Red Hat Bugzilla – Bug 1311627
Gateway IP address not properly set in IKE replies
Last modified: 2016-07-13 10:26:59 EDT
Description of problem:
The IKE replies have their source IP set according to the connection interface, even if the gateway address is bound to another interface.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Set an IP address (x.x.x.x) on eth0 for real traffic.
2. Set a gateway IP address (y.y.y.y) on eth1, configure and add a tunnel using it.
3. On an external machine (with ip z.z.z.z), set a route to gateway IP address via the eth0 IP address and configure the other end of the tunnel.
4. Monitor the traffic with wireshark.
5. Start the tunnel from the external machine.
The initial request: z.z.z.z --> y.y.y.y
The strongswan reply: x.x.x.x --> z.z.z.z
The reply source address puzzles the initiator :-(
The strongswan reply: y.y.y.y --> z.z.z.z
This seems to be https://wiki.strongswan.org/issues/1171. The upstream commit https://wiki.strongswan.org/projects/strongswan/repository/revisions/47e113a63905305fdb7eee8304a5eb1adcb216d4/diff?format=diff fixes this issue for me.
Strongswan has recently been updated to 5.4.0 in Fedora.