Issue #3106
passthrough-children not in table 220
Status:
Closed
Priority:
Normal
Assignee:
-
Category:
kernel-interface
Affected version:
5.5.1
Resolution:
Fixed
Description
If have some children configured for passthrough:
connections { passthrough-lan { remote_addrs = 127.0.0.1 children { pt-192-168-1-0 { start_action = trap mode = pass local_ts = 192.168.1.0/24 remote_ts = 192.168.1.0/24 } pt-192-168-179-0 { start_action = trap mode = pass local_ts = 192.168.179.0/24 remote_ts = 192.168.179.0/24 } } } }
Unfortunately the interfaces for these connections come up after strongSwan gets started at reboot. For example:
Jul 7 12:49:11 09[CFG] added vici connection: passthrough-lan Jul 7 12:49:11 09[CFG] installing 'pt-192-168-1-0' Jul 7 12:49:11 09[CFG] installing 'pt-192-168-179-0' Jul 7 12:49:11 06[CFG] added vici connection: ... ... Jul 7 12:49:13 15[KNL] 192.168.1.136 appeared on vmbrLAN0 ... Jul 7 12:49:14 06[KNL] 192.168.179.25 appeared on wlp4s0
For this reason strongSwan does not know an interface for the routes and can't install them:
# ip route show table 220 default via 192.168.1.1 dev vmbrLAN0 proto static src 172.20.1.1
"swanctl --load-conns" does not help. Only if I change the connection name and the children names and do a "swanctl --load-conns" the connections get deleted and installed again:
# ip route show table 220 default via 192.168.1.1 dev vmbrLAN0 proto static src 172.20.1.1 192.168.1.0/24 dev vmbrLAN0 proto static src 192.168.1.136 192.168.179.0/24 dev wlp4s0 proto static src 192.168.179.25
Is there a more easy way to do this? Ideally something I could start automatically when an interface comes up?
I know about bypass-lan. Unfortunately I am stuck with Debian 9 at the moment, so strongSwan 5.5.1.
Related issues
History
#1 Updated by Tobias Brunner about 6 years ago
- Related to Issue #2197: charon does not add routes for passthrough policies when local_addrs is not set. added
#2 Updated by Noel Kuntze about 6 years ago
Could be solved on Linux with throw
routes (#3118).
#3 Updated by Tobias Brunner almost 5 years ago
- Related to Feature #3118: Use throw type routes instead of copying routes into table 220 for passthrough policies added
#4 Updated by Tobias Brunner almost 5 years ago
- Category set to kernel-interface
- Status changed from New to Closed
- Resolution set to Fixed