-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello Luka,
What other rules do you have in the POSTROUTING chain? If any other rule removes the packets from the chain, then they don't reach the MASQUERADE rule and hence won't get masqueraded. The rule basicly says: If the traffic is going out on the eth0 interface and the source is 10.0.0.0/24 and the destination ist 0.0.0.0/0, then masquerade it. Masquerade basicly means NAT, but it will replace the source IP of the traffic based on the interface it's going out. No, the parameters that are displayed in the first couple of columns are just filters that restrict traffic going to the target. For further clarification, I recomment you read the manpage for iptables and iptables-extensions (if the latter exists on your system. It does on Arch Linux.). For your setup, I recomment you ommit -o eth0 and INSERT, and not APPEND the rule to the chain. Example: iptables -I POSTROUTING 1 -s 10.0.0.0/24 -j MASQUERADE Regards Noel Kuntze On 10.11.2013 16:31, Luka wrote: > > Hi Noel. > > Still no luck. > > I’ve added masquerade, following line is added to nat iptable: > > Chain POSTROUTING (policy ACCEPT 2500 packets, 221K bytes) > > num pkts bytes target prot opt in out source > destination > > … > > 4 0 0 MASQUERADE all -- * eth0 10.0.0.0/24 > <http://10.0.0.0/24> 0.0.0.0/0 <http://0.0.0.0/0> > > > What exactly does this masquerade record means ? Probably that all packets > from 10.0.0.0/24 <http://10.0.0.0/24> network that have any(0.0.0.0) > destination will get IP address of eth0 device ? > > But eth0 is device with external IP of server (86.58.x.x) (see ifconfig > output below), should I use br0 device here (the one with local IP of router) > ? > > > Ok, if I sum up my situation: > > CLIENT(iPhone): > > - I can connect to IPsec(strongswan) > > - gets virtual IP Address: 10.0.0.2 > > > SERVER (strongswan v5.0.4, on my router, Linux 2.6.22.19): > > - local IP: 192.168.2.1 > > - external IP 86.58.x.x > > ipsec statusall: > > Virtual IP pools (size/online/offline): > > 10.0.0.2 <http://10.0.0.2>: 1/1/0 > > Listening IP addresses: > > 86.58.x.x > > 192.168.2.1 > > > Security Associations (1 up, 0 connecting): > > ios[2]: ESTABLISHED 19 seconds ago, 86.58.x.x[C=SI, O=Lupo, > CN=86.58.x.x]…46.123.x.x[C=SI, O=Lupo, CN=clientLupo] > > ios[2]: Remote XAuth identity: lupo > > ios[2]: IKEv1 SPIs: cd789eae5d666586_i 638f1ca174f85726_r*, public > key reauthentication in 2 hours > > ios[2]: IKE proposal: > AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536 > > ios{1}: INSTALLED, TUNNEL, ESP SPIs: c7f2d740_i 0829cc4a_o > > ios{1}: AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in > 45 minutes > > ios{1}: 0.0.0.0/0 <http://0.0.0.0/0> === 10.0.0.2/32 > <http://10.0.0.2/32> > > > iptables: > > This entries are added to FORWARD chain after I connect to server: > > > Chain FORWARD (policy DROP 0 packets, 0 bytes) > > num pkts bytes target prot opt in out source > destination > > 1 0 0 ACCEPT all -- eth0 * 10.0.0.2 > 0.0.0.0/0 <http://0.0.0.0/0> policy match dir in pol ipsec reqid 2 > proto 50 > > 2 0 0 ACCEPT all -- * eth0 0.0.0.0/0 > <http://0.0.0.0/0> 10.0.0.2 policy match dir out pol > ipsec reqid 2 proto 50 > > > iptables(nat table): > > Chain PREROUTING (policy ACCEPT 4188 packets, 599K bytes) > > num pkts bytes target prot opt in out source > destination > > 1 1 60 ACCEPT tcp -- * * 0.0.0.0/0 > <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0> tcp > dpt:1194 > > 2 305 54089 VSERVER all -- * * 0.0.0.0/0 > <http://0.0.0.0/0> 86.58.x.x > > > Chain POSTROUTING (policy ACCEPT 2500 packets, 221K bytes) > > num pkts bytes target prot opt in out source > destination > > 1 0 0 MASQUERADE all -- * tun11 192.168.2.0/24 > <http://192.168.2.0/24> 0.0.0.0/0 <http://0.0.0.0/0> > > 2 731 46984 MASQUERADE all -- * eth0 !86.58.x.x > 0.0.0.0/0 <http://0.0.0.0/0> > > 3 0 0 MASQUERADE all -- * * 0.0.0.0/0 > <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0> MARK > match 0xd001 > > 4 0 0 MASQUERADE all -- * eth0 10.0.0.0/24 > <http://10.0.0.0/24> 0.0.0.0/0 <http://0.0.0.0/0> > > > Chain OUTPUT (policy ACCEPT 2489 packets, 220K bytes) > > num pkts bytes target prot opt in out source > destination > > > Chain LOCALSRV (0 references) > > num pkts bytes target prot opt in out source > destination > > > Chain VSERVER (1 references) > > num pkts bytes target prot opt in out source > destination > > 1 1 123 DNAT tcp -- * * 0.0.0.0/0 > <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0> tcp > dpt:1184 to:192.168.2.100:1194 <http://192.168.2.100:1194> > > 2 0 0 DNAT udp -- * * 0.0.0.0/0 > <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0> udp > dpt:1184 to:192.168.2.100:1194 <http://192.168.2.100:1194> > > 3 304 53966 VUPNP all -- * * 0.0.0.0/0 > <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0> > > > Chain VUPNP (1 references) > > num pkts bytes target prot opt in out source > destination > > > Chain YADNS (0 references) > > num pkts bytes target prot opt in out source > destination > > > > ifconfig: > > br0 Link encap:Ethernet HWaddr 30:85:A9:E6:EF:A0 > > inet addr:192.168.2.1 Bcast:192.168.2.255 Mask:255.255.255.0 > > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 > > RX packets:20577 errors:0 dropped:0 overruns:0 frame:0 > > TX packets:16212 errors:0 dropped:0 overruns:0 carrier:0 > > collisions:0 txqueuelen:0 > > RX bytes:7597057 (7.2 MiB) TX bytes:2892960 (2.7 MiB) > > > eth0 Link encap:Ethernet HWaddr 30:85:A9:E6:EF:A0 > > inet addr:86.58.x.x Bcast:86.58.y.y Mask:255.255.255.0 > > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 > > RX packets:665392 errors:0 dropped:0 overruns:0 frame:0 > > TX packets:1473423 errors:0 dropped:0 overruns:0 carrier:0 > > collisions:0 txqueuelen:1000 > > RX bytes:83612848 (79.7 MiB) TX bytes:1996770618 (1.8 GiB) > > Interrupt:4 Base address:0x2000 > > ... > > btw, should tunnel, that is created by strongswan, appear in this ifconfig > list ? > > > I’m probably missing another piece of puzzle. > > Is there any other log file except strongswan log, that should I examine ? > > > Thanks > > Luka > > > > On Sun, Nov 10, 2013 at 3:38 PM, Noel Kuntze <n...@familie-kuntze.de > <mailto:n...@familie-kuntze.de>> wrote: > > > Sorry, it is "iptables -A POSTROUTING -t nat -s 10.0.0.0/24 > <http://10.0.0.0/24> -o eth0 -j MASQUERADE" > On 10.11.2013 15:05, Noel Kuntze wrote: > > > Hello Luka, > > > You need to masquerade the traffic from your iPhone to the LAN or the > > internet. > > You do this with either the MASQUERADE or the SNAT target in iptables. > > Example: iptables -A FORWARD -t nat -s 10.0.0.0/24 <http://10.0.0.0/24> -o > > eth0 -j MASQUERADE > > > Regards > > Noel Kuntze > > > On 10.11.2013 11:50, Luka wrote: > > > Hi. > > > I've found way to fix that error: "iptables: No chain/target/match by > > > that name" by executing command: > > > > insmod xt_policy > > > > > Now when I connect, iPhone gets IP 10.0.0.2 and following policy is added > > > to FORWARD chain: > > > > Chain FORWARD (policy DROP 0 packets, 0 bytes) > > > > num pkts bytes target prot opt in out source > > > destination > > > > 1 0 0 ACCEPT all -- eth0 * 10.0.0.2 > > > 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> policy match > > > dir in pol ipsec reqid 1 proto 50 > > > > 2 0 0 ACCEPT all -- * eth0 0.0.0.0/0 > > > <http://0.0.0.0/0> <http://0.0.0.0/0> 10.0.0.2 > > > policy match dir out pol ipsec reqid 1 proto 50 > > > > > I'm using config: > > > > conn %default > > > > keyexchange=ikev1 Read > > > the manpage for it > > > > authby=xauthrsasig > > > > xauth=server > > > > > > #leftid = subject alt. name (v certifikatu) > > > > conn ios > > > > left=%defaultroute > > > > leftsubnet=0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> > > > > leftcert=serverCert.pem > > > > leftfirewall=yes > > > But I still can't access my LAN (192.168.2.0/24 <http://192.168.2.0/24>) or > > ping router 192.168.2.1 or ping phone virtual IP 10.0.0.2. > > > I've no idea what else should I try. I give up. > > > > right=%any > > > > rightsubnet=10.0.0.0/24 <http://10.0.0.0/24> <http://10.0.0.0/24> > > > > rightsourceip=10.0.0.2 > > > > auto=add > > > > rightcert=clientCert.pem > > > > > > But I still can't access my LAN (192.168.2.0/24 <http://192.168.2.0/24> > > > <http://192.168.2.0/24>) or ping router 192.168.2.1 or ping phone virtual > > > IP 10.0.0.2. > > > > I've no idea what else should I try. I give up. > > > > > L > > > > > > > On Thu, Nov 7, 2013 at 11:05 PM, Noel Kuntze <n...@familie-kuntze.de > > > <mailto:n...@familie-kuntze.de> <mailto:n...@familie-kuntze.de > > > <mailto:n...@familie-kuntze.de>>> wrote: > > > > > Hello Luka, > > > > I actually meant the config which you created after I sent you that link > > > [1]. > > > I don't know exactly why there are retransmits happening, but in general, > > > the setup should work. > > > > [1] > > > http://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling > > > > Regards > > > Noel Kuntze > > > > On 07.11.2013 23:03, Luka wrote: > > >> Ok I've switched back to following configuration and I can connect to > > >> VPN again (back to beginning, can connect but can't access LAN behind > > >> VPN): > > > >> conn %default > > > >> keyexchange=ikev1 > > > >> authby=xauthrsasig > > > >> xauth=server > > > > > >> conn ios > > > >> left=86.xx.xx.x35 > > > >> leftcert=serverLupoCert.pem > > > >> leftsubnet=192.168.2.0/24 <http://192.168.2.0/24> > > >> <http://192.168.2.0/24> <http://192.168.2.0/24> > > > >> leftfirewall=yes > > > >> right=%any > > > >> rightsourceip=10.3.0.1 > > > >> auto=add > > > >> rightcert=clientLupoCert.pem > > > > >> Do I have to put server's WAN Ip address for "left" or local IP ? > > > >> Configuration is simmilar to this > > >> one:http://www.strongswan.org/uml/testresults/ikev1/xauth-id-rsa-config/index.html. > > >> I've checked iptables -L command on that site > > >> <http://www.strongswan.org/uml/testresults/ikev1/xauth-id-rsa-config/moon.iptables> > > >> and compared it with mine. > > >> It looks like mine is missing some forwarding rules. > > >> Mine: > > > >> iptables -L -v -n --line-numbers > > > >> Chain INPUT (policy ACCEPT 109K packets, 9709K > > >> bytes)http://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling > > > >> num pkts bytes target prot opt in out source > > >> destination > > > >> 1 236 31088 ACCEPT esp -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > >> 2 0 0 ACCEPT udp -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> udp dpt:4500 > > > >> 3 196 68288 ACCEPT udp -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> udp dpt:500 > > > >> 4 0 0 ACCEPT all -- tun21 * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > >> 5 1138 105K ACCEPT tcp -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> tcp dpt:1194 > > > >> 6 0 0 ACCEPT all -- tun11 * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > > >> Chain FORWARD (policy DROP 0 packets, 0 bytes) > > > >> num pkts bytes target prot opt in out source > > >> destination > > > >> 1 0 0 ACCEPT esp -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > >> 2 0 0 ACCEPT all -- tun21 * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > >> 3 5 344 ACCEPT all -- tun11 * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > >> 4 22028 1928K ACCEPT all -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> state RELATED,ESTABLISHED > > > >> 5 0 0 logdrop all -- !br0 eth0 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > >> 6 28 1432 logdrop all -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> state INVALID > > > >> 7 0 0 ACCEPT all -- br0 br0 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > >> 8 1344 80640 ACCEPT all -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> ctstate DNAT > > > >> 9 32811 2190K ACCEPT all -- br0 * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > > >> Chain OUTPUT (policy ACCEPT 109K packets, 19M bytes) > > > >> num pkts bytes target prot opt in out source > > >> destination > > > >> 1 0 0 ACCEPT esp -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > > >> Chain FUPNP (0 references) > > > >> num pkts bytes target prot opt in out source > > >> destination > > > > >> Chain PControls (0 references) > > > >> num pkts bytes target prot opt in out source > > >> destination > > > >> 1 0 0 ACCEPT all -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > > >> Chain logaccept (0 references) > > > >> num pkts bytes target prot opt in out source > > >> destination > > > >> 1 0 0 LOG all -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> state NEW LOG flags 7 level 4 prefix `ACCEPT ' > > > >> 2 0 0 ACCEPT all -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > > >> Chain logdrop (2 references) > > > >> num pkts bytes target prot opt in out source > > >> destination > > > >> 1 0 0 LOG all -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> state NEW LOG flags 7 level 4 prefix `DROP' > > > >> 2 28 1432 DROP all -- * * 0.0.0.0/0 > > >> <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > >> 0.0.0.0/0 <http://0.0.0.0/0> <http://0.0.0.0/0> <http://0.0.0.0/0> > > > > >> If I understand "leftfirewall=yes" command, it should put those rules > > >> into iptables. > > > >> I've checked charon log file and found this error: > > > >> cat strongswancharon.log | grep iptables > > > >> Nov 7 22:59:06 11[CFG] leftupdown=ipsec _updown iptables > > > >> Nov 7 22:59:26 12[CHD] updown: iptables: No chain/target/match by that > > >> name > > > >> Nov 7 22:59:26 12[CHD] updown: iptables: No chain/target/match by that > > >> name > > > > >> Am I missing some modules here or something ? > > > >> How can I get/log those commands for iptables, that strongswan executes ? > > > > >> Thanks. > > > > > >> On Thu, Nov 7, 2013 at 6:25 PM, Noel Kuntze <n...@familie-kuntze.de > > >> <mailto:n...@familie-kuntze.de> <mailto:n...@familie-kuntze.de > > >> <mailto:n...@familie-kuntze.de>> <mailto:n...@familie-kuntze.de > > >> <mailto:n...@familie-kuntze.de> <mailto:n...@familie-kuntze.de > > >> <mailto:n...@familie-kuntze.de>>>> wrote: > > > > >> Hello Luka, > > > >> Your former configuration worked just fine. The problem was with the > > >> network or similiar. It had nothing to do with strongSwan. > > > >> Regards > > >> Noel Kuntze > > > >> On 07.11.2013 10:51, Luka wrote: > > >>> Now I've tried to load modules by hand. I've added following line to > > >>> strongswan.conf: > > >>> load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 > > >>> revocation hmac xcbc stroke kernel-netlink socket-default updown > > >>> resolve attr farp xauth-generic > > > >>> And if I check charon logs, it looks like it connects and then > > >>> immediately disconnects from vpn. > > >>> Here are interesting lines from log file, (I connect with iphone and > > >>> get "Negotiation with the VPN server failed": > > > >>> ... > > >>> Nov 7 10:31:12 14[CFG] id '<server.wan.ip>' not confirmed by > > >>> certificate, defaulting to 'C=SI, O=Hlupo, CN=clientLupo' > > >>> ... > > >>> Nov 7 10:31:12 14[CFG] id '%any' not confirmed by certificate, > > >>> defaulting to 'C=SI, O=Hlupo, CN=<server.wan.ip>' > > >>> ... > > >>> Nov 7 10:31:12 14[CFG] left is other host, swapping ends > > >>> ... > > >>> Nov 7 10:13:55 04[IKE] IKE_SA (unnamed)[1] state change: CREATED => > > >>> CONNECTING > > >>> ... > > >>> Nov 7 10:13:56 05[IKE] remote host is behind NAT > > >>> ... > > >>> Nov 7 10:13:57 11[IKE] XAuth authentication of 'lupo' successful > > >>> ... > > >>> Nov 7 10:13:57 12[IKE] IKE_SA ios[1] state change: CONNECTING => > > >>> ESTABLISHED > > >>> ... > > >>> Nov 7 10:13:57 12[IKE] peer requested virtual IP %any > > >>> Nov 7 10:13:57 12[IKE] no virtual IP found for %any requested by 'lupo' > > >>> ... > > >>> Nov 7 10:14:13 05[ENC] parsing HASH_V1 payload finished > > >>> Nov 7 10:14:13 05[ENC] parsing DELETE_V1 payload, 40 bytes left > > >>> ... > > >>> Nov 7 10:14:13 05[ENC] parsing DELETE_V1 payload finished > > >>> ... > > >>> Nov 7 10:14:13 05[IKE] IKE_SA ios[1] state change: ESTABLISHED => > > >>> DELETING > > >>> Nov 7 10:14:13 05[MGR] checkin and destroy IKE_SA ios[1] > > >>> Nov 7 10:14:13 05[IKE] IKE_SA ios[1] state change: DELETING => > > >>> DESTROYING > > >>> Nov 7 10:14:13 05[MGR] check-in and destroy of IKE_SA successful > > >>> Nov 7 10:14:13 02[NET] waiting for data on sockets > > >>> Nov 7 10:14:25 15[JOB] got event, queuing job for execution > > >>> Nov 7 10:14:25 15[JOB] next event in 9732s 760ms, waiting > > >>> Nov 7 10:14:25 06[MGR] checkout IKE_SA > > > >>> Should I put something else instead of "right=%any" ? > > > > > > > > > > > _______________________________________________ > > Users mailing list > > Users@lists.strongswan.org <mailto:Users@lists.strongswan.org> > > https://lists.strongswan.org/mailman/listinfo/users > > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJSf64LAAoJEDg5KY9j7GZYwV0QAJOdf6h+ub20kurhfoyCTypv fuKNs22i4batpPoSRyxI+f2PcLE0ojos6FF1aR3BRdQbWhGwe8nZHxVT2eOiCdPV 4+J/EBfXRG+uKhKCrBJWqZdcmCenJmb2kfG0e0DxO2FWmqvh/r5YyS1zz7IM6e0B WQg4d8UaKxSvso6XRDLJErscqHxeUx57QtLk03/boz75fmwGq75l7LlGDjt6PMJ5 EC97ipXgdf5tZj7OfEHM4p9UYzzjBuGq6RdFtX1SiZMhAKCJGp8I33yGs92hJhUG gF+C735qwJlz9WXKS7pIHeyjekCOUQpmn4UEcJBwP+sVPQowfTWLttH6FtcRAPHM M9st8xTfabOhlqjU/AZ9ws8FvojDN2fLcfhoHkkycbcXgcTBdm8oEiakHju7PUaW JUazZD9xxFgQrCEuLATBlwi3YT5Nph8JiAHBfSJ2qnI55/2uU806w+GcKG+Jna9q qRFGKWUQi1OF9KSjzfzgHMLxyPmVc1xYGH8rxviN7p9zsJqpRZx/rMXunrgSGpVy IY5+bJv8+qWqbBjz2mzL5RS3OjWBD5163gZPE68eVxYJQzs1SvUv6EntDS5kPag+ KadLEyabq1zo+MAC5TIsucfSTrDjU/iBTtOzKO4gqDoaBe8gNX+ZdGccjqSMJJpt GBYSeSk0qahEDa8nL9jN =uJPU -----END PGP SIGNATURE----- _______________________________________________ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users
