[strongSwan] Avoiding adding IP to loopback interface

[Simon T]

Hi,

I'm using strongSwan 5.6.1 (Linux 4.14.29, x86_64) and see some
unexpected behavior when I add a tunnel where the subnet for my side
of the connection does not exist on any interface on my machine.
Strongswan (well, I'm pretty sure it's Strongswan) adds a /32 IP to my
loopback interface when bringing up the connection.

E.g. My side is 10.0.0.0/24, and when the tunnel comes up, I find lo
has 10.0.0.0/32 installed to it. Is it possible to disable this
behavior? I was thinking of using an updown script to delete it, but
want to know if there's a way to avoid it being installed in the first
place?

# ip addr show lo
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet 10.0.0.0/32 scope global lo <------- This entry
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever

# cat /etc/ipsec.conf
config setup

conn %default
ikelifetime=14400s
keylife=10800s
rekeymargin=600s
keyingtries=%forever
keyexchange=ikev2
authby=secret
ike=aes256-sha256-modp1536!
esp=aes256-sha256-modp1536!
closeaction=restart

conn tun
auto=start
forceencaps=yes
ikelifetime=14400s
keylife=10800s
left=10.33.1.93
leftfirewall=no
leftid=@tunleft
leftsubnet=10.0.0.0/24
rekeymargin=600s
right=10.55.2.18
rightfirewall=no
rightid=@tunright
rightsubnet=10.1.1.1/32

Most traffic routes fine across the tunnel -- it's just that the
10.0.0.0/24 network doesn't reside locally, instead it comes from
another source, with my server acting as an intermediary router. So
adding 10.0.0.0/32 to lo stops traffic from the real 10.0.0.0 IP
working.

Regards,

Simon

[Tobias Brunner]

Hi Simon,

Post by Simon T
Strongswan (well, I'm pretty sure it's Strongswan) adds a /32 IP to my
loopback interface when bringing up the connection.

I don't think it is. strongSwan only adds virtual IPs (assigned from
the other peer, and since you don't request one with leftsourceip, there
won't be any) to local interfaces, and to `lo` only if explicitly
configured to do so (via charon.install_virtual_ip_on). There will also
be a log message if an IP address is installed.

Regards,
Tobias

[Simon T]

Hi Tobias,

Thanks for the sanity check. I've investigated further and you are
correct it was a third party program doing this! All working now.

Regards,

Simon

Post by Tobias Brunner
Hi Simon,

Post by Simon T
Strongswan (well, I'm pretty sure it's Strongswan) adds a /32 IP to my
loopback interface when bringing up the connection.

I don't think it is. strongSwan only adds virtual IPs (assigned from
the other peer, and since you don't request one with leftsourceip, there
won't be any) to local interfaces, and to `lo` only if explicitly
configured to do so (via charon.install_virtual_ip_on). There will also
be a log message if an IP address is installed.
Regards,
Tobias