Strongswan tunnel is up but can't ping remote

Installing and Using OpenWrt
#1

image
image1067×316 134 KB

Hi, openwrt
I use openwrt 21.0.3 strongswan connect to remote with side to side, the tunnel is up ,but local can't ping remote,can anyone help me? Thanks.

#2

Need the output of these commands. It's probably that your iptables nat changes the ips of packet and causes the packets to be missed from the xfrm policies.

ipsec statusall
ip rule
ip -4 ro sh table all
ip xfrm policy
iptables-save -t nat
#3

企业微信截图_53e4d4b3-8afc-47d7-a384-84eefca40f02

#4

企业微信截图_d5b898c5-4774-4ad6-afcd-f51ba261b2a8

#5

iptable
iptable1159×889 101 KB

#6

tableall
tableall1159×889 161 KB

#7

xfrm
xfrm1159×889 102 KB

#8

root@OpenWrt:~# ip route show table 220

10.100.162.0/24 via 10.0.10.254 dev eth0.2 proto static src 192.168.49.1

seems normal？

#9

Pick one of these and your problem should be resolved.
Do the same on remote end if it's behind NAT just reverse the src/dst.
To understand why this is needed look at the packet flow

iptables -t nat -I POSTROUTING          -s 192.168.49/24 -d 10.100.162/24 -j ACCEPT
iptables -t nat -I postrouting_rule     -s 192.168.49/24 -d 10.100.162/24 -j ACCEPT
iptables -t nat -I postrouting_wan_rule -s 192.168.49/24 -d 10.100.162/24 -j ACCEPT
#10

It's works,Thanks for you help.

#11

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.