Hi I'm running Barrier Breaker version of OpenWRT and I have setup a VPN according to: http://wiki.openwrt.org/inbox/strongswan.howto I can connect to the VPN with my iPhone or Mac (to network). I can also connect from Windows 7. An IP is allocated to the client successfully using DHCP. Once connected I can't access anything on the network. /etc/firewall.user contains:

# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
iptables -I INPUT  -m policy --dir in --pol ipsec --proto esp -j ACCEPT
iptables -I FORWARD  -m policy --dir in --pol ipsec --proto esp -j ACCEPT
iptables -I FORWARD  -m policy --dir out --pol ipsec --proto esp -j ACCEPT
iptables -I OUTPUT   -m policy --dir out --pol ipsec --proto esp -j ACCEPT
# Enable ssh and HTTP to router
iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT
iptables -I OUTPUT 1 -p tcp --sport 22 -j ACCEPT
iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT
iptables -I OUTPUT 1 -p tcp --sport 80 -j ACCEPT

/etc/ipsec.conf contains:

# ipsec.conf - strongSwan IPsec configuration file
# basic configuration
config setup
    # strictcrlpolicy=yes
    # uniqueids = no
conn ios                                              

conn %default                                         
conn win7                                             

(The real domain name of the router has been replaced above with xxx.yyy.com).

/etc/strongswan.conf contains:

# strongswan.conf - strongSwan configuration file
charon {
    dns1 =
    # number of worker threads in charon
    threads = 16
    # send strongswan vendor ID?
    # send_vendor_id = yes
    plugins {
            dhcp {
                    server =
            sql {                     
                    # loglevel to log into sql database
                    loglevel = -1                      

                    # URI to the database              
                    # database = sqlite:///path/to/file.db
                    # database = mysql://user:password@localhost/database

    # ...                                                                

pluto {                                                                      


libstrongswan {                                                              

    #  set to no, the DH exponent size is optimized                      
    #  dh_exponent_ansi_x9_42 = no                                       

When I connect with both Windows 7 and also iPhone ipsec status on router shows:

Security Associations (2 up, 0 connecting):
     ios[5]: ESTABLISHED 4 seconds ago, xxx.xxx.xxx.xxx[C=AU, O=Netroworx, CN=xxx.xxx.com]...xxx.xxx.xxx.xxx[C=AU, O=Netroworx, CN=client]
     ios{5}:  INSTALLED, TUNNEL, ESP in UDP SPIs: c8618e27_i 0923f471_o
     ios{5}: === 
    win7[4]: ESTABLISHED 45 seconds ago, xxx.xxx.xxx.xxx[xxx.xxx.com]...xxx.xxx.xxx[]
    win7{4}:  INSTALLED, TUNNEL, ESP in UDP SPIs: cae3b4a6_i 67f3eaf0_o
    win7{4}: ===

(Sensitive ips and domain names replaced with xxx)

Any ideas on why packets are not being routed over the vpn?

Could this be a NAT thing?

Update: I get the following when trying to install strongswan on Barrier Breaker:

opkg install strongswan-full
Installing strongswan-full (5.0.4-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/strongswan-full_5.0.4-1_ar71xx.ipk.
Multiple packages (kmod-crypto-hash and kmod-crypto-hash) providing same name marked HOLD or PREFER. Using latest.
Multiple packages (kmod-crypto-manager and kmod-crypto-manager) providing same name marked HOLD or PREFER. Using latest.
Multiple packages (kmod-crypto-core and kmod-crypto-core) providing same name marked HOLD or PREFER. Using latest.
Collected errors:
 * satisfy_dependencies_for: Cannot satisfy the following dependencies for strongswan-full:
 *      kernel (= 3.10.18-1-0de2f8afeb2eecb34eeca6f54b460523) * 
 * opkg_install_cmd: Cannot install package strongswan-full.
  • You should remove rightsubnet= in both configs. Also, is the farp plugin loaded? (You can check with ipsec statusall) – ecdsa May 7 '13 at 9:45
  • Removed rightsubnet – Greg Pagendam-Turner May 8 '13 at 0:41
  • farp is loaded: loaded plugins: charon test-vectors curl ldap mysql sqlite pkcs11 aes des blowfish sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs8 pgp dnskey pem openssl gcrypt af-alg fips-prf gmp agent xcbc cmac hmac ctr ccm gcm attr kernel-netlink resolve socket-default farp stroke smp updown eap-identity eap-md5 eap-mschapv2 eap-radius xauth-generic xauth-eap dhcp whitelist led duplicheck uci addrblock unity – Greg Pagendam-Turner May 8 '13 at 0:42
  • rightsubnet does not resolve the issue – Greg Pagendam-Turner May 8 '13 at 0:50
  • Quite bizarre that it should be tied to a specific kernel version. I'd probably build an image with ImageBuilder and add strongswan to it. Could also be your image is out of date. Barrier Breaker does change nightly, of course. – Michael Hampton Nov 29 '13 at 5:10

I've exactly same problem. Did you found solution for this issue yet ? Some gurus said, that I need to masquerade traffic. Try following:

iptables -I POSTROUTING 1 -s -j MASQUERADE -t nat
iptables -I FORWARD -m conntrack --ctstate SNAT -j ACCEPT
iptables -I FORWARD -m conntrack -s --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT

It didn't work for me, but maybe it will work for you.

  • The openwrt guys said I needed a later version of firmware. I've since tried to install strongswan on the new firmware but a dependency could not be downloaded. – Greg Pagendam-Turner Nov 18 '13 at 22:49

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.