I established a L2TP/IPsec client connection on the gateway, and I'm trying to redirect my host on LAN to use this connection when accessing the Internet.
Here is the network topology.
This is my gateway's routing table:
$ ip route default dev pppoe-wan scope link 22.214.171.124 dev ppp1 proto kernel scope link src 192.168.179.11 126.96.36.199 dev pppoe-wan scope link 188.8.131.52 dev pppoe-wan proto kernel scope link src 184.108.40.206 192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1 $ ip rule 1: from all lookup local 10: from 192.168.1.2 lookup 10 32766: from all lookup main 32767: from all lookup default $ ip route show table 10 default dev ppp1 scope link 220.127.116.11 via 18.104.22.168 dev pppoe-wan 192.168.1.0/24 via 192.168.1.1 dev br-lan
The problem is that after I add the default route to table 10, my host can no longer access the Internet. Using tcpdump to listen on the interface ppp1 (
tcpdump -i ppp1) reveals that no packets flow through it.
I tried masquerade the ppp1 interface with:
$ iptables -t nat -A POSTROUTING -o ppp1 -j MASQUERADE
It didn't help, still no packets flowed through the interface. Also the kernel is allowed to redirect packets:
$ cat /proc/sys/net/ipv4/ip_forward 1
But if I use the interface directly on the gateway, it works just fine:
$ curl --interface ppp1 google.com <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.google.com.hk/?gfe_rd=cr&ei=suORVbLfOKXC8Af3noGwDA">here</A>. </BODY></HTML>
So looks like the gateway's linux kernel somehow dropped the packets from my host. But none of the interface has reverse path filtering enabled:
$ cat /proc/sys/net/ipv4/conf/ppp1/rp_filter 0 $ cat /proc/sys/net/ipv4/conf/pppoe-wan/rp_filter 0
So I'm at my wits' end. Why the host traffic never goes through ppp1? How could I redirect my host to the L2TP/IPsec client connection?
I used the same configuration for a PPTP client, and it worked just fine. Somehow it doesn't work for a L2TP/IPsec client.
The gateway is an OpenWrt box (Chaos Calmer 15.05-rc2, kernel 3.18.14). I use strongSwan(5.3.0) + xl2tpd(1.3.6) to set up the L2TP/IPsec client.
This is configuration for strongSwan:
conn example auto=start keyexchange=ikev1 type=transport left=%defaultroute leftauth=psk right=server.example.com rightid=%any rightauth=psk dpdaction=restart dpddelay=10s dpdtimeout=60s
and configuration for xl2tpd
[lac example] lns = server.example.com length bit = yes redial = yes max redials = 5 pppoptfile = /etc/ppp/options.xl2tpd
and configuration for ppp
noauth mru 1452 mtu 1452 nomppe ipcp-accept-remote ipcp-accept-local nopcomp noaccomp lcp-echo-interval 10 lcp-echo-failure 5
The host is a Mac (Yosemite 10.10.3).
Thanks in advance for the help.
P.S. Only the gateway's Internet IP and server's Internet IP have been replaced with fake IPs, all other IPs are the real used ones.