<p>Dear,</p>
<p>I'm failed to make vpn subnet to subnet even though I tried it for couple of weeks.</p>
<p>I've found all of packets in ipsec0 getting dropped when I ping from <a href="http://192.168.10.117">192.168.10.117</a> to client at opposite subnet</p>
<p>my vpn diagram<br><a href="http://192.168.10.0/24">192.168.10.0/24</a> ---- [eth1 a.b.c.d eth0] ==== internet ==== [eth0 x.y.w.z eth1] ----- <a href="http://192.168.15.0/24">192.168.15.0/24</a></p>
<p>a.b.c.d gateway</p>
<p>/etc/ipsec.conf<br>conn L5<br> left=a.b.c.d<br> leftnexthop=<a href="http://61.10.102.1">61.10.102.1</a><br> leftsubnet=<a href="http://192.168.10.0/24">192.168.10.0/24</a><br> leftid=a.b.c.d<br> leftcert=wahj.crt<br>
right=x.y.w.z<br> rightnexthop=<a href="http://61.10.64.1">61.10.64.1</a><br> rightsubnet=<a href="http://192.168.15.0/24">192.168.15.0/24</a><br> rightid=x.y.w.z<br> rightcert=hwwong.crt</p>
<p>/etc/init.d/iptables<br> echo 0 > /proc/sys/net/ipv4/conf/ipsec0/rp_filter<br> echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter<br> iptables -A POSTROUTING -t nat -o eth0 -d \! <a href="http://192.168.15.0/24">192.168.15.0/24
</a> -j MASQUERADE</p>
<p><br>x.y.w.z gateway</p>
<p>/etc/ipsec.conf<br>conn L5<br> left=a.b.c.d<br> leftnexthop=<a href="http://61.10.102.1">61.10.102.1</a><br> leftsubnet=<a href="http://192.168.10.0/24">192.168.10.0/24</a><br> leftid=a.b.c.d<br> leftcert=wahj.crt<br>
right=x.y.w.z<br> rightnexthop=<a href="http://61.10.64.1">61.10.64.1</a><br> rightsubnet=<a href="http://192.168.15.0/24">192.168.15.0/24</a><br> rightid=x.y.w.z<br> rightcert=hwwong.crt</p>
<p>/etc/init.d/iptables<br> echo 0 > /proc/sys/net/ipv4/conf/ipsec0/rp_filter<br> echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter<br> iptables -A POSTROUTING -t nat -o eth0 -d \! <a href="http://192.168.10.0/24">192.168.10.0/24
</a> -j MASQUERADE</p>
<p>ipsec auto --up L5 --> IPsec SA established<br>ipsec verify --> everything are ok</p>
<p>ipsec auto --status<br>"L5": <a href="http://192.168.10.0/24===a.b.c.d:17/1701---61.10.102.1...61.10.64.1---x.y.w.z:17/1701===192.168.15.0/24">192.168.10.0/24===a.b.c.d:17/1701---61.10.102.1...61.10.64.1---x.y.w.z:17/1701===192.168.15.0/24
</a><br>"L5": ike_life: 1800s; ipsec_life: 1800s; rekey_margin: 1200s; rekey_fuzz: 25%; keyingtries: 3<br>"L5": policy: RSASIG+ENCRYPT+COMPRESS+TUNNEL; interface: eth0; unrouted</p>
<p>netstat -rn<br>Kernel IP routing table<br>Destination Gateway Genmask Flags MSS Window irtt Iface<br>x.y.w.z <a href="http://61.10.102.1">61.10.102.1</a> <a href="http://255.255.255.255">
255.255.255.255</a> UGH 0 0 0 ipsec0<br><a href="http://192.168.0.0">192.168.0.0</a> <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://255.255.255.0">255.255.255.0</a> U 0 0 0 eth1
<br><a href="http://192.168.15.0">192.168.15.0</a> <a href="http://61.10.102.1">61.10.102.1</a> <a href="http://255.255.255.0">255.255.255.0</a> UG 0 0 0 ipsec0<br><a href="http://192.168.10.0">192.168.10.0
</a> <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://255.255.255.0">255.255.255.0</a> U 0 0 0 eth1<br><a href="http://61.10.102.0">61.10.102.0</a> <a href="http://0.0.0.0">0.0.0.0</a>
<a href="http://255.255.254.0">255.255.254.0</a> U 0 0 0 eth0<br><a href="http://61.10.102.0">61.10.102.0</a> <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://255.255.254.0">255.255.254.0
</a> U 0 0 0 ipsec0<br><a href="http://127.0.0.0">127.0.0.0</a> <a href="http://0.0.0.0">0.0.0.0</a> <a href="http://255.0.0.0">255.0.0.0</a> U 0 0 0 lo<br><a href="http://0.0.0.0">
0.0.0.0</a> <a href="http://61.10.102.1">61.10.102.1</a> <a href="http://0.0.0.0">0.0.0.0</a> UG 0 0 0 eth0</p>
<p>tcpdump -n -i ipsec0 -vv<br>tcpdump: listening on ipsec0<br>18:36:09.377051 <a href="http://192.168.10.117">192.168.10.117</a> > <a href="http://192.168.15.1">192.168.15.1</a>: icmp: echo request (ttl 31, id 10446, len 60)
</p>
<p>ifconfig ipsec0<br>ipsec0 Link encap:Ethernet HWaddr 00:50:FC:3A:17:5C <br> inet addr:a.b.c.d Mask:<a href="http://255.255.254.0">255.255.254.0</a><br> UP RUNNING NOARP MTU:16260 Metric:1<br>
RX packets:0 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:0 errors:0 dropped:48 overruns:0 carrier:0<br> collisions:0 txqueuelen:10 </p>
<p><br>Kind regards,<br>Steve Jong</p>