<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p><br>
</p>
<div>Hi Paul / all:</div>
<div>Paul: Thanks for your response at first !</div>
<div><br>
1. <br>
(1).<br>
In previous email, you mentioned "mark=-1/0xffffffff" and "Instead of NAT". Are you saying, I shall run "iptables -t mangle" on private client???</div>
<div>But it does NOT take effect after I run "iptables -t mangle -A POSTROUTING -p esp -m policy --dir out -s 192.168.161.44 -d 10.0.146.196 -j MARK --set-mark 16344" on private client.
</div>
<div>After I run above command, "ip xfrm state" still shows reqid as "16397" on private client.
</div>
<div>Only after I configure "reqid" in ipsecXX.conf on private machine, "ip xfrm state" shows the value which I configured.
<br>
(By the way, on public server side, "reqid" (output of "ip xfrm state") is changed after I configure "reqid" in IPSecXXX.conf also.)</div>
<div>(2).<br>
Can you please tell me <b><u>where </u></b>to run "iptables -t mangle --set-mask"?
<b><u>On private client or public server</u></b>? </div>
<div><br>
2.<br>
http://swan.libreswan.narkive.com/Rxj6YbXK/cannot-install-eroute-when-second-client-connected-from-behind-the-same-nat writes "still need some iptables rules based on the reqid to ensure these two flows" .
</div>
<div><br>
https://libreswan.org/wiki/SAref_code writes "When a packet is sent out, it will pass through iptables. Libreswan maintains an IPSEC chain in the mangle table. This allows it to tag packets using xmark".
</div>
<div><br>
</div>
<div>From above links, looks like "iptables -t mangle" is used for some work. but https://linux.die.net/man/8/iptables writes "--set-mark mark " "It can for example be used in conjunction with iproute2"</div>
<div><br>
</div>
<div>Can you please <b><u>give some clue(links) about how does "--set-mark mark " work with IPsec(xfrm</u></b>)?
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks </div>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font color="#000000" face="Calibri, sans-serif" style="font-size:11pt"><b>From:</b> Paul Wouters <paul@nohats.ca><br>
<b>Sent:</b> Thursday, October 26, 2017 18:53<br>
<b>To:</b> Hao Chen<br>
<b>Cc:</b> swan@lists.libreswan.org<br>
<b>Subject:</b> Re: [Swan] Does libreswan v3.20 support multiple clients behind NAT to communicate with public server simultaneously?</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On Thu, 26 Oct 2017, Hao Chen wrote:<br>
<br>
> at first, without configuring "overlapid=yes", pluto.log report "cannot install eroute, it is in use for XXXX" for the 2nd startup client. <br>
> <br>
> Only 1st client can communicate with public sever in all time.<br>
> No matter how many times I restart IPsec on 2nd machine, pluto.log on public server report "cannot install eroute, it is in use for XXXX".<br>
> <br>
> <br>
> 2.<br>
> Get some clue from <a id="LPlnk188331" href="http://swan.libreswan.narkive.com/Rxj6YbXK/cannot-install-eroute-when-second-client-connected-from-behind-the-same-nat" previewremoved="true">
http://swan.libreswan.narkive.com/Rxj6YbXK/cannot-install-eroute-when-second-client-connected-from-behind-the-same-nat</a>
<div id="LPBorder_GT_15093816478880.17943854259919378" style="width: 100%; text-indent: 0px; overflow: auto; margin-bottom: 20px;">
<table id="LPContainer_15093816478860.27687341315289804" role="presentation" style="width: 90%; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top-color: rgb(200, 200, 200); border-bottom-color: rgb(200, 200, 200); border-top-width: 1px; border-bottom-width: 1px; border-top-style: dotted; border-bottom-style: dotted; position: relative; background-color: rgb(255, 255, 255);" cellspacing="0">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="TextCell_15093816478870.46574296071303345" style="padding: 0px; vertical-align: top; display: table-cell; position: relative;" colspan="2">
<div id="LPRemovePreviewContainer_15093816478870.7141413522890203"></div>
<div id="LPTitle_15093816478870.3728653677931708" style="top: 0px; color: rgb(0, 120, 215); line-height: 21px; font-family: "wf_segoe-ui_light","Segoe UI Light","Segoe WP Light","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size: 21px; font-weight: 400;">
<a id="LPUrlAnchor_15093816478870.5235490824996054" style="text-decoration: none;" href="http://swan.libreswan.narkive.com/Rxj6YbXK/cannot-install-eroute-when-second-client-connected-from-behind-the-same-nat" target="_blank">"cannot install eroute" when second
client connected from ...</a></div>
<div id="LPMetadata_15093816478880.5655738373388426" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); line-height: 14px; font-family: "wf_segoe-ui_normal","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size: 14px; font-weight: 400;">
swan.libreswan.narkive.com</div>
<div id="LPDescription_15093816478880.025574693488586097" style="color: rgb(102, 102, 102); line-height: 20px; overflow: hidden; font-family: "wf_segoe-ui_normal","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size: 14px; font-weight: 400; display: block; max-height: 100px;">
"cannot install eroute" when second client connected from behind the same NAT</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
> I configured "overlapid=yes" on server side. And added 2 IPTables rule on NAT-GW:<br>
<br>
Instead of NAT, use:<br>
<br>
mark=-1/0xffffffff<br>
<br>
This should install the policies with a unique mark for each connection.<br>
When used with overlapip=yes, it should install multiple policies to<br>
the same IPs with the mark causing the rules to be different and not<br>
clash.<br>
<br>
The only limitation is that traffic must be initiated from the client,<br>
to get the initial MARK. If multiple clients clash, then you cannot<br>
from the server connect to the one IP and expect to reach one or the<br>
other. But in the typical use of IPsec Transport Mode with L2TP, it<br>
is always the client generating the traffic so this solution works.<br>
<br>
Paul<br>
</div>
</span></font></div>
</div>
</body>
</html>