Strongswan and OpenVPN together

Question

I have an host in Amazon EC2 which is configured with an OpenVPN Access Server. The only client to this server is acting as a gateway from a private network. I installed StrongSWAN 5 on the same host to allow windows 7 and iOS clients to connect using IPSEC.

Both services works but what I cannot figure out is how to configure StrongSWAN to consider the OpenVPN tunnel endpoint as the only gateway available to clients.

Basically I want all the traffic that comes from IPSEC clients to be entirely forwarded to the OpenVPN tunnel.

The remote OpenVPN client that is exposing the private network has forwarding enabled and appropriate masquerading configured.

The only missing point is to have the OpenVPN tunnel as the gateway for IPsEC clients

Answer 1

Seems you only forgot to set the appropriate routes :

1 - each client have to know the defaut router is the the Amazon host : if you issue a traceroute from a client to Google, you must see it going thru Amazon. If not, on each client : route add 0.0.0.0 mask 0.0.0.0 w.x.y.z with w.x.y.z = the IP address of the StrongSWAN endpoint on the Amazon host (or the IP address of the other endpoint, I don't know how StrongSWAN react).

2 - the Amazon host has to know the default router is the OpenVPN tunnel : set the default route to OpenVPN's endpoint

3 - the Amazon host also has to know the routes back to clients. StrongSWAN may take care of it. If not, you must add a route to each client with route add 192.168.x.0 mask 255.255.255.0 w.x.y.z (the values are difficult to explain. If you have problem, give us an example with your addresses)