I have a StrongSwan VPN server running on Ubuntu 16.04.5 LTS. The public IP is 51.x.x.x. The site to site configuration between my StrongSwan vpn server and the other VPN server which is cisco ASA firewall with public IP 188.8.131.52, works fine.
Once the tunnel is up, I could ping and telnet into private server 184.108.40.206 which sits behind cisco ASA firewall. Server 220.127.116.11 is not accessible via open internet except through the vpn tunnel. Note that the IP is public IP.
I set up this strongswan vpn server to act as a bridge between my private network 192.168.0.0/16 and cisco ASA firewall.(my strongswan vpn server private IP is 192.168.0.8). That is, I want to be able to ping or telnet into 18.104.22.168 from 192.168.0.13, via Strongswan VPN server, acting as a router.
My vpn server has two NICS: ens18 which carry public IP address and ens19 with private IP address.
I defined two zones in my VPN server: public and internal zones. I assigned public interface to public zone and private interface to internal zone
I successfully ran this command to packet forwarding but I do not see its effect sudo firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POSTROUTING -o ens18 -j MASQUERADE -s 192.168.0.0/23 -d 22.214.171.124
When I try to ping 126.96.36.199, it failed. 100% packet loss.
Here are my configurations on the Strongswan vpn server:
sore@ubuntu-vpnserver:~$ sudo firewall-cmd --list-all --zone=public [sudo] password for sore: public (default, active) interfaces: ens18 sources: services: dhcpv6-client ipsec ssh ports: 4500/udp 500/udp protocols: masquerade: yes forward-ports: port=4500:proto=udp:toport=443:toaddr=188.8.131.52 port=500:proto=udp:toport=443:toaddr=184.108.40.206 port=4500:proto=udp:toport=443:toaddr=192.168.0.13 port=500:proto=udp:toport=443:toaddr=192.168.0.13 icmp-blocks: rich rules: rule protocol value="ah" accept rule protocol value="esp" accept
Here is my /etc/network/interfaces file
auto ens18 iface ens18 inet static address 51.x.x.x netmask 255.255.255.255 broadcast 51.x.x.x post-up route add 54.36.12x.x dev ens18 post-up route add default gw 54.36.12x.x pre-down route del 54.36.12x.x dev ens18 pre-down route del default gw 56.36.12x.x dns-nameservers 213.186.x.x
auto ens19 iface ens19 inet static address 192.168.0.8 netmask 255.255.254.0 getway 192.168.0.1