I have a site-to-site IPsec tunnel up and running between a strongswan
(v5.2.0) instance (site A) and a RouterOS
router (site B). Everything works fine, the hosts in the two private subnets setup for site A (10.10.0.0/16
) and B (10.50.0.0/16
) can communicate with each other just fine.
What I don't understand though is the following output of ip xfrm policy
on site A's router (public IPs obfuscated). Theses policies were created by strongswan
, I did not manually install or modfify them:
ip xfrm policy
src 10.50.0.0/16 dst 10.10.0.0/16
dir fwd priority 2947 ptype main
tmpl src <PUBLIC_IP_B> dst <PUBLIC_IP_A>
proto esp reqid 1 mode tunnel
src 10.50.0.0/16 dst 10.10.0.0/16
dir in priority 2947 ptype main
tmpl src <PUBLIC_IP_B> dst <PUBLIC_IP_A>
proto esp reqid 1 mode tunnel
src 10.10.0.0/16 dst 10.50.0.0/16
dir out priority 2947 ptype main
tmpl src <PUBLIC_IP_A> dst <PUBLIC_IP_B>
proto esp reqid 1 mode tunnel
There's a policy each for input and output, but only one for forwarding (from site B to site A). But I can still successfully ping, for instance, 10.50.4.11
from 10.10.0.89
:
ping -R 10.50.4.11
PING 10.50.4.11 (10.50.4.11): 56 data bytes
64 bytes from 10.50.4.11: icmp_seq=0 ttl=62 time=10.872 ms
RR: 10.10.0.89
10.50.0.1
10.50.4.11
10.50.4.11
10.50.4.11
10.10.0.2
10.10.0.89
The interesting part about this route trace is that site A's router (10.10.0.2
) only shows up on the route back from the ping target, while site B's router (10.50.0.1
) is only listed for the outgoing route.
This seems to confirm that there is actually no forward policy needed on site A's router to forward 10.10.0.0/16
to 10.50.0.0/16
over the IPsec tunnel, but I do not understand why.
Thanks for any explanations!