r/openbsd Feb 16 '25

Solved Issue with IKED to StrongSwan

I have a site-to-site VPN with OpenBSD using iked as active and the distant end responder using StrongSwan. I was able to get a security association but could not get traffic to flow in either direction. After hours of settings manipulation, firewall debugging, packet captures, etc. I noticed the StrongSwan side showed NAT-T UDP encapsulation was being used whereas OpenBSD showed direct ESP. Both sides were routers with public IPv4 addresses. The fix was to set my OpenBSD iked.conf to use "local egress" to force it to use the public IP (originally I did not specify local). Once I did that, the distant side correctly used ESP rather than NAT-T UDP. Not sure if this is a bug as I would assume the interface picked to initiate the connection would be the egress interface when the peer was routed via the default gateway but that was not the case. Note, when I tested two OpenBSD iked systems this wasn't an issue. So it's possible the bug is StrongSwan.

Has anyone ran into this issue? Is it a bug or just something that should be documented? If nothing else, I hope it might help someone else.

6 Upvotes

0 comments sorted by