[Swan] Understanding left/rightsubnet for "VPN server for remote clients using IKEv2"
bradyjoh at redhat.com
Sun Mar 27 15:37:26 EEST 2022
I am trying to configure a VPN IPSec server and client using Libreswan
according to .
For the VPN server, I am using RHEL 8.5 with the following Libreswan
$ ipsec --version
Linux Libreswan 4.4 (netkey) on 4.18.0-348.12.2.el8_5.x86_64
For the VPN client, I am using the following:
Red Hat Enterprise Linux CoreOS release 4.8
$ uname -r
$ ipsec --version
Linux Libreswan 4.4 (netkey) on 4.18.0-305.10.2.el8_4.x86_64
Since CoreOS is immutable, I am using Libreswan via a privileged
My specific questions are related to how the left/rightsubnet(s) works.
1) Am I correct in my understanding that the rightsubnet (and rightsubnets)
on the VPN client is for policies to determine which layer 3 traffic on the
VPN client will be sent through the IPSec tunnel?
1a) If this assumption is correct, are there any relationships between
leftsubnet(s) (on the VPN server or client) and VPN client rightsubnet(s)?
I ask because sometimes I get TS_UNACCEPTABLE on the VPN client when
establishing the IPSec tunnel, and I cant really figure out what causes it,
but it seems to be due to some invalide combination of the left/right
2) What role does the leftsubnet (and leftsubnets) play in the VPN client
configuration? The leftsubnet was already specified on the server side, why
does it need to be repeated in the client side configuration? What if it is
different in the client configuration?
3) In the  document, I see that it sets the subnet to 0, like this:
"leftsubnet=0.0.0.0/0". What exactly does this mean? I may be mistaken, but
I thought I read in one of the documents that it means "all traffic". But,
based on my testing, it seems to mean "no traffic".
Here are the client/server configurations Im using:
# Not using DHCP for clients
# For now the client/server are in the same subnet, but that will change
brady.johnson at redhat.com
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Swan