0

Using the following ipsec.conf configuration:

conn %default
        ikelifetime=60m
        keylife=20m
        keyingtries=3
        rekeymargin=3m
        keyexchange=ikev2
        esp=aes-aes256-sha-modp1024,aes256-sha512-modp4096
        ike=aes-aes256-sha-modp1024,aes256-sha512-modp4096
        leftcert=servercert.pem    
        leftid=server.strongswan.org
        lefthostaccess=yes
        leftfirewall=yes

conn roadwarrior
        left=%any
        right=%any
        leftsubnet=0.0.0.0/0
        rightsourceip=%dhcp
        auto=add

When a client connects from behind the NAT (e.g. private IP range, for example 192.168.1.0/24) it's local routing (in the 192.xxx range) doesn't work anymore as it is forwarded via the tunnel (gateway has no idea about external private networks).

The question is - how to let all traffic go through the tunnel except for the client's own network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.