Personal Blog of Andrej Stender, covering Linux and other topics.
Blog
Latest
Archive
Tags
My Profiles
GitHub
LinkedIn
Xing
Facebook
Misc
Legal Notice
Privacy Policy
About this Website
Personal Blog of Andrej Stender, covering Linux and other topics.
Blog
Latest
Archive
Tags
My Profiles
GitHub
LinkedIn
Xing
Facebook
Misc
Legal Notice
Privacy Policy
About this Website
back to parent article
ip addr add 192.168.1.100/24 dev eth0 ip route add default via 192.168.1.1
ip addr add 192.168.2.100/24 dev eth0 ip route add default via 192.168.2.1
ip addr add 192.168.1.1/24 dev eth0 ip addr add 8.0.0.1/8 dev eth1 ip route add default via 8.0.0.2 sysctl net.ipv4.ip_forward=1
On successful IKE handshake, Strongswan adds an additional routing table
(no. 220
) here and puts a source route in it which tells r1
to use the
IP address 192.168.1.1
of its eth0
interface when sending locally
generated packets to hosts in the VPN peer subnet 192.168.2.0/24
.
ip route show table 220 192.168.2.0/24 via 8.0.0.2 dev eth1 proto static src 192.168.1.1
This behavior depends on the Strongswan configuration
setting charon.install_route
, however the default value for this setting is yes
. The
setting will usually be placed in file /etc/strongswan.d/charon.conf
. See reference docu on strongswan.conf.
Strongswan automatically removes this route again when the VPN tunnel is terminated.
ip addr add 8.0.0.2/8 dev eth0 ip addr add 9.0.0.2/8 dev eth1 sysctl net.ipv4.ip_forward=1
Intentionally, no routes to subnets 192.168.1.0/24
and 192.168.2.0/24
are set here because in this topology rx fulfills the role of a router in
the Internet and routers in the Internet do not have routes into private
subnets behind edge routers like r1
and r2
.
ip addr add 192.168.2.1/24 dev eth0 ip addr add 9.0.0.1/8 dev eth1 ip route add default via 9.0.0.2 sysctl net.ipv4.ip_forward=1
This route is added by Strongswan (already explained for r1
):
ip route show table 220 192.168.1.0/24 via 9.0.0.2 dev eth1 proto static src 192.168.2.1