Skip to content

Strongswan IPsec on LEDE/OpenWRT with fast-classifier and shortcut-fe modules

Strongswan IPsec on LEDE/OpenWRT with fast-classifier and shortcut-fe modules published on 5 Comments on Strongswan IPsec on LEDE/OpenWRT with fast-classifier and shortcut-fe modules

I have using TP-Link TL-WDR4300 router with LEDE software. Recently, thanks to fast-classifier and shortcut-fe modules the router got a second life 🙂 To my surprise after loading fast-classifier modules it can be able to pass 500Mb/s over NAT, which is absolutely great result 🙂

But after that I noticed that my site-to-site IPsec tunnel, based on Strongswan stopped working properly… Ping was working, tcp connections over tunnel could be established, but after passing some tcp packets the connection freezes. I suspected a problem with MTU, but that was not it.
After unload kmod-fast-classifier and kmod-shortcut-fe tunnel was working properly. I’m started to reading source code of fast-classifier and shortcut-fe modules. I found that:

I realized that the offloading which is doing by fast-classifier and shortcut-fe is basing on conntrack table. The next thought was that conntrack is needed to realize NAT. Only connection between my LAN and internet (WAN) should be tracked and should be in conntrack table. I don’t need to track connection beetween my local nets connected through site-to-site vpn! Connections between my local nets can be realized only based on routing table. I decided to disable conntrack for my local nets and see if it solved my problem.
My network looks as follows:

Strongswan configuration: /etc/ipsec.conf (

Strongswan configuration: /etc/ipsec.conf (

File with secrets is the same on booth sides. /etc/ipsec.secrets

Excluding particular connections from conntrack can be done by iptables with raw and conntrack module – I had to install them earlier.

I excluded whole local network class – 192.168.0/0/12

Now my IPsec tunnel started passing traffic properly! 🙂 And there is no connections from my localnets in conntrack! (so fast-classifier not offloading this connections).
The only issue was that I was unable to connect to LEDE router ( from my remote network behind IPsec tunnel. I resolved that by exclude IP of router from iptables rule:

I had to install iprange module before:

Now I can enjoy very fast internet connection with fast-classifier and fully working strongswan IPsec vpn connections 🙂