<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.0.10">
</HEAD>
<BODY>
THXs,<BR>
<BR>
the solution below:<BR>
<BR>
wen viewing the results from "ip route show" the problem was clear for me.<BR>
<BR>
-------------------------------------<BR>
>From the Right server:<BR>
10.20.0.0/16 dev ipsec0 scope link src 192.168.200.100<BR>
<BR>
In the Left Server<BR>
10.210.21.0/24 dev ipsec0 scope link src 200.178.78.2<BR>
--------------------------------------<BR>
<BR>
Then I tried:<BR>
-----------------------------<BR>
In the Right Server<BR>
ip route change 10.20.0.0/16 dev ipsec0 scope link src 10.210.21.1<BR>
<BR>
In the Left Server<BR>
ip route change 10.210.21.0/24 dev ipsec0 scope link src 10.20.10.60<BR>
---------------------------<BR>
<BR>
YEHH!!!!! WORKED!!! Now every packet out from the eth0 even packets of the own server are encrypted.<BR>
<BR>
Then I tried the "rightsourceip" and "leftsourceip". But the "rightsourceip" must be the INTERNAL ip of the Right Server, and the "leftsourceip" must be the INTERNAL ip of the Left Server. INIT 6 in all servers and everything went right with only one tunnel.<BR>
<BR>
Thanks!<BR>
<BR>
Em Qua, 2007-02-07 às 12:17, Paul Wouters escreveu:
<BLOCKQUOTE TYPE=CITE>
<PRE><FONT COLOR="#737373"><I>On Wed, 7 Feb 2007, Augusto Pizarro wrote:
> Server Left
> Server Left Network
> 10.210.21.0------10.210.21.1/192.168.200.100
> ---(internet)---200.178.78.1/10.20.10.60-----10.20.0.0
> eth1
> eth0 eth0 eth1
> RESUMING: The Right clients are OK bur the Right server itself DONT!!!
> Really stupid!!
Try using leftsourceip=
> In the IPTRAF I can see "ICMP dest unrch from 10.210.21.1 to
> 10.210.21.1 on lo" in the Right Server wen trying to ping the Left
> Server.
I am not sure how you can not reach 10.210.21.1 from 10.210.21.1. If
your logs show some error with the "ip route add" command, you might
need to explicitely set a leftnexthop= value.
> Maybe I have to create another tunnel just for the traffic from the
> server to the Left Network.
If you specify leftsourceip/rightsourceip, that is not needed. Else
you are correct, and would need to add a host-net, net-host, and host-host
tunnel.
Paul</I></FONT></PRE>
</BLOCKQUOTE>
<PRE><TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
<BR>
</TD>
</TR>
</TABLE>
</PRE>
</BODY>
</HTML>