From nobody Sat Oct 14 10:25:23 2023 X-Original-To: freebsd-net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4S6zzN2ptZz4xZtB for ; Sat, 14 Oct 2023 10:25:36 +0000 (UTC) (envelope-from vitspec@gmail.com) Received: from mail-ua1-x935.google.com (mail-ua1-x935.google.com [IPv6:2607:f8b0:4864:20::935]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1D4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4S6zzM558pz3F83 for ; Sat, 14 Oct 2023 10:25:35 +0000 (UTC) (envelope-from vitspec@gmail.com) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20230601 header.b=KrDxhrWu; spf=pass (mx1.freebsd.org: domain of vitspec@gmail.com designates 2607:f8b0:4864:20::935 as permitted sender) smtp.mailfrom=vitspec@gmail.com; dmarc=pass (policy=none) header.from=gmail.com Received: by mail-ua1-x935.google.com with SMTP id a1e0cc1a2514c-7b5fe8ab5f9so1196276241.3 for ; Sat, 14 Oct 2023 03:25:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1697279135; x=1697883935; darn=freebsd.org; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=onaJ0FD1dCDepnjmqRu6hfXsEMrcbtxp8uTfPyTCUuk=; b=KrDxhrWun4SL5PftbY92Iw1Dwyu3LJPJv+kHHk9Yale5m5310vh9dTfOPA9pOIaEi6 dn9TivF3BNuKbENRvPsFQiulAo36h1K0+i9pNMgneV0rKVBOp/akSf+h5Vuib9ExOzfS v85Q1yjqntJ3rCqcmFcC4keX98NQR6PH7QmprmPluH5FXV3WqnvKtWIhlLM6nshnlTqK ENfC0p6kbL03YmI4AZlswPya8e0qFmBDX5gt8CMoVdDBt6gENu1bLYFt47w66k6FQtKB KN5WWd6jGaTY6e00rtBdJmuVLfaQmtqgdwrpFXC0fA4PaBHFVPHsYcbQtk/hqN61sdQb Qm/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1697279135; x=1697883935; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=onaJ0FD1dCDepnjmqRu6hfXsEMrcbtxp8uTfPyTCUuk=; b=D/XYQa+5tsymr7lCbIMW4I9C6DcQCfFQqBUyFWg4cSXaCPBJctw3DTAmDX1NTArPjD bTsmzHiJIbD27HHvZaYpYLii+ggAfR9nkzdm4kaJ6d+CFEnWGTJxcXC7GKMuvo8GQQ8n sklb9hZNgvnk2CzOPc1zyvpiaXj0YvyuNTVPZxiBfKxz732+j+XMidwHnXb3hCO1fj9v 0OR8DoVjeBxkAwaFl/5uSxZGABfT7szhymT5FrRms9u1EgogqMdV2wBDSxEtYX6zewP8 kwYd4aYE9gmnT6ITXSABxrrPbkV9KWHJaXQev4iPMF9l5Oa2QzoDsgOBOSikBRHyju88 T1Lw== X-Gm-Message-State: AOJu0Yy375C3ajImqxqUhTUoB7KHcTWNz46yEY5BxZNbBv6B553jPww4 P9CAwKaf1OB7/UTPh6hzQeZIobIew5+QoT4kPdsXP2BgeIA= X-Google-Smtp-Source: AGHT+IFUCBWFafENrvomwKKrp6kgjom9aWZxuaUQS2pgsPLV+Jv0xT62AsF4d3ftAsvwX7jQbvF7SPiwmM+zh6tagrI= X-Received: by 2002:a05:6102:34f6:b0:455:c426:1b22 with SMTP id bi22-20020a05610234f600b00455c4261b22mr28532865vsb.16.1697279134567; Sat, 14 Oct 2023 03:25:34 -0700 (PDT) List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@freebsd.org MIME-Version: 1.0 From: Victor Gamov Date: Sat, 14 Oct 2023 13:25:23 +0300 Message-ID: Subject: Packet forwarding stooped when Strongswan install IPsec policy To: freebsd-net Content-Type: multipart/alternative; boundary="000000000000e6984d0607aa97c2" X-Spamd-Bar: -- X-Spamd-Result: default: False [-2.85 / 15.00]; HTTP_TO_IP(1.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-0.85)[-0.852]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20230601]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; FROM_HAS_DN(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FREEMAIL_FROM(0.00)[gmail.com]; RCPT_COUNT_ONE(0.00)[1]; PREVIOUSLY_DELIVERED(0.00)[freebsd-net@freebsd.org]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::935:from]; ARC_NA(0.00)[]; RCVD_TLS_LAST(0.00)[]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; DKIM_TRACE(0.00)[gmail.com:+]; TO_DN_ALL(0.00)[]; MID_RHS_MATCH_FROMTLD(0.00)[]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; RCVD_COUNT_ONE(0.00)[1]; MIME_TRACE(0.00)[0:+,1:+,2:~]; FROM_EQ_ENVFROM(0.00)[]; FREEMAIL_ENVFROM(0.00)[gmail.com]; MLMMJ_DEST(0.00)[freebsd-net@freebsd.org] X-Rspamd-Queue-Id: 4S6zzM558pz3F83 --000000000000e6984d0607aa97c2 Content-Type: text/plain; charset="UTF-8" Hi All I have FreeBSD 13.2-STABLE stable/13-n255939-b9da47180fd6 GENERIC amd64 machine with strongswan-5.9.11_2 installed by pkg. When routed ipsec is up all outgoing packets forwarded into ipsec-tunnel so networking is immediately fails. FreeBSD config: ===== net.fibs=4 net.inet.ip.forwarding=1 ===== ifconfig ipsec10121 ===== ipsec10121: flags=8050 metric 0 mtu 1400 description: PoP-12 tunnel inet 1.1.1.2 --> 2.2.2.2 inet 172.16.110.129 --> 172.16.110.130 netmask 0xfffffffc groups: ipsec reqid: 10121 nd6 options=29 ===== strongswan etc/ipsec.conf: ===== conn pop4-to-pop12-routed # also = tmpl_route_based left = 1.1.1.2 right = 2.2.2.2 leftsubnet = 0.0.0.0/0 rightsubnet = 0.0.0.0/0 reqid = 10121 type = tunnel authby = psk keyexchange = ikev2 ike = aes256-sha256-modp3072,aes256-sha256-modp3072 esp = aes256-sha256-modp3072,aes256-sha256-modp3072 ikelifetime = 28800 mobike = no lifetime = 3600 dpdaction = restart dpddelay = 30s auto = start ===== strongswan etc/strongswan.d/charon/kernel-pfkey.conf: ===== kernel-pfkey { load = yes # route_via_internal = no } ===== route -n monitor ===== got message of size 272 on Sat Oct 14 12:39:39 2023 RTM_GET: Report Metrics: len 272, pid: 49695, seq 1, errno 0, flags: locks: inits: sockaddrs: 0.0.0.0 1.1.1.1 0.0.0.0 vlan200:48.dc.2d.6.4f.f4 1.1.1.2 got message of size 200 on Sat Oct 14 12:39:39 2023 RTM_GET: Report Metrics: len 200, pid: 49695, seq 2, errno 0, flags: locks: inits: sockaddrs: 0.0.0.0 1.1.1.1 0.0.0.0 got message of size 256 on Sat Oct 14 12:39:39 2023 RTM_ADD: Add Route: len 256, pid: 49695, seq 3, errno 0, flags: locks: inits: sockaddrs: 2.2.2.2 1.1.1.1 vlan200:48.dc.2d.6.4f.f4 1.1.1.2 got message of size 272 on Sat Oct 14 12:39:39 2023 RTM_ADD: Add Route: len 272, pid: 49695, seq 5, errno 0, flags: locks: inits: sockaddrs: 128.0.0.0 1.1.1.1 128.0.0.0 vlan200:48.dc.2d.6.4f.f4 1.1.1.2 got message of size 272 on Sat Oct 14 12:39:39 2023 RTM_ADD: Add Route: len 272, pid: 49695, seq 4, errno 0, flags: locks: inits: sockaddrs: 0.0.0.0 1.1.1.1 128.0.0.0 vlan200:48.dc.2d.6.4f.f4 1.1.1.2 ===== netstat -r -nW4: ===== Routing tables Internet: Destination Gateway Flags Nhop# Mtu Netif Expire 0.0.0.0/1 195.34.58.166 US 12 1500 vlan200 default 195.34.58.166 UGS 6 1500 vlan200 10.4.102.128/31 link#8 U 8 1500 vlan22 10.4.102.129 link#8 UHS 7 16384 lo0 31.131.95.64/27 127.0.0.1 U1B 9 16384 lo0 46.243.226.103 195.34.58.166 UGHS 10 1500 vlan200 127.0.0.1 link#5 UHS 1 16384 lo0 128.0.0.0/1 195.34.58.166 US 12 1500 vlan200 172.16.110.12/31 link#4 U 2 1500 ixl3 172.16.110.13 link#4 UHS 3 16384 lo0 172.16.110.129 link#11 UHS 11 16384 lo0 195.34.58.166/31 link#7 U 4 1500 vlan200 195.34.58.167 link#7 UHS 5 16384 lo0 ===== netstat -o -nW4 ===== Nexthop data Internet: Idx Type IFA Gateway Flags Use Mtu Netif Addrif Refcnt Prepend 1 v4/resolve 127.0.0.1 lo0/resolve HS 1366 16384 lo0 2 2 v4/resolve 172.16.110.13 ixl3/resolve 0 1500 ixl3 2 3 v4/resolve 127.0.0.1 lo0/resolve HS 0 16384 lo0 ixl3 2 4 v4/resolve 195.34.58.167 vlan200/resolve 51749 1500 vlan200 4 5 v4/resolve 127.0.0.1 lo0/resolve HS 0 16384 lo0 vlan200 2 6 v4/gw 195.34.58.167 195.34.58.166 GS 37902 1500 vlan200 2 7 v4/resolve 127.0.0.1 lo0/resolve HS 0 16384 lo0 vlan22 2 8 v4/resolve 10.4.102.129 vlan22/resolve 3 1500 vlan22 2 9 v4/resolve 127.0.0.1 lo0/resolve 1B 0 16384 lo0 2 10 v4/gw 195.34.58.167 195.34.58.166 GHS 0 1500 vlan200 2 11 v4/resolve 127.0.0.1 lo0/resolve HS 0 16384 lo0ipsec10121 2 12 v4/resolve 195.34.58.167 vlan200/resolve S 0 1500 vlan200 3 ===== If I changed "route_via_internal=yes" at etc/strongswan.d/charon/kernel-pfkey.conf then no route like 0.0.0.0/1 or 128.0.0.0/1 installed but network still fails The very same strongswan config works fine for many years on FreeBSD-11. FreeBSD-13 has many changes at network stack and strongswan changed too. Also I read https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255678 and https://github.com/strongswan/strongswan/issues/910 and its looks like strongswan/FreeBSD integration issue. I'll appreciate any advice. Thanks! -- CU, Victor Gamov --000000000000e6984d0607aa97c2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi All

I have FreeBSD 13.2-S= TABLE stable/13-n255939-b9da47180fd6 GENERIC amd64 machine with strongswan-= 5.9.11_2 installed by pkg.

When routed ipsec is up= all outgoing packets forwarded into ipsec-tunnel so networking is immediat= ely fails.

FreeBSD config:
=3D=3D=3D= =3D=3D
net.fibs=3D4
net.inet.ip.forwarding=3D1
=3D= =3D=3D=3D=3D


ifconfig ipsec10121
=3D=3D=3D=3D=3D
ipsec10121: flags=3D8050<UP,POINTO= POINT,RUNNING,MULTICAST> metric 0 mtu 1400
description: PoP-12
t= unnel inet 1.1.1.2 --> 2.2.2.2
inet 172.16.110.129 --> 172.16.110= .130 netmask 0xfffffffc
groups: ipsec
reqid: 10121
nd6 options= =3D29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
=3D=3D=3D=3D=3D=


strongswan etc/ipsec.conf:
=3D=3D=3D=3D=3D
conn pop4-to-pop12-routed
# =C2=A0also = =3D tmpl_route_based
=C2=A0 left =3D 1.1.1.2
=C2=A0 right =3D 2.2.2.2=
=C2=A0 leftsubnet =3D 0.0.0.0/0
=C2= =A0 rightsubnet =3D 0.0.0.0/0
=C2=A0 re= qid =3D 10121
=C2=A0 type =3D tunnel
=C2=A0 authby =3D psk
=C2=A0 = keyexchange =3D ikev2
=C2=A0 ike =3D aes256-sha256-modp3072,aes256-sha25= 6-modp3072
=C2=A0 esp =3D aes256-sha256-modp3072,aes256-sha256-modp3072<= br>=C2=A0 ikelifetime =3D 28800
=C2=A0 mobike =3D no
=C2=A0 lifetime = =3D 3600
=C2=A0 dpdaction =3D restart
=C2=A0 dpddelay =3D 30s
=C2= =A0 auto =3D start
=3D=3D=3D=3D=3D


<= /div>
strongswan etc/strongswan.d/charon/kernel-pfkey.conf:
= =3D=3D=3D=3D=3D
kernel-pfkey {
=C2=A0 load =3D yes
# route_via_internal =3D no
}
=3D=3D=3D=3D=3D
<= div>

route -n monitor
=3D=3D=3D=3D= =3D
got message of size 272 on Sat Oct 14 12:39:39 2023
RTM_GE= T: Report Metrics: len 272, pid: 49695, seq 1, errno 0, flags:<UP,GATEWA= Y,DONE,STATIC>
locks: =C2=A0inits:
sockaddrs: <DST,GATEWAY,NET= MASK,IFP,IFA>
=C2=A00.0.0.0 1.1.1.1 0.0.0.0 vlan200:48.dc.2d.6.4f.f4 = 1.1.1.2

got message of size 200 on Sat Oct 14 12:39:39 2023
RTM_G= ET: Report Metrics: len 200, pid: 49695, seq 2, errno 0, flags:<UP,GATEW= AY,DONE,STATIC>
locks: =C2=A0inits:
sockaddrs: <DST,GATEWAY,NE= TMASK>
=C2=A00.0.0.0=C2=A01.1.1.1 0.0.0.0

got message of size = 256 on Sat Oct 14 12:39:39 2023
RTM_ADD: Add Route: len 256, pid: 49695,= seq 3, errno 0, flags:<UP,GATEWAY,HOST,DONE,STATIC>
locks: =C2=A0= inits:
sockaddrs: <DST,GATEWAY,IFP,IFA>
=C2=A02.2.2.2 1.1.1.1 = vlan200:48.dc.2d.6.4f.f4 1.1.1.2

got message of size 272 on Sat Oct = 14 12:39:39 2023
RTM_ADD: Add Route: len 272, pid: 49695, seq 5, errno 0= , flags:<UP,DONE,STATIC>
locks: =C2=A0inits:
sockaddrs: <DS= T,GATEWAY,NETMASK,IFP,IFA>
=C2=A0128.0.0.0=C2=A01.1.1.1 128.0.0.0 vla= n200:48.dc.2d.6.4f.f4 1.1.1.2

got message of size 272 on Sat Oct 14 = 12:39:39 2023
RTM_ADD: Add Route: len 272, pid: 49695, seq 4, errno 0, f= lags:<UP,DONE,STATIC>
locks: =C2=A0inits:
sockaddrs: <DST,G= ATEWAY,NETMASK,IFP,IFA>
=C2=A00.0.0.0=C2=A01.1.1.1 128.0.0.0 vlan200:= 48.dc.2d.6.4f.f4 1.1.1.2
=3D=3D=3D=3D=3D

=

netstat -r -nW4:
=3D=3D=3D=3D=3D
Routing tables

Internet:
Destination =C2=A0 =C2=A0 =C2=A0 =C2= =A0Gateway =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Flags =C2=A0 Nhop# =C2= =A0 =C2=A0Mtu =C2=A0 =C2=A0 =C2=A0Netif Expire
0.0.0.0/1 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0195.34.58.166 =C2=A0 = =C2=A0 =C2=A0US =C2=A0 =C2=A0 =C2=A0 =C2=A0 12 =C2=A0 1500 =C2=A0 =C2=A0vla= n200
default =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0195.34.58.166 =C2= =A0 =C2=A0 =C2=A0UGS =C2=A0 =C2=A0 =C2=A0 =C2=A0 6 =C2=A0 1500 =C2=A0 =C2= =A0vlan200
10.4.102.128/31 =C2=A0= =C2=A0link#8 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 U =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 8 =C2=A0 1500 =C2=A0 =C2=A0 vlan22
10.4.102.129 =C2=A0= =C2=A0 =C2=A0 link#8 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 UHS =C2=A0 = =C2=A0 =C2=A0 =C2=A0 7 =C2=A016384 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0
31.131.95.64/27 =C2=A0 =C2=A0127.0.0.1 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0U1B =C2=A0 =C2=A0 =C2=A0 =C2=A0 9 =C2=A01638= 4 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0
46.243.226.103 =C2=A0 =C2=A0 195.34.58.= 166 =C2=A0 =C2=A0 =C2=A0UGHS =C2=A0 =C2=A0 =C2=A0 10 =C2=A0 1500 =C2=A0 =C2= =A0vlan200
127.0.0.1 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0link#5 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 UHS =C2=A0 =C2=A0 =C2=A0 =C2=A0 1 =C2=A0163= 84 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0
128.0.0= .0/1 =C2=A0 =C2=A0 =C2=A0 =C2=A0195.34.58.166 =C2=A0 =C2=A0 =C2=A0US = =C2=A0 =C2=A0 =C2=A0 =C2=A0 12 =C2=A0 1500 =C2=A0 =C2=A0vlan200
172.16.110.12/31 =C2=A0 link#4 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 U =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 2 =C2= =A0 1500 =C2=A0 =C2=A0 =C2=A0 ixl3
172.16.110.13 =C2=A0 =C2=A0 =C2=A0lin= k#4 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 UHS =C2=A0 =C2=A0 =C2=A0 =C2= =A0 3 =C2=A016384 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0
172.16.110.129 =C2=A0 = =C2=A0 link#11 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0UHS =C2=A0 =C2=A0 = =C2=A0 =C2=A011 =C2=A016384 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0
195.34.58.166/31 =C2=A0 link#7 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 U =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 4 =C2=A0 1500= =C2=A0 =C2=A0vlan200
195.34.58.167 =C2=A0 =C2=A0 =C2=A0link#7 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 UHS =C2=A0 =C2=A0 =C2=A0 =C2=A0 5 =C2=A0= 16384 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0
=3D=3D=3D=3D=3D

netstat -o -nW4
=3D=3D=3D=3D=3D
Nexthop data

Internet:
Idx =C2=A0 Type =C2=A0 =C2=A0 =C2= =A0 =C2=A0 IFA =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Gatew= ay =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Flags =C2=A0 =C2=A0 =C2=A0Use = Mtu =C2=A0 =C2=A0 =C2=A0 =C2=A0 Netif =C2=A0 =C2=A0 Addrif Refcnt Prepend1 =C2=A0 =C2=A0 =C2=A0 v4/resolve 127.0.0.1 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0lo0/resolve =C2=A0 =C2=A0 =C2=A0 =C2=A0HS =C2=A0 =C2=A0 =C2=A0 =C2=A0= 1366 =C2=A016384 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 2
2 =C2=A0 =C2=A0 =C2=A0 v4/resolve 172.16.110= .13 =C2=A0 =C2=A0 =C2=A0ixl3/resolve =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 =C2=A0 1500 =C2=A0 =C2=A0 =C2=A0 ixl3 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 2
3 =C2=A0 =C2=A0 =C2=A0 = v4/resolve 127.0.0.1 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0/resolve =C2=A0 = =C2=A0 =C2=A0 =C2=A0HS =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A00 =C2=A0163= 84 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0 =C2=A0 =C2=A0 =C2=A0ixl3 =C2=A0 =C2=A0 2 =
4 =C2=A0 =C2=A0 =C2=A0 v4/resolve 195.34.58.167 =C2=A0 =C2=A0 =C2=A0vla= n200/resolve =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A051749 =C2=A0 1= 500 =C2=A0 =C2=A0vlan200 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 4=
5 =C2=A0 =C2=A0 =C2=A0 v4/resolve 127.0.0.1 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0lo0/resolve =C2=A0 =C2=A0 =C2=A0 =C2=A0HS =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A00 =C2=A016384 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0 =C2=A0 vla= n200 =C2=A0 =C2=A0 2
6 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0v4/gw 1= 95.34.58.167 =C2=A0 =C2=A0 =C2=A0195.34.58.166 =C2=A0 =C2=A0 =C2=A0GS =C2= =A0 =C2=A0 =C2=A0 =C2=A037902 =C2=A0 1500 =C2=A0 =C2=A0vlan200 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 2
7 =C2=A0 =C2=A0 =C2=A0 v4/reso= lve 127.0.0.1 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0/resolve =C2=A0 =C2=A0 = =C2=A0 =C2=A0HS =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A00 =C2=A016384 =C2= =A0 =C2=A0 =C2=A0 =C2=A0lo0 =C2=A0 =C2=A0vlan22 =C2=A0 =C2=A0 2
8 =C2= =A0 =C2=A0 =C2=A0 v4/resolve 10.4.102.129 =C2=A0 =C2=A0 =C2=A0 vlan22/resol= ve =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 3 =C2=A0 = 1500 =C2=A0 =C2=A0 vlan22 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = 2
9 =C2=A0 =C2=A0 =C2=A0 v4/resolve 127.0.0.1 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0lo0/resolve =C2=A0 =C2=A0 =C2=A0 =C2=A01B =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A00 =C2=A016384 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 2
10 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 v4/gw 195.34.58.167 =C2=A0 =C2=A0 =C2=A0195.34.58.166 =C2=A0 =C2=A0= =C2=A0GHS =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 =C2=A0 1500 =C2=A0 =C2=A0vl= an200 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 2
11 =C2=A0 =C2= =A0 =C2=A0v4/resolve 127.0.0.1 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0/resolv= e =C2=A0 =C2=A0 =C2=A0 =C2=A0HS =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A00 = =C2=A016384 =C2=A0 =C2=A0 =C2=A0 =C2=A0lo0ipsec10121 =C2=A0 =C2=A0 2
12= =C2=A0 =C2=A0 =C2=A0v4/resolve 195.34.58.167 =C2=A0 =C2=A0 =C2=A0vlan200/r= esolve =C2=A0 =C2=A0S =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0 =C2=A0 15= 00 =C2=A0 =C2=A0vlan200 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 3 =
=3D=3D=3D=3D=3D


= If I changed "route_via_internal=3Dyes" at etc/strongswan.d/char= on/kernel-pfkey.conf then no route like 0.0.0.= 0/1 or 128.0.0.0/1 installed but net= work still fails

The very same strongswan config w= orks fine for many years on FreeBSD-11.=C2=A0=C2=A0 FreeBSD-13 has many cha= nges at network stack and strongswan changed too.



<= div>I'll appreciate any advice.=C2=A0 Thanks!

= --
CU,
Victor Gamov=
--000000000000e6984d0607aa97c2--