Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to use Openswan (version 2.6.37) to connect an IPsec VPN from my local network to a remote site. Everything works fine when I just want to connect to a single subnet on the remote site. However, the remote site also has an extra subnet that I want to access.

This is my configuration:

conn myConn

When I replace rightsubnet with rightsubnets, like so:


...then the connection is created successfully but only the last subnet in the list is available. Any attempts to ping anything on the subnet fails. If I swap the order of the subnets around then I can ping 172.16.1.X but can't ping anything on the other subnet. It's as if Openswan is only using the last subnet in the list to create a connection.

Am I doing something wrong here?

A little bit of extra information that I neglected to mention (although I'm not sure it's relevant): My Openswan client is behind a router using NAT and I have nat_traversal=yes in my ipsec.conf file.

share|improve this question
Do you use VLANs? I had almost exactly the same problem and the issue was a VLAN error – user30549 Jan 19 '13 at 2:32
Have you tried making two security associations, one for each subnet? – gimmesudo Jan 19 '13 at 11:10
@Tyke, no I'm not using VLANs. My OpenSwan client is behind a router using NAT though - I've updated the question to reflect that. – LSW Jan 23 '13 at 10:32
@gimmesudo: I tried duplicating my configuration above for a new connection (connection myConn2), with everything identical except for the rightsubnet. When I use ipsec auto --up myConn I can ping 172.168.1.X. When I try to bring up the second connection (ipsec auto --up myConn2), I can ping 192.168.3.X but the first connection dies completely. – LSW Jan 23 '13 at 11:16
For conneting as a client on many IPSec routers (like Cisco), You'll simplier to use vpnc ! – F. Hauri Mar 2 '13 at 17:13

Looks like the usual separator for the multiple subnets is a comma, but at least openswan-2.6.32 works with spaces too.

Interesting information should be logged to /var/log/secure which could contain clues why it isn't working. Also post the output of ip x s sh and ip x p sh.

share|improve this answer

Make conn section configuration for each subnets on BOTH endpoints of the tunnel. Only one of them (the first started) will start a SA negotiation, the second (or more) will only make a new SPD of the further subnets.

share|improve this answer
Unfortunately I can't do this as the remote endpoint is a third-party FortiGate router (not running OpenSwan). I'm starting to wonder if the problem may be related to the router not being able to cope with multiple tunnels between the same endpoints. – LSW Feb 4 '13 at 14:29

If you use rightsubnets you have to use leftsubnets as well, not leftsubnet. Even if there's only one subnet on that side. The ipsec.conf man page doesn't do a great job of explaining this, but it's there.

I had the simmilar problems for months and just found the answer here: http://serverfault.com/questions/571352/openswan-multiple-subnets-routing-issue

share|improve this answer

It looks like there's a bug in OpenSwan where the subnets list needs an extra comma at the end to work correctly. Try:


Note the extra comma at the end.

share|improve this answer

It should be like this


Use a comma (,) and not a space to separate entries.

share|improve this answer
That seems to be what the answer from two years ago is saying. – G-Man May 15 '15 at 8:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.