Hello, just to try the "ipsec-interface" parameter, that I've never used
before, I've added "ipsec-interface=yes" to a working VPN (Libreswan
4.2) and I've noted that it has trouble with "auto=ondemand".
In that case, as soon I start the ipsec service, I see something like
that in the log:
=====
"test": route-host output: /usr/libexec/ipsec/_updown.xfrm: doroute "ip
-4 route replace 192.168.1.0/24 dev ipsec1" failed (Cannot find device
"ipsec1")
=====
The message is right, because in that moment the ipsec1 interface
doesn't exist, as reported by "ip link".
If I trigger traffic to bring the VPN up, it starts as expected, the
ipsec1 interface is created but clearly I cannot reach the other end,
since the corresponding route is not there.
If I change to "auto=start", everything is ok: VPN works, the ipsec1
interface is there and also its route.
So it seems that the ipsec1 interface is created too late for the
ondemand case.
If it helps, my connection is something like that:
=====
conn test
auto=ondemand
authby=rsasig
ipsec-interface=yes
leftid=@left
left=192.168.10.55
leftrsasigkey=xyz...
rightid=@right
right=1.2.3.4
rightsubnet=192.168.1.0/24
rightrsasigkey=abc...
dpdaction=restart
dpddelay=10
dpdtimeout=30
=====
Cesare.
_______________________________________________
Swan mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan
