StrongSwan连接WatchGuard VPN成功但无流量互通问题求助

各位大佬求助！我在AWS托管的Ubuntu 22机器上用StrongSwan连接客户的WatchGuard VPN，连接明明显示建立成功了，但完全没有流量互通——我ping不通目标端的172.30.101.11，对方也访问不了我的机器。但在Windows测试机上连接后就能正常ping通这个地址，因为WatchGuard提供了iOS、Android和Windows的连接配置/脚本，偏偏没有Linux的，愁死我了😭

已做的配置与检查 #

AWS入站端口设置 #

已经开启了以下入站规则：

• UDP 4500
• UDP 500
• ESP(50) 所有端口

StrongSwan的ipsec.conf配置 #

conn PHS-IKEv2-VPN
left=172.31.89.153
leftid=USERNAME
leftauth=eap-mschapv2
type=tunnel
ike=aes256-sha256-modp2048
esp=aes256-sha256-modp2048
right=8.50.50.3
rightid=%any
auto=start
rightsubnet=172.30.101.11/32
rightauth=pubkey
modeconfig=pull  # 也试过push，没区别
leftsourceip=%config

系统级IP转发确认 #

已经启用了IP转发：

sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

路由配置（尝试镜像Windows机器的路由） #

Table 220的路由：第一条是StrongSwan自动生成的，剩下的是我手动添加的（模仿Windows机器的路由，但加不加结果都一样）

172.30.101.11 via 172.31.80.1 dev ens5 proto static src 10.184.123.129
8.50.50.3 via 172.31.80.1 dev ens5 src 172.31.89.153
10.0.0.0/8 dev ens5 scope link src 10.184.123.129
10.184.123.129 dev ens5 scope link src 10.184.123.129
10.255.255.255 dev ens5 scope link src 10.184.123.129
255.255.255.255 dev ens5 scope link src 10.184.123.129

系统/AWS生成的主路由表：

sudo ip route show table main
default via 172.31.80.1 dev ens5 proto dhcp metric 100
default via 172.31.80.1 dev ens5 proto dhcp src 172.31.89.153 metric 100
169.254.0.0/16 dev ens5 scope link metric 1000
172.31.0.2 via 172.31.80.1 dev ens5 proto dhcp src 172.31.89.153 metric 100
172.31.80.0/20 dev ens5 proto kernel scope link src 172.31.89.153 metric 100
172.31.80.1 dev ens5 proto dhcp scope link src 172.31.89.153 metric 100

StrongSwan状态检查（ipsec statusall） #

Listening IP addresses:
172.31.89.153
Connections:
IKEv2-VPN:  172.31.89.153...8.50.50.3  IKEv1/2
IKEv2-VPN:   local:  [USERNAME] uses EAP_MSCHAPV2 authentication
IKEv2-VPN:   remote: uses public key authentication
IKEv2-VPN:   child:  dynamic === 172.30.101.11/32 TUNNEL
Security Associations (1 up, 0 connecting):
IKEv2-VPN[1]: ESTABLISHED 17 minutes ago, 172.31.89.153[USERNAME]...8.50.50.3[O=WatchGuard, OU=Fireware, CN=ike2muvpn Server]
IKEv2-VPN[1]: IKEv2 SPIs: a8540d486c9c39c0_i* 16392ad532fb0bcc_r, EAP reauthentication in 2 hours
IKEv2-VPN[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
IKEv2-VPN{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c26bfd03_i 8e77f201_o
IKEv2-VPN{1}:  AES_CBC_256/HMAC_SHA2_256_128, 0 bytes_i, 0 bytes_o, rekeying in 29 minutes
IKEv2-VPN{1}:   10.184.123.129/32 === 172.30.101.11/32

日志信息 #

Sep 11 04:54:55 14[IKE] IKE_SA PHS-IKEv2-VPN[1] established between 172.31.89.153[GH_Remote]...8.53.54.171[O=WatchGuard, OU=Fireware, CN=ike2muvpn Server]
Sep 11 04:54:55 14[IKE] scheduling reauthentication in 10190s
Sep 11 04:54:55 14[IKE] maximum IKE_SA lifetime 10730s
Sep 11 04:54:55 14[IKE] installing DNS server 54.174.40.213 to /etc/resolv.conf
Sep 11 04:54:55 14[IKE] installing DNS server 52.3.100.184 to /etc/resolv.conf
Sep 11 04:54:55 14[CFG] handling INTERNAL_IP4_SUBNET attribute failed
Sep 11 04:54:55 14[IKE] installing new virtual IP 10.184.123.129
Sep 11 04:54:55 14[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ
Sep 11 04:54:55 14[IKE] CHILD_SA PHS-IKEv2-VPN{1} established with SPIs c7ee10bb_i cecb1240_o and TS 10.184.123.129/32 === 172.30.101.11/32
Sep 11 04:54:55 14[IKE] peer supports MOBIKE
Sep 11 04:56:56 06[IKE] sending keep alive to 8.53.54.171[4500]
Sep 11 04:58:56 10[IKE] sending keep alive to 8.53.54.171[4500]

测试操作与抓包 #

从10.x虚拟接口ping目标（普通ping也是同样无响应）：

ping -I 10.184.123.129 172.30.101.11
PING 172.30.101.11 (172.30.101.11) from 10.184.123.129 : 56(84) bytes of data
# 无任何响应

对应的TCP Dump结果：

sudo tcpdump -v  -i ens5 dst 172.30.101.11
tcpdump: listening on ens5, link-type EN10MB (Ethernet), snapshot length 262144 bytes
11:01:23.464363 IP (tos 0x0, ttl 64, id 49668, offset 0, flags [DF], proto ICMP (1), length 84)
ip-172-31-89-153 > 172.30.101.11: ICMP echo request, id 132, seq 1, length 64

备注：内容来源于stack exchange，提问作者T3.0