I have a site-to-site IPsec tunnel up and running between a
strongswan (v5.2.0) instance (site A) and a
RouterOS router (site B). Everything works fine, the hosts in the two private subnets setup for site A (
10.10.0.0/16) and B (
10.50.0.0/16) can communicate with each other just fine.
What I don't understand though is the following output of
ip xfrm policy on site A's router (public IPs obfuscated). Theses policies were created by
strongswan, I did not manually install or modfify them:
ip xfrm policy src 10.50.0.0/16 dst 10.10.0.0/16 dir fwd priority 2947 ptype main tmpl src <PUBLIC_IP_B> dst <PUBLIC_IP_A> proto esp reqid 1 mode tunnel src 10.50.0.0/16 dst 10.10.0.0/16 dir in priority 2947 ptype main tmpl src <PUBLIC_IP_B> dst <PUBLIC_IP_A> proto esp reqid 1 mode tunnel src 10.10.0.0/16 dst 10.50.0.0/16 dir out priority 2947 ptype main tmpl src <PUBLIC_IP_A> dst <PUBLIC_IP_B> proto esp reqid 1 mode tunnel
There's a policy each for input and output, but only one for forwarding (from site B to site A). But I can still successfully ping, for instance,
ping -R 10.50.4.11 PING 10.50.4.11 (10.50.4.11): 56 data bytes 64 bytes from 10.50.4.11: icmp_seq=0 ttl=62 time=10.872 ms RR: 10.10.0.89 10.50.0.1 10.50.4.11 10.50.4.11 10.50.4.11 10.10.0.2 10.10.0.89
The interesting part about this route trace is that site A's router (
10.10.0.2) only shows up on the route back from the ping target, while site B's router (
10.50.0.1) is only listed for the outgoing route.
This seems to confirm that there is actually no forward policy needed on site A's router to forward
10.50.0.0/16 over the IPsec tunnel, but I do not understand why.
Thanks for any explanations!