1

I'm trying to setting a VPN on Linux Mint 19.2.

I'm using the network-manager-strongswan so I added this file named VPN under /etc/NetworkManager/system-connections/

[connection]
id=VPN
uuid=be1d4fd1-bbaa-4aa9-9fdc-e293bf16fe67
type=vpn
autoconnect=false
permissions=
timestamp=1582680217

[vpn]
address=vpn********.it
certificate=
encap=yes
ipcomp=no
method=eap
password-flags=0
proposal=no
user=user
virtual=yes
service-type=org.freedesktop.NetworkManager.strongswan

[vpn-secrets]
password=password

[ipv4]
dns-search=
ignore-auto-dns=true
ignore-auto-routes=true
method=auto

[ipv6]
addr-gen-mode=stable-privacy
dns-search=
ip6-privacy=0
method=ignore

The connection is fine, I can access using ssh on the private network. The big issue is that after the connection I can't surf the internet, connecting to the vpn lock all other addresses.
I added the ignore-auto-routes flag in the config so why my connection is locked?


ip a output*

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:3c:de:1b brd ff:ff:ff:ff:ff:ff
    inet yy.16.209.132/24 brd yy.16.209.255 scope global dynamic noprefixroute ens33
       valid_lft 1656sec preferred_lft 1656sec
    inet yy.26.199.18/32 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::216e:bcc0:3b4f:44b2/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

route -n output

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         yy.16.209.2    0.0.0.0         UG    20100  0        0 ens33
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 ens33
yy.16.209.0    0.0.0.0         255.255.255.0   U     100    0        0 ens33
yy.26.199.18   0.0.0.0         255.255.255.255 UH    50     0        0 ens33
yy.26.199.18   0.0.0.0         255.255.255.255 UH    100    0        0 ens33

ip xfrm policy output NO VPN

src yy.16.209.0/24 dst yy.16.209.0/24 
    dir fwd priority 175423 
src yy.16.209.0/24 dst yy.16.209.0/24 
    dir in priority 175423 
src yy.16.209.0/24 dst yy.16.209.0/24 
    dir out priority 175423 
src 169.254.0.0/16 dst 169.254.0.0/16 
    dir fwd priority 183615 
src 169.254.0.0/16 dst 169.254.0.0/16 
    dir in priority 183615 
src 169.254.0.0/16 dst 169.254.0.0/16 
    dir out priority 183615 
src fe80::/64 dst fe80::/64 
    dir fwd priority 134463 
src fe80::/64 dst fe80::/64 
    dir in priority 134463 
src fe80::/64 dst fe80::/64 
    dir out priority 134463 
src yy.26.199.18/32 dst 0.0.0.0/0 
    dir out priority 383615 
    tmpl src yy.16.209.132 dst xx.xx.124.58
        proto esp spi 0xc57cfb3f reqid 7 mode tunnel
src 0.0.0.0/0 dst yy.26.199.18/32 
    dir fwd priority 383615 
    tmpl src xx.xx.124.58 dst yy.16.209.132
        proto esp reqid 7 mode tunnel
src 0.0.0.0/0 dst yy.26.199.18/32 
    dir in priority 383615 
    tmpl src xx.xx.124.58 dst yy.16.209.132
        proto esp reqid 7 mode tunnel
src ::1/128 dst ::1/128 
    dir fwd priority 68927 
src ::1/128 dst ::1/128 
    dir in priority 68927 
src ::1/128 dst ::1/128 
    dir out priority 68927 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src ::/0 dst ::/0 
    socket in priority 0 
src ::/0 dst ::/0 
    socket out priority 0 
src ::/0 dst ::/0 
    socket in priority 0 
src ::/0 dst ::/0 
    socket out priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src ::/0 dst ::/0 
    socket in priority 0 
src ::/0 dst ::/0 
    socket out priority 0 
src ::/0 dst ::/0 
    socket in priority 0 
src ::/0 dst ::/0 
    socket out priority 0

ip xfrm policy output UNDER VPN

src yy.26.199.18/32 dst 0.0.0.0/0 
    dir out priority 383615 
    tmpl src yy.16.209.132 dst xx.xx.124.58
        proto esp spi 0xc787ea42 reqid 2 mode tunnel
src 0.0.0.0/0 dst yy.26.199.18/32 
    dir fwd priority 383615 
    tmpl src xx.xx.124.58 dst yy.16.209.132
        proto esp reqid 2 mode tunnel
src 0.0.0.0/0 dst yy.26.199.18/32 
    dir in priority 383615 
    tmpl src xx.xx.124.58 dst yy.16.209.132
        proto esp reqid 2 mode tunnel
src fe80::/64 dst fe80::/64 
    dir fwd priority 134463 
src fe80::/64 dst fe80::/64 
    dir in priority 134463 
src fe80::/64 dst fe80::/64 
    dir out priority 134463 
src ::1/128 dst ::1/128 
    dir fwd priority 68927 
src ::1/128 dst ::1/128 
    dir in priority 68927 
src ::1/128 dst ::1/128 
    dir out priority 68927 
src yy.16.209.0/24 dst yy.16.209.0/24 
    dir fwd priority 175423 
src yy.16.209.0/24 dst yy.16.209.0/24 
    dir in priority 175423 
src yy.16.209.0/24 dst yy.16.209.0/24 
    dir out priority 175423 
src 169.254.0.0/16 dst 169.254.0.0/16 
    dir fwd priority 183615 
src 169.254.0.0/16 dst 169.254.0.0/16 
    dir in priority 183615 
src 169.254.0.0/16 dst 169.254.0.0/16 
    dir out priority 183615 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src ::/0 dst ::/0 
    socket in priority 0 
src ::/0 dst ::/0 
    socket out priority 0 
src ::/0 dst ::/0 
    socket in priority 0 
src ::/0 dst ::/0 
    socket out priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket in priority 0 
src 0.0.0.0/0 dst 0.0.0.0/0 
    socket out priority 0 
src ::/0 dst ::/0 
    socket in priority 0 
src ::/0 dst ::/0 
    socket out priority 0 
src ::/0 dst ::/0 
    socket in priority 0 
src ::/0 dst ::/0 
    socket out priority 0

Diffing the outputs I can see this piece is added while the VPN is connected:

src yy.26.199.18/32 dst 0.0.0.0/0 
    dir out priority 383615 
    tmpl src yy.16.209.132 dst xx.xx.124.58
        proto esp spi 0xc787ea42 reqid 2 mode tunnel
src 0.0.0.0/0 dst yy.26.199.18/32 
    dir fwd priority 383615 
    tmpl src xx.xx.124.58 dst yy.16.209.132
        proto esp reqid 2 mode tunnel
src 0.0.0.0/0 dst yy.26.199.18/32 
    dir in priority 383615 
    tmpl src xx.xx.124.58 dst yy.16.209.132
        proto esp reqid 2 mode tunnel

I tried a lot of things but with no luck.

  • tried to increase the Metric for yy.26.199.18 to 1050 and 1100.
  • route del default && ip route add default via yy.26.199.18 dev ens33
  • Tried to delete the route entries yy.26.199.18 but nothing changes

and a lot of others stupid stuff.

So I want to use my connection for the "normal internet" while routing specific addresses through VPN.
It is possible?

1
+100

Strongswan uses policy routing, which are configured through xfrm policies:

  1. the dir out policy says what to do with packets from 172.26.199.18/32 to 0.0.0.0/0: they need to be encrypted and sent through the VPN tunnel.
  2. the dir in and dir fwd policies says what to do when an encrypted packet comes in. If, after decryption, a packet from 0.0.0.0/0 to 172.26.199.18/32 didn't come from the specified tunnel, it is dropped. Plaintext packets are not subject to this.

In order to restrict the usage of the VPN network you have three solutions:

  1. The networks that appear in these rules are negotiated between your IKE server and the remote one. The NetworkManager plugin always proposes a tunnel between your_ip/32 and 0.0.0.0/0. If the remote server proposes 0.0.0.0/0 and 10.0.0.0/8 the resulting connection will be: between your_ip/32 and 10.0.0.0/8. So you need to ask the administrator of the remote endpoint to properly configure his IKE daemon.
  2. You can renounce using NetworkManager for the VPN tunnel, install charon-systemd and create a simple configuration file (e.g. /etc/swanctl/conf.d/my_vpn.conf):

    connections {
        my_vpn {
            version = 2
            local_addrs=%any
            remote_addrs=vpn********.it
            local {
                auth = eap
                eap_id = your_username
            }
            remote {
                auth = pubkey
                id = server_name
            }
            children {
                my_tunnel {
                    #local_ts = dynamic
                    remote_ts = remote_network
                }
            }
        }
    }
    

    reload the daemon (systemctl reload strongswan-swanctl) and run:

    swanctl --initiate --ike my_vpn --child my_tunnel
    
  3. Add your own policies, with a priority value smaller than the automatically installed on, which will allow unencrypted traffic, e.g.:

    ip xfrm policy add src your_ip/32 dst 192.0.2.0/24 \
        dir out priority 1000
    ip xfrm policy add src 192.0.2.0/24 dst your_ip/32 \
        dir in priority 1000
    

    which will allow plaintext traffic to 192.0.2.0/24.

| improve this answer | |
  • I tried the latest of the solutions you proposed (it seems to be the simpler). But I can't make it works. Any help? – Roberto Manfreda Mar 23 at 11:57
  • The third solution requires you to add all prefixes that you don't want to route through the VPN, which can be a lot of rules. Can you update ip xfrm policy in your question? I would rank the first solution as the best: if you are connecting to your work network, your admin does not want you to browse the Internet from the VPN either. – Piotr P. Karwasz Mar 23 at 21:02
  • Ok it works really well. Sorry I misunderstood your answer. Anyway it is working now... and yes my admin is locking all except internal network. Switching between vpn and normal connection is a big pain. I'll make a script to add the main sites to the policies or something of more sophisticated then I will be ok. Thanks.I'll assign to you the reward, for now is locked your answers are too fast! – Roberto Manfreda Mar 24 at 2:02
  • I wrote a daemon that adds at runtime searched addresses to policies getting it from a tcpdump in background. I wrote it on a virtual machine and works really fine. I can surf the web without problems. To add policies I use ip xfrm policy add src 0.0.0.0/0 dst "$addr"/24 dir out priority 1000 and ip xfrm policy add src "$addr"/24 dst 0.0.0.0/0 dir in priority 1000... But when I install the daemon on the host it doesn't work! – Roberto Manfreda Mar 26 at 17:15
  • Saying the thruth if I run these 2 commands on the host the new policies doesn't work , they are added to xfrm but the addresses continue to pass through the VPN. I also tried to change 0.0.0.0/0 with my ip and with ip assigned by the VPN. No luck. Some hint? – Roberto Manfreda Mar 26 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.