufw is active?