<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html charset=us-ascii" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 11.00.9600.17420"></HEAD>
<BODY style="WORD-WRAP: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space" leftMargin=1 rightMargin=1 topMargin=1><FONT size=2 face="Segoe UI">
<DIV>Hi Michael,</DIV>
<DIV> </DIV>
<DIV>Yep, had both of those turned on already.</DIV>
<DIV> </DIV>
<DIV>With the help of a colleague we've managed to resolve both our problems today. For posterity and future seekers of the truth here are the answers:</DIV>
<DIV> </DIV>
<DIV>1. Not able to route back down the tunnel: Basically we removed the two lines leftprotoport=17/1701 and rightprotoport=17/%any. They were part of the default setup of the script we were using so I didn't give them much thought, but from previous discussions they're only relevant when using L2TP.</DIV>
<DIV> </DIV>
<DIV>2. Couldn't forward packets to the internet: Changed left=<local subnet> to left=0.0.0.0/0. The server is happily sending on packets to the 'net and returning them to the correct host at the other end of the VPN.</DIV>
<DIV> </DIV>
<DIV>Thanks all for the help.</DIV>
<DIV> </DIV>
<DIV>Darren.<BR></DIV></FONT>
<DIV style="FONT-SIZE: x-small; FONT-FAMILY: Segoe UI">
<DIV>----------------------- <B>Original Message</B> -----------------------</DIV>
<DIV> </DIV>
<DIV><B>From:</B> Michael Hicks <A href="mailto:nooneofconsequence@gmail.com"><FONT color=#0000ff><nooneofconsequence@gmail.com></FONT></A></DIV>
<DIV><B>To:</B> Darren Share <A href="mailto:darren.share@chronos.co.uk"><FONT color=#0000ff><darren.share@chronos.co.uk></FONT></A></DIV>
<DIV><B>Cc:</B> Paul Wouters ?? <A href="mailto:paul@nohats.ca"><FONT color=#0000ff><paul@nohats.ca>,</FONT></A> <A href="mailto:swan@lists.libreswan.org"><FONT color=#0000ff>"swan@lists.libreswan.org"</FONT></A> <A href="mailto:swan@lists.libreswan.org"><FONT color=#0000ff><swan@lists.libreswan.org></FONT></A></DIV>
<DIV><B>Date:</B> Fri, 5 Dec 2014 07:51:19 -0800</DIV>
<DIV><B>Subject: <U>Re: [Swan] Can't route back down ipsec tunnel from VPS</U></B></DIV>
<DIV> </DIV></DIV>Darren,
<DIV><BR></DIV>
<DIV>Two things that may be affecting your tunnel traffic.</DIV>
<DIV><BR></DIV>
<DIV>1) Is IP packet forwarding turned on? </DIV>
<DIV><BR></DIV>
<DIV>
<DIV>/sbin/sysctl net.ipv4.ip_forward</DIV></DIV>
<DIV>Make sure it shows 1</DIV>
<DIV><BR></DIV>
<DIV>if not, run </DIV>
<DIV>
<DIV>/sbin/sysctl -w net.ipv4.ip_forward=1</DIV></DIV>
<DIV><BR></DIV>
<DIV>and if that fixes the problem, make it persistent in /etc/sysctl</DIV>
<DIV><BR></DIV>
<DIV>2) even if your VPS is forwarding the packets out the interface, if the source IP they are coming from is not something that DO knows to route back to your VPS you will need to Nat Masquerade the VPN traffic to the ip address on your VPS with iptables so that its something DO can route back to you.
<DIV><BR></DIV>
<DIV>tcpdump is your friend</DIV>
<DIV><BR></DIV>
<DIV><BR></DIV>
<DIV>Mike</DIV>
<DIV><BR>
<DIV>
<DIV>On Dec 5, 2014, at 12:31 AM, Darren Share <<A href="mailto:darren.share@chronos.co.uk">darren.share@chronos.co.uk</A>> wrote:</DIV><BR class=Apple-interchange-newline>
<BLOCKQUOTE type="cite">
<DIV style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT: 12px Helvetica; LETTER-SPACING: normal; TEXT-INDENT: 0px; -webkit-text-stroke-width: 0px" topmargin="1" rightmargin="1" leftmargin="1"><FONT size=2 face="Segoe UI">Thanks Paul, but I am using Digitial Ocean and the VPS has a public, static IP address on eth0.<BR><BR></FONT>
<DIV style="FONT-SIZE: x-small; FONT-FAMILY: 'Segoe UI'">
<DIV>-----------------------<SPAN class=Apple-converted-space> </SPAN><B>Original Message</B><SPAN class=Apple-converted-space> </SPAN>-----------------------</DIV>
<DIV> </DIV>
<DIV><B>From:</B> Paul Wouters ??<<A href="mailto:paul@nohats.ca">paul@nohats.ca</A>></DIV>
<DIV><B>To:</B> Darren Share<SPAN class=Apple-converted-space> </SPAN><A href="mailto:darren.share@chronos.co.uk"><FONT color=#0000ff><darren.share@chronos.co.uk></FONT></A></DIV>
<DIV><B>Cc:</B> <A href="mailto:swan@lists.libreswan.org"><FONT color=#0000ff>"swan@lists.libreswan.org"</FONT></A><SPAN class=Apple-converted-space> </SPAN><A href="mailto:swan@lists.libreswan.org"><FONT color=#0000ff><swan@lists.libreswan.org></FONT></A></DIV>
<DIV><B>Date:</B> Thu, 4 Dec 2014 23:11:33 -0500 (EST)</DIV>
<DIV><B>Subject: <U>Re: [Swan] Can't route back down ipsec tunnel from VPS</U></B></DIV>
<DIV> </DIV></DIV><FONT size=2 face="Segoe UI">On Thu, 4 Dec 2014, Darren Share wrote:<BR><BR>> Can you elaborate? The only use of "elastic IP" I'm aware of is regarding AWS, is that what you mean? I am using a VPS on DigitalOcean for this project if that helps.<BR><BR>Normally in AWS, you get a "static" elastic IP assigned. This public IP<BR>is NAT'ed to your virtual machine. But your virtual machine only has<BR>RFC1918 addresses configured on it. Because the AWS NAT router will<BR>NAT it to your static elastic IP.<BR><BR>Now when you do a VPN in tunnel mode, the packet you are sending<BR>needs to be "from" your public IP. But you don't have it configured<BR>on your virtual machine itself. So you cannot create a source packet<BR>with that IP. The usual solution is to configure it as an alias on<BR>the loopback or ethernet interface.<BR><BR>
See: <A href="https://libreswan.org/wiki/Interoperability#Amazon_EC2"><FONT color=#0000ff>https://libreswan.org/wiki/Interoperability#Amazon_EC2</FONT></A><BR><BR>Paul<BR><BR>______________________________________________________________________<BR>This email has been scanned by the Symantec Email Security.cloud service.<BR>For more information please visit <A href="http://www.symanteccloud.com/"><FONT color=#0000ff>http://www.symanteccloud.com</FONT></A><BR>______________________________________________________________________<BR></FONT><BR clear=both>______________________________________________________________________<BR>This email has been scanned by the Symantec Email Security.cloud service.<BR>For more information please visit<SPAN class=Apple-converted-space> </SPAN><A href="http://www.symanteccloud.com/">http://www.symanteccloud.com</A><BR>
______________________________________________________________________<BR>_______________________________________________<BR>Swan mailing list<BR><A href="mailto:Swan@lists.libreswan.org">Swan@lists.libreswan.org</A><BR><A href="https://lists.libreswan.org/mailman/listinfo/swan">https://lists.libreswan.org/mailman/listinfo/swan</A><BR></DIV></BLOCKQUOTE></DIV><BR></DIV></DIV><br clear="both">
______________________________________________________________________<BR>
This email has been scanned by the Symantec Email Security.cloud service.<BR>
For more information please visit http://www.symanteccloud.com<BR>
______________________________________________________________________<BR>
</BODY></HTML>