Openswan doesn't honor 'left=' parameter on host with multipe ip's
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| openswan (Ubuntu) |
New
|
Undecided
|
Unassigned | ||
Bug Description
Ubuntu release: 12.04.1
Openswan version: 2.6.37-1
It appears that the openswan version in ubuntu 12.04 does not honor the 'left=' parameter when used on a host with multiple external IP addresses on one 'public' interface. For example: I have a host with 2 IP's bound to eth0:
2: eth0: <BROADCAST,
link/ether 2c:76:8a:53:63:d0 brd ff:ff:ff:ff:ff:ff
inet 11.22.33.44/24 brd 82.94.228.231 scope global eth0
inet 11.22.33.46/24 scope global secondary eth0
I want to use the 11.22.33.46 address as the sending IP for this connection. However, openswan always picks 11.22.33.44 as the sending address, which fails to connect because that address isn't know by the peer. (IP's are 'fake', obviously)
Installing an older version of the package (the one from 10.04 LTS), fixes the problem. So version 2.6.23+
Example config:
conn testme
auth=esp
authby=secret
auto=start
disablearri
esp=aes128-sha1
ike=
ikelifetime=24h
keyexchange=ike
keylife=8h
left=
leftsourcei
leftsubnet=
pfs=no
rekey=yes
right=
rightsubnet
type=tunnel
| Simon Déziel (sdeziel) wrote | #1 |
| Ronald Moesbergen (intercommit) wrote | #2 |
Ronald, I think that if you add a route to get to right= using the source IP 11.22.33.46 it should work.
Here's an example:
$ ip ro get 99.88.77.66 # checking the source IP used to get to right=
99.88.77.66 via 172.24.27.1 dev wlan0 src 11.22.33.46
cache
You see that by default it uses the "main" IP on wlan0. Now let's add the other IP
$ sudo ip addr add 11.22.33.46/24 dev wlan0 # adding this IP alias
And add a route to right= using that new IP as the source
$ sudo ip ro add 99.88.77.66 via 172.24.27.1 src 11.22.33.46 # 172.24.27.1 is my default GW
And confirm all worked:
$ ip ro get 99.88.77.66
99.88.77.66 via 172.24.27.1 dev wlan0 src 11.22.33.46
cache