<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-15"
http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#333399">
<br>
<blockquote cite="mid1154703091.5592.84.camel@tahini.andynet.net"
type="cite">
<pre wrap="">On Fri, 2006-08-04 at 15:01 +0100, Matthew Claridge wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi,
Never tried to do things this way, so I don't really know if this is
feasible/easy/possible etc.....
If, for example, we had a firewall with 2 network segments (DMZs) -
DMZ1 contains an OpenSwan IPSec device with external IP a.a.a.a and
private IP b.b.b.b
DMZ2 contains another network segment using IP addresses of c.c.c.0/24
Can the VPN in DMZ1 be set up to allow traffic to/from DMZ2? I would
normally do this by having the VPN inside DMZ2, but we are thinking of
changing our infrastructure so I'm wondering what options there are...
</pre>
</blockquote>
<pre wrap=""><!---->
Not sure I really understand what you're asking. But I think the answer
is yes - in general if you can route packets between 2 places, you can
put an IPsec tunnel between them. If you have firewalls in the path, you
need them to permit and forward your IPsec traffic (protocol 50) and
ISAKMP (udp port 500, and 4500 if your firewall does NAT).
</pre>
</blockquote>
Except that I want to terminate the tunnel in DMZ1, but have DMZ2 (on
the other side of a firewall) accessible by the remote end. I guess
maybe I could NAT some addresses from DMZ2 into the DMZ1 network
range.....<br>
<blockquote cite="mid1154703091.5592.84.camel@tahini.andynet.net"
type="cite">
<blockquote type="cite">
<pre wrap="">cheers
Matt
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a class="moz-txt-link-freetext"
href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext"
href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
<pre wrap=""><!---->
_____________________________________________________________________
This e-mail has been scanned for viruses by Verizon Business Internet Managed Scanning Services - powered by MessageLabs. For further information visit <a
class="moz-txt-link-freetext" href="http://www.mci.com">http://www.mci.com</a>
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<font size="-1">Matthew Claridge<br>
Product Support Engineer<br>
RWA Limited
</font>
<p><font size="-1">Tel: 02920 815 054<br>
Email: <a class="moz-txt-link-abbreviated"
href="mailto:mclaridge@rwa-net.co.uk">mclaridge@rwa-net.co.uk</a><br>
Web: <a class="moz-txt-link-abbreviated"
href="http://www.rwa-net.co.uk">www.rwa-net.co.uk</a></font></p>
</div>
</body>
</html>