I'm trying to solve a weird problem in routing. I've got my router set up (Turris, running customized OpenWRT), with Strongswan tunneling ipv6 connection. This works fine for the router itself, as it's ipv6 connectivity is working fine (via the tunnel, my provider does not offer native ipv6).

TL;DR: Routes are not chosen as I'd expect them, as the most generic one, ::/0 seems to be always preferred, although a /64 match is available.

But when I tried to extend this to my home network, I stumbled on a problem, and I'm unable to find a cause.

Although the ipsec works, I get an ipsec0 interface, and these routes:

Kernel IPv6 routing table
Destination                                 Next Hop                                Flags Metric Ref    Use Iface
::/0                                        ::                                      U     1024   0        2 ipsec0  
2a01:490:19:42::/64                         ::                                      U     1024   0        0 br-lan  

Here, 2a01:490:19:42::/64 is a rank that I dedicated for my local network, 2a01:490:19:42::1 is IP address of the router on that network.

Here are some observations:

1) When I ping 2a01:490:19:42::1 from a computer on my local network, the router responds, but sends the response into the ipsec0 interface. I have no idea why. Should not the more specific prefix, 2a01:490:19:42::/64, on br-lan be favored? It seems to correctly choose the source IP address 2a01:490:19:42::1.

2) The same things happens when I try to send a packet from my local network to some other site, say ping6 stackexchange.com. The packets get on the router, gets forwarded, server sends response, router gets it... and sends it back to the ipsec0 interface.

3) There are no xfrm policies. ip xfrm pol returns nothing. But Strongswan is running and I was under the impression, that Strongswan always creates some policies. In my previous setup, I had to add some to enable passing packets into the tunnel, but I'm a bit confused about the policy list being empty.

Allright, so what's wrong? Why is the most generic route, ::/0, preferred for my ipv6 packets?



The problem was, that ipsec inserted it's rules into different routing table (table 220) and created a policy to direct traffic there:

root@turris:/etc/config# ip rule list
0:  from all lookup local 
220:    from all lookup 220 
32766:  from all lookup main 
32767:  from all lookup default 

But the table 220 only contained default route into the ipsec tunnel, and not the local network:

root@turris:/etc/config# ip -6 r show table 220
default dev ipsec0  proto static  src 2a01:490:19:42::1  metric 1024 

Which inevitably caused all the packets to be forwarded into the tunnel.

Network for the router itself worked only because they were accepted and not routed.

I fixed this by instructing strongswan to insert routing rules into the main table instead, by setting charon.routing_table = 254 (the id of main, as seen in /etc/iproute2/rt_tables). My strongswan.conf now looks like this:

charon {
#       load_modular = yes
        plugins {
                include strongswan.d/charon/*.conf
        routing_table = 254 # main

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.