<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Hi There federico,<br>
<br>
I am using multiple ADSLs and fix my ipsec down the 2nd line and
balance the two lines together for all other traffic.<br>
<br>
Basically, the problem can be split apart, one is that of load
balancing the ADSLs the other is that of ipsec config.<br>
<br>
1)I did the following, my two ADSL lines each have a Zyxel router on
them so I created two routing tables called Zyxel1 and Zyxel2.<br>
<br>
2)I took all the default gateway entries out of /etc/sysconfig/network
and all the gateway setting from each of the ifconfig files [ifcfg-ethn]<br>
<br>
3)I creating a complete set of routing tables and balanced the two
lines (the "equalize" parameter at the end of this script does this for
you, the "weight" option controls the priority of packets down each
line so you can balance lines of different speeds the adsl lines are
xxx.yyy.62.80/28 and xxx.yyy.62.96/28, the routers are at xxx.yyy.62.81
and 97 respectively, I run this script in /etc/rc.d/rc.local at boot
time:<br>
<blockquote type="cite"><font face="Courier New, Courier, monospace">#!/bin/sh<br>
#<br>
echo 200 Zyxel1 >> /etc/iproute2/rt_tables<br>
echo 201 Zyxel2 >> /etc/iproute2/rt_tables<br>
ip route add xxx.yyy.62.80/28 dev eth0 table Zyxel1<br>
ip route add default via xxx.yyy.62.81 table Zyxel1<br>
ip route add xxx.yyy.62.96/28 dev eth2 table Zyxel2<br>
ip route add default via xxx.yyy.62.97 table Zyxel2<br>
route add -net 127.0.0.0/8 dev lo<br>
<br>
ip route add 127.0.0.0/8 dev lo table Zyxel2<br>
ip route add 127.0.0.0/8 dev lo table Zyxel1<br>
<br>
ip route add 10.200.8.0/24 dev eth1 table Zyxel2<br>
ip route add 10.200.8.0/24 dev eth1 table Zyxel1<br>
<br>
ip route add xxx.yyy.62.96/28 dev eth2 table Zyxel1<br>
ip route add xxx.yyy.62.80/28 dev eth0 table Zyxel2<br>
<br>
ip route add xxx.yyy.62.80/28 dev eth0 src xxx.yyy.62.82<br>
ip route add xxx.yyy.62.96/28 dev eth2 src xxx.yyy.62.98<br>
ip rule add from xxx.yyy.62.82 table Zyxel1<br>
ip rule add from xxx.yyy.62.98 table Zyxel2<br>
<br>
ip route add xxx.yyy.62.80/28 dev eth0 table Zyxel2<br>
<br>
ip route add xxx.yyy.62.96/28 dev eth2 table Zyxel1<br>
<br>
ip route add equalize default scope global nexthop via xxx.yyy.62.81
dev eth0 weight 1 nexthop via xxx.yyy.62.97 dev eth2 weight 1</font><br>
</blockquote>
4)Then I created an ipsec config as per normal fixing it to one ADSL
line as follows:<br>
<blockquote type="cite"><font face="Courier New, Courier, monospace">conn
newport-chip<br>
left=xxx.yyy.62.98<br>
leftnexthop=xxx.yyy.62.97<br>
leftsubnet=10.200.8.0/21<br>
right=xxx.yyy.62.2<br>
rightnexthop=xxx.yyy.62.1<br>
rightsubnet=10.200.0.0/21<br>
authby=secret<br>
pfs=no<br>
auto=add</font><br>
</blockquote>
<br>
<br>
it has a corresponding ipsec.secrets entry as well.<br>
<blockquote type="cite"><font face="Courier New, Courier, monospace">xxx.yyy.62.98
xxx.yyy.62.2 : PSK "mypassphrasehere"</font><br>
</blockquote>
<br>
<br>
5)After the routes script runs above I start the ipsec services and
bring up the tunnel, which is then tied to the 2nd ADSL line<br>
Left nexthop points to the ADSL router at the load balanced twin dsl
end (this end which runs the routing script above)<br>
right nexthop points to the SDSL router at the remote site which is
outside of the load balancing stuff at xxx.yyy.62.1<br>
<br>
I hope this helps!<br>
<br>
Pete<br>
<br>
<br>
<br>
<br>
Federico wrote:
<blockquote cite="mid018901c68895$86aeb8e0$0564060a@multibel.it"
type="cite">
<pre wrap="">Hello,
I'm still fighting with the multiple dsl vpn problem. I search how to do,
and follow Openusers suggestions coming from my first post but I did not
manage to get out.
So I have better to re-explain my problem.
I got the following conf:
________
+------------+ /
| | ADSL |
+-------------+ Provider 1 +-------
__ | | GW1 | /
___/ \_ +------+-------+ +------------+ |
_/ \__ | eth1 | /
/ \ | | |
| Local network -----+eth0 VPN GW | | Internet
\_ __/ | | |
\__ __/ | eth2 | \
\___/ +------+-------+ +------------+ |
| | | \
+-------------+ Provider 2 +-------
| GW2 | HDSL |
+------------+ \________
On ADSL (Slow but Flat)I route all Internet (http, ftp, etc.) traffic.
On HDSL link (Fast but Leased Line) I want to use Openswan in L2tp/Ipsec
(=>Road Warrior => no static route applicable as in a IPSEC GW-GW conf!)
Obviously on VPN GW the default gw is GW1 (route add default gw GW1)
On the other hand I want to redirect the IPSEC (say generated in response of
connections initiated from any IP) to GW2 and hence it MUST born on eth2!!
I Thought it was possible to do that using the leftnexthop directive to let
ipsec packet born from eth2 and travel through GW only for ipsec traffic,
but I didn't manage to do this. VPN start correctly but only if I use GW2 as
default gw.
I read the ipsec.conf manual but perhaps I didn't understand the use of
leftnexthop directive.... Could anyone explain that better than
documentation?
And Could anyone suggest a solution for this kind of problem please?
Thank you in advance.
Best Regards
FV
</pre>
<blockquote type="cite">
<pre wrap="">-----Messaggio originale-----
Da: Radek Antoniuk [<a class="moz-txt-link-freetext" href="mailto:r.antoniuk@pixel.com.pl">mailto:r.antoniuk@pixel.com.pl</a>]
Inviato: venerdì 2 giugno 2006 16.35
A: Federico
Cc: <a class="moz-txt-link-abbreviated" href="mailto:users@openswan.org">users@openswan.org</a>
Oggetto: Re: R: R: [Openswan Users] VPN on Multiple DLS router
Federico wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Sorry, what do you mean? I already tried the following (as stated in my
first post):
ip rule add from $IP2 table T2
May be you are using a lan to lan VPN where my config is a road-warrior
VPN...
So x.yz is the address of your remote (right) vpn-gw... Am I wrong?
But I can't do that!!
I just would say: everything coming from the public IP of my HDSL-
</pre>
</blockquote>
<pre wrap="">interface
</pre>
<blockquote type="cite">
<pre wrap="">Go trough my hdsl GW...
But how?
Thank you for your patience!
FV
</pre>
</blockquote>
<pre wrap="">Maybe this will help.
ip rule add to your_public_ip_hdsl lookup table 100
ip r a default via your_hdsl_gw dev your_hdsl_dev table 100
</pre>
</blockquote>
<pre wrap=""><!---->Sorry, I come back to the office today...
I
_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n(3155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n(3155</a>
</pre>
</blockquote>
</body>
</html>