<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;"><div>Hi All,</div><div><br></div><div>While it's not really a libreswan issue I thought that someone here might be able to assist.</div><div><br></div><div>With a datacentre network of 10.10.10.0/20 and a libreswan ipsec allocated network of ( 10.200.200.16- 10.200.200.64) ie 10.200.200.0/24 I want traffic to allow traffic to be able to route between the networks. I don't want to use NAT and I would like to use the firewall. </div><div>The reason for not wanting NAT is that when services are consumed the source IP address is logged which is associated with an end user.</div><div><br></div><div>I can ping between the hosts, so routing appears to be correct.</div><div>Everything routes correctly when I stop firewalld. </div><div><br></div><div>I had thought that this would be pretty simple with something like the following</div><div><br></div><div>firewall-cmd --zone=work --add-rich-rule='rule family="ipv4" source address="10.200.200.0/24" destination address="10.10.10.0/20" protocol value="tcp" log level="warning" accept'</div><div><br></div><div>However the traffic was dropped still being dropped by the firewall.</div><div><br></div><div>I then throught that a direct rule might help.</div><div><br></div><div>Something like </div><div><br></div><div><pre>firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -i ens3 -o ens7 -p tcp --dport 53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT</pre></div><div><br></div><div>However that didn't work either. </div><div><br></div><div>Any advice on the best way to set this up would be appreciated.</div><div><br></div><div><br></div></body></html>