0

I have a StrongSwan VPN server running on Ubuntu 16.04.5 LTS. The public IP is 51.x.x.x. The site to site configuration between my StrongSwan vpn server and the other VPN server which is cisco ASA firewall with public IP 41.10.10.2, works fine.

Once the tunnel is up, I could ping and telnet into private server 41.10.11.3 which sits behind cisco ASA firewall. Server 41.10.11.3 is not accessible via open internet except through the vpn tunnel. Note that the IP is public IP.

I set up this strongswan vpn server to act as a bridge between my private network 192.168.0.0/16 and cisco ASA firewall.(my strongswan vpn server private IP is 192.168.0.8). That is, I want to be able to ping or telnet into 41.10.11.3 from 192.168.0.13, via Strongswan VPN server, acting as a router.

My vpn server has two NICS: ens18 which carry public IP address and ens19 with private IP address.

I defined two zones in my VPN server: public and internal zones. I assigned public interface to public zone and private interface to internal zone

I successfully ran this command to packet forwarding but I do not see its effect sudo firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POSTROUTING -o ens18 -j MASQUERADE -s 192.168.0.0/23 -d 41.220.79.242

When I try to ping 41.10.11.3, it failed. 100% packet loss.

Here are my configurations on the Strongswan vpn server:

sore@ubuntu-vpnserver:~$ sudo firewall-cmd --list-all --zone=public [sudo] password for sore: public (default, active) interfaces: ens18 sources: services: dhcpv6-client ipsec ssh ports: 4500/udp 500/udp protocols: masquerade: yes forward-ports: port=4500:proto=udp:toport=443:toaddr=137.74.50.58 port=500:proto=udp:toport=443:toaddr=137.74.50.58 port=4500:proto=udp:toport=443:toaddr=192.168.0.13 port=500:proto=udp:toport=443:toaddr=192.168.0.13 icmp-blocks: rich rules: rule protocol value="ah" accept rule protocol value="esp" accept

Here is my /etc/network/interfaces file

auto ens18 iface ens18 inet static address 51.x.x.x netmask 255.255.255.255 broadcast 51.x.x.x post-up route add 54.36.12x.x dev ens18 post-up route add default gw 54.36.12x.x pre-down route del 54.36.12x.x dev ens18 pre-down route del default gw 56.36.12x.x dns-nameservers 213.186.x.x

auto ens19 iface ens19 inet static address 192.168.0.8 netmask 255.255.254.0 getway 192.168.0.1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.