<br><br>---------- Forwarded message ----------<br><span class="gmail_quote">From: <b class="gmail_sendername">Can Akalin</b> <<a href="mailto:canakalin77@gmail.com">canakalin77@gmail.com</a>><br>Date: May 12, 2006 2:52 PM
<br>Subject: Re: [Openswan Users] Linux to Linux VPconnection<br>To: Paul Wouters <<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>><br><br></span><div>Hello,<br>
<br>
I am sorry if I am asking really simple or stupid questions but can
anybody answer my questions regarding right, left, rightsubnet,
leftsubnet of conn roadwarrior configurations at both side of a VPN
connection? My questions can be found below.<br>
<br>
I've been trying to find the answers of these questions by googling around but so far I couldn't get the asnwers.<br>
<br>
<br>
Thank you for your help.</div><div><span class="e" id="q_10b29f128696e496_1"><br>
<br><br><div><span class="gmail_quote">On 5/12/06, <b class="gmail_sendername">Can Akalin</b> <<a href="mailto:canakalin77@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">canakalin77@gmail.com
</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>Hello Paul,<br>
<br>
Thank you for your time and help. :)<br>
<br>
In my network, here is what I have;</div><div><span><br>
<br>
VPN Gateway (<a href="http://10.10.10.10/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.10.10" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.10.10</a>)<------------> (<a href="http://10.10.10.1/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.10.1" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
10.10.10.1</a>)Router
(<a href="http://192.168.1.203/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.203" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.203</a>)<--------------------> (<a href="http://192.168.1.109/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.109" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.109</a>)Remote
Machine<br>
<br></span></div><div>
So from this perspective,<br>
<br>
1- At VPN Gateway, which network is considered as the leftsubnet of conn roadwarrior-net?<br>
2-At VPN Gateway, which network is consideredas the righ and left of conn road warrior?<br>
3-At Remote Machine, which network is considered as the leftsubnet of conn roadwarrior-net?<br>
4-At Remote Machine, which network is considered as the left and right of conn roadwarrior?<br>
<br>
<br>
Thank you.</div><div><span><br>
<br>
<br><br><div><span class="gmail_quote">On 5/11/06, <b class="gmail_sendername">Paul Wouters</b> <<a href="mailto:paul@xelerance.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">paul@xelerance.com
</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Thu, 11 May 2006, Can Akalin wrote:<br><br>> I have a local VPN gateway that is a Suse Linux SLES kernel 2.6.5 and is<br>> behind a router. It has openswan v.2.4.5 installed and It's IP address is<br>> <a href="http://10.10.10.10/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.10.10" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
10.10.10.10/24</a><br><br>kernel 2.6.5 is really old, and likely will not work well with NETKEY unless<br>Suse backported things.<br><br>> nat_traversal=yes<br>> virtual_private=%v4:<a href="http://10.0.0.0/8,$v4:172.16.0.0/12,%25v4:192.168.0.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.0.0.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
10.0.0.0/8,$v4:172.16.0.0/12,%v4:192.168.0.0/24</a><br><br>> conn roadwarrior-net<br>> leftsubnet=<a href="http://10.10.10.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.10.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.10.0/24
</a><br><br>You can never specify a leftsubnet without excluding it from virtual_private.
<br>An address can only live on one end (eg either it on your server's subnet, or<br>it can be used by a NAT router on the client, but not both)<br><br>> also=roadwarrior<br>><br>> conn roadwarrior<br>> left=%defaultroute
<br>> rightcert=gate.example.com.pem<br>> right=%any<br><br>You cannot use both %defaultroute and %any. Specify the IP address of left=<br><br>> rightsubnet=vhost:%no,%priv<br>> auto=add
<br>> pfs=yes<br>> rekey=no<br><br>> conn roadwarrior-net<br>> leftsubnet=<a href="http://10.10.10.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.10.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.10.0/24
</a><br>> also=roadwarrior<br>><br>> conn roadwarrior<br>
> left=<a href="http://192.168.1.203" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.203" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.203</a><br>> leftcert=gate.example.com.pem<br>> right=%defaultroute<br>
> rightcert=lin.example.com.pem<br>> auto=add<br>> pfs=yes
<br><br>> One extra question is that I am so confused with the left, right,<br>> leftsubnet, rightsubnet, leftcert, rightcert of roadwarrior section of the<br>> ipsec.conf files. which left is which and whose's right is other's right?
<br>> Especially the rightcert and leftcert of the ipsec.conf files are so<br>> confusing? Can anybody explain me this to me clearly or send me a link to<br>> read. I did a google search on this for a couple of hours but couldn't find
<br>> a clue.<br><br>You can pick either left or right for any end of the IPsec connection. It's up<br>to you which end you call left or right. And you can make it different on both<br>sides if you want. Traditionally people use left for Local and right for Remote.
<br><br>Paul<br>--<br>Building and integrating Virtual Private Networks with Openswan:<br><a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155
</a><br></blockquote></div><br><br clear="all"><br></span></div><div>-- <br></div><div><span>Can Akalin
</span></div></blockquote></div><br><br clear="all"><br></span></div><div>-- <br></div><div><span class="sg">Can Akalin
</span></div><br clear="all"><br>-- <br>Can Akalin