Project

General

Profile

Issue #3106

passthrough-children not in table 220

Added by Robert Dahlem 16 days ago. Updated 12 days ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
-
Affected version:
5.5.1
Resolution:

Description

If have some children configured for passthrough:

connections {
        passthrough-lan {
                remote_addrs = 127.0.0.1
                children {
                        pt-192-168-1-0 {
                                start_action = trap
                                mode = pass
                                local_ts = 192.168.1.0/24
                                remote_ts = 192.168.1.0/24
                        }
                        pt-192-168-179-0 {
                                start_action = trap
                                mode = pass
                                local_ts = 192.168.179.0/24
                                remote_ts = 192.168.179.0/24
                        }
                }
        }
}

Unfortunately the interfaces for these connections come up after strongSwan gets started at reboot. For example:

Jul  7 12:49:11 09[CFG] added vici connection: passthrough-lan
Jul  7 12:49:11 09[CFG] installing 'pt-192-168-1-0'
Jul  7 12:49:11 09[CFG] installing 'pt-192-168-179-0'
Jul  7 12:49:11 06[CFG] added vici connection: ...
...
Jul  7 12:49:13 15[KNL] 192.168.1.136 appeared on vmbrLAN0
...
Jul  7 12:49:14 06[KNL] 192.168.179.25 appeared on wlp4s0

For this reason strongSwan does not know an interface for the routes and can't install them:
# ip route show table 220
default via 192.168.1.1 dev vmbrLAN0 proto static src 172.20.1.1

"swanctl --load-conns" does not help. Only if I change the connection name and the children names and do a "swanctl --load-conns" the connections get deleted and installed again:
# ip route show table 220
default via 192.168.1.1 dev vmbrLAN0 proto static src 172.20.1.1
192.168.1.0/24 dev vmbrLAN0 proto static src 192.168.1.136
192.168.179.0/24 dev wlp4s0 proto static src 192.168.179.25

Is there a more easy way to do this? Ideally something I could start automatically when an interface comes up?
I know about bypass-lan. Unfortunately I am stuck with Debian 9 at the moment, so strongSwan 5.5.1.


Related issues

Related to Issue #2197: charon does not add routes for passthrough policies when local_addrs is not set.Closed

History

#1 Updated by Tobias Brunner 15 days ago

  • Related to Issue #2197: charon does not add routes for passthrough policies when local_addrs is not set. added

#2 Updated by Noel Kuntze 12 days ago

Could be solved on Linux with throw routes (#3118).

Also available in: Atom PDF