<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Darren,<div><br></div><div>Two things that may be affecting your tunnel traffic.</div><div><br></div><div>1) Is IP packet forwarding turned on? </div><div><br></div><div><div>/sbin/sysctl net.ipv4.ip_forward</div></div><div>Make sure it shows 1</div><div><br></div><div>if not, run </div><div><div>/sbin/sysctl -w net.ipv4.ip_forward=1</div></div><div><br></div><div>and if that fixes the problem, make it persistent in /etc/sysctl</div><div><br></div><div>2) even if your VPS is forwarding the packets out the interface, if the source IP they are coming from is not something that DO knows to route back to your VPS you will need to Nat Masquerade the VPN traffic to the ip address on your VPS with iptables so that its something DO can route back to you.<div><br></div><div>tcpdump is your friend</div><div><br></div><div><br></div><div>Mike</div><div><br><div><div>On Dec 5, 2014, at 12:31 AM, Darren Share <<a href="mailto:darren.share@chronos.co.uk">darren.share@chronos.co.uk</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div leftmargin="1" rightmargin="1" topmargin="1" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><font size="2" face="Segoe UI">Thanks Paul, but I am using Digitial Ocean and the VPS has a public, static IP address on eth0.<br><br></font><div style="font-size: x-small; font-family: 'Segoe UI';"><div>-----------------------<span class="Apple-converted-space"> </span><b>Original Message</b><span class="Apple-converted-space"> </span>-----------------------</div><div> </div><div><b>From:</b> Paul Wouters ??<<a href="mailto:paul@nohats.ca">paul@nohats.ca</a>></div><div><b>To:</b> Darren Share<span class="Apple-converted-space"> </span><a href="mailto:darren.share@chronos.co.uk"><font color="#0000ff"><darren.share@chronos.co.uk></font></a></div><div><b>Cc:</b> <a href="mailto:swan@lists.libreswan.org"><font color="#0000ff">"swan@lists.libreswan.org"</font></a><span class="Apple-converted-space"> </span><a href="mailto:swan@lists.libreswan.org"><font color="#0000ff"><swan@lists.libreswan.org></font></a></div><div><b>Date:</b> Thu, 4 Dec 2014 23:11:33 -0500 (EST)</div><div><b>Subject: <u>Re: [Swan] Can't route back down ipsec tunnel from VPS</u></b></div><div> </div></div><font size="2" face="Segoe UI">On Thu, 4 Dec 2014, Darren Share wrote:<br><br>> Can you elaborate? The only use of "elastic IP" I'm aware of is regarding AWS, is that what you mean? I am using a VPS on DigitalOcean for this project if that helps.<br><br>Normally in AWS, you get a "static" elastic IP assigned. This public IP<br>is NAT'ed to your virtual machine. But your virtual machine only has<br>RFC1918 addresses configured on it. Because the AWS NAT router will<br>NAT it to your static elastic IP.<br><br>Now when you do a VPN in tunnel mode, the packet you are sending<br>needs to be "from" your public IP. But you don't have it configured<br>on your virtual machine itself. So you cannot create a source packet<br>with that IP. The usual solution is to configure it as an alias on<br>the loopback or ethernet interface.<br><br>See: <a href="https://libreswan.org/wiki/Interoperability#Amazon_EC2"><font color="#0000ff">https://libreswan.org/wiki/Interoperability#Amazon_EC2</font></a><br><br>Paul<br><br>______________________________________________________________________<br>This email has been scanned by the Symantec Email Security.cloud service.<br>For more information please visit <a href="http://www.symanteccloud.com/"><font color="#0000ff">http://www.symanteccloud.com</font></a><br>______________________________________________________________________<br></font><br clear="both">______________________________________________________________________<br>This email has been scanned by the Symantec Email Security.cloud service.<br>For more information please visit<span class="Apple-converted-space"> </span><a href="http://www.symanteccloud.com/">http://www.symanteccloud.com</a><br>______________________________________________________________________<br>_______________________________________________<br>Swan mailing list<br><a href="mailto:Swan@lists.libreswan.org">Swan@lists.libreswan.org</a><br><a href="https://lists.libreswan.org/mailman/listinfo/swan">https://lists.libreswan.org/mailman/listinfo/swan</a><br></div></blockquote></div><br></div></div></body></html>