I have a server running strongSwan on an Amazon EC2 instance that I want to connect to with Windows 7. The strongSwan server is on a private network (IP address on the network and has traffic forwarded to its private address from a public IP address - this is what Amazon calls "Elastic IP".

I want to assign the clients addresses from another private subnet - - and route traffic between the two private subnets. Note that the subnet is managed by Amazon, but the subnet isn't managed by anything right now (other than my ipsec.conf).

My Windows clients do connect to the VPN, but cannot connect to any hosts on the private network. My theory is that it is related to a problem with either the client routing or a lack of some iptables invocation on the server, but I'm not very knowledgeable in either domain and I've gotten stuck.

  • I have installed Ubuntu 12.04 and strongswan-ikev2 on the server.
  • ipsec version reports Linux strongSwan U4.5.2/K3.2.0-52-virtual
  • Note that both the client and server are behind NAT (the client because it is on a local office network, and the server because it is in Amazon's cloud). I have unblocked UDP ports 500 and 4500 in the Amazon dashboard, and on the client's firewall.
  • I have enabled IPv4 forwarding on the server: echo 1 > /proc/sys/net/ipv4/ip_forward
  • I have gone into Amazon's VPC administrative UI for the subnet and allowed all traffic to/from the subnet.
  • This is /etc/ipsec.conf:

    config setup
    conn %default
    conn dlpvpn
  • This is /etc/ipsec.secrets:

    : RSA openssl-key.rsa
    TESTDOMAIN\testuser : EAP "testpassword"
  • This is /etc/strongswan.conf:

    charon {
        threads = 16
        dns1 =
  • I want to use split tunneling - where only traffic for the private network goes over the VPN, and traffic bound for the Internet uses the client's local gateway. To do this, I have unchecked "Use default gateway on remote network", and checked "Disable class based route addition" on the Windows client.

  • The connection completes sucessfully. ipconfig /all shows:

    PPP adapter strongswan:
       Description . . . . . . . . . . . : strongswan
       IPv4 Address. . . . . . . . . . . :
       Subnet Mask . . . . . . . . . . . :
       Default Gateway . . . . . . . . . :
       DNS Servers . . . . . . . . . . . :
  • However, I can't ping any host on the network. In fact, if I do an nslookup, it attempts to contact the DNS server I specified in strongswan.conf, but Wireshark on that DNS server shows that it received nothing. I can't even ping the address of the strongSwan server itself.

  • It's my understanding that route rules must be added manually on Windows. However, what do they need to be? The only answer that I could come up with was to try adding the route for the network to use the VPN server's address as the gateway using the command route add if 45. However, that didn't change anything - traffic from my VPN client did not make it to the network.

I'd appreciate any help. Thanks.

  • You should definitely specify leftsubnet= otherwise no IPsec policy is installed and no traffic to that subnet is allowed (only would be reachable, not sure why it doesn't in your case, perhaps a Windows issue). You could first try the default, i.e. leftsubnet=, and then move to split tunneling later. – ecdsa Sep 5 '13 at 9:21
  • Hmm, OK. I just tried setting it to and that doesn't change the behavior at all. I also tried setting a route manually on the Windows client after changing that setting and restarting ipsec with route add mask, which also resulted in no behavior change. – Micah R Ledbetter Sep 5 '13 at 15:21

I finally have this working, thanks to help from @ecdsa here and some help from the #strongswan irc channel.

  1. My VPN client's route rules were incomplete. I needed to add both of these rules:

    route add
    route add

    The first one adds a route for the VPN server's private IP address, specifying my client's VPN-assigned IP address as the gateway to it (route print will then display this as being on-link AKA local to that interface). The second one does what I was trying to do with the route rule in my question - it adds a route for the whole private network, specifying the VPN server as the gateway.

  2. I needed to specify leftsubnet= on the server, or else IPsec policy wouldn't permit traffic to the subnet no matter what the routes were.

  3. I needed to specify leftfirewall=yes on the server so that it would insert appropriate rules into iptables.

  4. I needed to disable "source/dest check" on my Amazon instance. While I had allowed traffic from my VPN subnet to/from the security groups in the Amazon VPC dashboard, I didn't realize there was another setting. On the EC2 dashboard, you can right click on an instance and go to "Change source/dest check". This check is enabled by default and prevented my VPN traffic from ever leaving the VPN server (and it prevented traffic from other VPC hosts to my VPN subnet from entering the VPN server).

| improve this answer | |
  • I'm having the same issue, but this doesn't work for me. I'm so confused by the first route you added in step 1. If is a VPN tunnel to then how can you route to again? Isn't that a circular loop? – Ryan Shillington Apr 15 '16 at 4:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.