我正在尝试按照我为拉伸编写的指南在 Debian buster 上设置一个 stronSwan 服务器。

与服务器的连接工作正常，但客户端无法访问互联网。

我错过了什么？

猫 /etc/ipsec.conf

config setup
  charondebug="ike 1, knl 1, cfg 0"
  uniqueids=never

conn ikev2
  auto=add
  compress=no
  type=tunnel
  keyexchange=ikev2
  fragmentation=yes
  forceencaps=yes
  ike=aes256gcm16-sha384-modp3072!
  esp=aes256gcm16-sha384-modp3072!
  dpdaction=clear
  dpddelay=300s
  rekey=no
  left=%any
  leftid=example.net
  leftcert=server.crt
  leftsendcert=always
  leftsubnet=0.0.0.0/0
  right=%any
  rightid=%any
  rightauth=eap-tls
  rightdns=1.1.1.1,1.0.0.1
  rightsourceip=10.0.2.0/24
  rightsendcert=never
  eap_identity=%identity

iptables-保存

# Generated by xtables-save v1.8.2 on Wed Apr 15 15:26:32 2020
*filter
:INPUT DROP [87:4831]
:FORWARD DROP [0:0]
:OUTPUT DROP [9:720]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A FORWARD -s 10.0.2.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A FORWARD -d 10.0.2.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Apr 15 15:26:32 2020
# Generated by xtables-save v1.8.2 on Wed Apr 15 15:26:32 2020
*nat
:PREROUTING ACCEPT [1800:60571]
:INPUT ACCEPT [12:768]
:POSTROUTING ACCEPT [24:1586]
:OUTPUT ACCEPT [15:1122]
-A POSTROUTING -s 10.0.2.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -s 10.0.2.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Apr 15 15:26:32 2020
# Generated by xtables-save v1.8.2 on Wed Apr 15 15:26:32 2020
*mangle
:PREROUTING ACCEPT [2413:113771]
:INPUT ACCEPT [701:58267]
:FORWARD ACCEPT [22:1424]
:OUTPUT ACCEPT [432:58684]
:POSTROUTING ACCEPT [445:59388]
-A FORWARD -s 10.0.2.0/24 -o eth0 -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
COMMIT
# Completed on Wed Apr 15 15:26:32 2020

sysctl -p

net.ipv4.ip_forward = 1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1