I'm using Linux strongSwan U5.3.5/K4.4.0-116-generic on Ubuntu 16.04 with IOS 11 IKEv2 client.
The connection could be successfully established on my client(IOS 11) and if I go to ip check webpage, e.g. myip.com it shows the VPN server's address.
However, I found that if I connect to a customized port on the same server for HTTPS, it could get blocked by my evil nat firewall even when the IKEv2 is established.
My understanding is that IPSEC will create a tunnel through port 500/4500, and making all traffic encrypted. Therefore I am wondering how will my company or other(nation level) firewall distinguish between different traffic? i.e. drop my https request on a arbitary port.
I tried directly using ip address to access, i.e https://xx.xx.xx.xx:12345, but does not seem make a difference.
My suspect is that this tunnel is not a end-to-end(my iphone to server) tunnel. Because my iphone is behind NAT somehow the connection is not encrypted from my IOS to my company gateway. Is this the reason?
Here is the ipsec.conf conn:
config setup cachecrls=yes uniqueids=yes charondebug="" conn %default keyingtries=%forever dpddelay=30s dpdtimeout=120s conn IKEv2-EAP-TLS auto=add type=tunnel keyexchange=ikev2 dpdaction=clear dpddelay=300s authby=pubkey left=%SERVERIP% leftid=%SERVERIP% leftsubnet=0.0.0.0/0 leftcert=vpnSrvCert.der leftsendcert=always right=%any rightid=%any rightsourceip=10.10.10.0/24 rightdns=22.214.171.124,126.96.36.199 rightauth=eap-tls
[Update] After some trial-and-error, I believe the reason is what BillThor has described. I found that at a no censorship WIFI environment, when I connect to the HTTPS port on the same (IKEv2) server1, it's a seperate TCP link.
On the other hand, when I connected to another L2TP server2(not the HTTPS) from inside censored WIFI, I could successfully connect to the original server1's HTTPS port.