Description of problem: The IKE replies have their source IP set according to the connection interface, even if the gateway address is bound to another interface. Version-Release number of selected component (if applicable): strongswan-5.3.2-2.fc23.x86_64 How reproducible: Always Steps to Reproduce: 1. Set an IP address (x.x.x.x) on eth0 for real traffic. 2. Set a gateway IP address (y.y.y.y) on eth1, configure and add a tunnel using it. 3. On an external machine (with ip z.z.z.z), set a route to gateway IP address via the eth0 IP address and configure the other end of the tunnel. 4. Monitor the traffic with wireshark. 5. Start the tunnel from the external machine. Actual results: The initial request: z.z.z.z --> y.y.y.y The strongswan reply: x.x.x.x --> z.z.z.z The reply source address puzzles the initiator :-( Expected results: The strongswan reply: y.y.y.y --> z.z.z.z Additional info: This seems to be https://wiki.strongswan.org/issues/1171. The upstream commit https://wiki.strongswan.org/projects/strongswan/repository/revisions/47e113a63905305fdb7eee8304a5eb1adcb216d4/diff?format=diff fixes this issue for me.
Strongswan has recently been updated to 5.4.0 in Fedora.