Strongswan IPSEC tunnel UP , but can not ping from node to node

[mpa]

@changchichung

routing table

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.11.253  0.0.0.0         UG    0      0        0 eth0.2
192.168.11.0    *               255.255.255.0   U     0      0        0 eth0.2
192.168.15.0    *               255.255.255.0   U     0      0        0 br-lan

If you want to see the route for IPsec traffic:

ip route list table 220

However, since ping works now, I believe the routes are OK.

@changchichung

is there shoulld be an interface named ipsec after tunnel up ?

No, this IPsec configuration does not create a new network interface.

@changchichung

when I disable firewall for temporary on both node , then I can ping from lan to lan .

so it should related to firewall settings .

Try this:

IPsec site-to-site tunnel

The wan interface is set up with masquerading (source NAT) by default. This affects both plaintext traffic to the internet and VPN traffic towards the remote LAN. When IPsec decides whether to pass through or to tunnel a packet, it compares the packet's source IP, destination IP, and optionally other header fields with its own configured policy. Masquerading changes the source IP, which causes a mismatch in this comparison, and the packet is not sent through the VPN. You have to make sure the …