I have a StrongSwan VPN server running on Ubuntu 16.04.5 LTS. The public IP is 51.x.x.x. The site to site configuration between my StrongSwan vpn server and the other VPN server which is cisco ASA firewall with public IP, works fine.

Once the tunnel is up, I could ping and telnet into private server which sits behind cisco ASA firewall. Server is not accessible via open internet except through the vpn tunnel. Note that the IP is public IP.

I set up this strongswan vpn server to act as a bridge between my private network and cisco ASA firewall.(my strongswan vpn server private IP is That is, I want to be able to ping or telnet into from, via Strongswan VPN server, acting as a router.

My vpn server has two NICS: ens18 which carry public IP address and ens19 with private IP address.

I defined two zones in my VPN server: public and internal zones. I assigned public interface to public zone and private interface to internal zone

I successfully ran this command to packet forwarding but I do not see its effect sudo firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POSTROUTING -o ens18 -j MASQUERADE -s -d

When I try to ping, it failed. 100% packet loss.

Here are my configurations on the Strongswan vpn server:

sore@ubuntu-vpnserver:~$ sudo firewall-cmd --list-all --zone=public [sudo] password for sore: public (default, active) interfaces: ens18 sources: services: dhcpv6-client ipsec ssh ports: 4500/udp 500/udp protocols: masquerade: yes forward-ports: port=4500:proto=udp:toport=443:toaddr= port=500:proto=udp:toport=443:toaddr= port=4500:proto=udp:toport=443:toaddr= port=500:proto=udp:toport=443:toaddr= icmp-blocks: rich rules: rule protocol value="ah" accept rule protocol value="esp" accept

Here is my /etc/network/interfaces file

auto ens18 iface ens18 inet static address 51.x.x.x netmask broadcast 51.x.x.x post-up route add 54.36.12x.x dev ens18 post-up route add default gw 54.36.12x.x pre-down route del 54.36.12x.x dev ens18 pre-down route del default gw 56.36.12x.x dns-nameservers 213.186.x.x

auto ens19 iface ens19 inet static address netmask getway

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.