Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm using strongswan 4.6.4 to connect road warriors to my server (ubuntu 13.10), which is natted behind a firewall.

    left=%defaultroute
    leftsubnet=10.10.1.0/24
    right=%any
    rightsubnet=10.11.1.0/24
    rightsourceip=10.11.1.0/24

The "leftsubnet" 10.10.1.0/24 is also dedicated VPN service network, the server itself is on the network 192.168.1.0/24 and has IP addresses in both networks (192.168.1.2 and 10.10.1.2). %defaultroute points to 192.168.1.1.

The vpn itself is working and if the ufw firewall is not running, then access from the road warrior clients to the server is working. tcpdump shows traffic from 10.11.1.1 to 10.10.1.2.

Now when ufw firewall is started, tunnel creation still works but the traffic which is comming from the road warriors is source and destination natted.

Which means tcpdump shows as source IP the public IP of the client instead of the virtual ip 10.11.1.1 and as destination IP 192.168.1.2 instead of 10.10.1.2.

Of course, there are no nat rules in iptables.

How can I nail down the problem? AFAIK ufw just maintains iptables rules. Where does the nat happen when ufw is active?

Many thanks!

share|improve this question
    
Although I still don't have an answer where any why the NAT is happening - the problem went away after upgrading to strongswan 5.1.1. –  Martin Mar 15 at 18:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.