[Swan] routing across two tunnels

Nick Howitt nick at howitts.co.uk
Mon Jun 8 14:55:38 EEST 2015

Hi Bob,

Do you have a tunnel from your roadwarrior to Libreswan for the subnet I don't know the Windows client (or any ikev2 details 
therefore my knowledge is entirely theoretical)so I don't know if you 
can use left/rightsubnets in Libreswan or if you have to define two 
different tunnels.

Similarly you will need a tunnel with subnets from and When negotiating these tunnels with the Sonicwall, do 
you see both coming up? Again, if the Sonicwall can't cope you may also 
need to define two separate tunnels from Libreswan.

 From a different angle, what is your roadwarrior's local LAN subnet when 
performing these tests? If is then you have a big issue 
as both the local and (very) remote subnets are the same.



On 2015-06-07 01:23, Bob Miller wrote:
> Hi,
> I am not sure if I am being dense and not seeing what is there, or if
> what I am looking for really isn't there.
> I have a firewall running libreswan that has an ipsec/psk net2net
> tunnel configured between it and a sonicwall device.  This firewall
> also has multiple road warriors connecting to the local network behind
> it. Remote windows machines are configured with ikev2.
> the gist:
><=^ ^=>Internet
> each segment works fine;
> remotelan<=>LAN, RW<=>LAN, Internet<=>LAN works great
> RW<=>LAN, RW<=>Internet works great.
> remotelan<=>internet doesn't work, which is great.
> Now I want the roadwarriors to access the remote lan, but I can't seem
> to figure it out.
> It happens I have another identical situation, with the singular
> difference that the road warriors are connecting via l2tp.  I have
> tried to get the same thing working on that one in the hopes that
> something about l2tp would magically work and grant me understanding.
> I have been at it for a while now, it would be tough to list all I
> have done, but generally I started at iptables, thinking it would be a
> simple forwarding thing.  I made sure I wasn't nat'ing my traffic,
> forward rules are in place, etc.  maybe there is a problem there, but
> I don't see it if there is.
> Next I played with left/rightsubnets (as opposed to singular subnet)
> as per what I found in the ipsec.conf man page.  I think I tried every
> combination at least twice, but nothing changed there.
> I looked through more of the docs.  I found passthrough conns, which
> seem like what I might want, but the only examples I can find are for
> extruded subnets, where one side is a smaller subset of a larger
> subnet on the other side.  regardless, tried a bunch of ways to make
> that work but no success.  I also looked through the multi-net
> examples, but those seem related to klips, and I think I need to find
> and study the context of those examples to get value from them...
> On google, I found a limited number of posts that discuss the topic.
> In the posts that seemed relevant, I could follow the discussion, but
> in no cases could I translate the examples to a working config on this
> firewall.
> I am not afraid to read and try and figure it out on my own, but I
> don't think I am reading the right stuff.  or if I am I haven't
> recognized it yet.  could someone kindly point me at the definitive
> thing I need to read and understand to achieve my goal?

More information about the Swan mailing list