<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
UP ! :-)<br>
I really need some help please.<br>
<br>
I read NATed network can cause problems with openswan ?<br>
I'm NATed, how can i setup openswan with two nated subnet ?<br>
<br>
<br>
<br>
I repeat my typo :<br>
<br>
<br>
*ROUTER* : have 2 ADDRESS : Public adress and private adress. <br>
They both redirects ports and protocols to OPENSWAN boxes.<br>
<br>
*OPENSWAN BOXES* got 2 network cards with ip.forwarding activate.<br>
<br>
*GRAPH :*<br>
<br>
LEFT LAN (10.1.12.0/24) <--> (10.1.12.222)<-OPENSWAN
BOX->(10.1.11.39) <-> (10.1.11.21)-ROUTER-(193.x.x.x)
----INTERNET---- (217.x.x.x)-ROUTER-(192.168.10.1) <->
(192.168.10.55)-OPENSWAN BOX-(192.168.12.222) <-> RIGHT LAN
(192.168.12.0/24)<br>
<br>
<br>
<br>
LOGS :<br>
Jun 15 15:57:07 vpnagence pluto[7719]: loading secrets from
"/etc/ipsec.secrets"<br>
Jun 15 15:57:09 vpnagence pluto[7719]: packet from 217.x.x.x:500:
received Vendor ID payload [Openswan (this version) 2.4.4 X.509-1.5.4
PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR]<br>
Jun 15 15:57:09 vpnagence pluto[7719]: packet from 217.x.x.x:500:
received Vendor ID payload [Dead Peer Detection]<br>
Jun 15 15:57:09 vpnagence pluto[7719]: packet from 217.x.x.x:500:
received Vendor ID payload [RFC 3947] method set to=109<br>
Jun 15 15:57:09 vpnagence pluto[7719]: packet from 217.x.x.x:500:
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108,
but already using method 109<br>
Jun 15 15:57:09 vpnagence pluto[7719]: packet from 217.x.x.x:500:
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107,
but already using method 109<br>
Jun 15 15:57:09 vpnagence pluto[7719]: packet from 217.x.x.x:500:
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]<br>
Jun 15 15:57:09 vpnagence pluto[7719]: packet from 217.x.x.x:500:
initial Main Mode message received on 10.1.11.39:500 but no connection
has been authorized<br>
<br>
<br>
Please help me, i turn around... and this VPN make me craaaaaazy it
makes me craaaaazzyyyyy... ;-)<br>
<br>
Thx in advance<br>
Best regards.<br>
<br>
Julien GROSJEAN - Proxiad a écrit :
<blockquote cite="mid46715164.9000209@proxiad.com" type="cite">
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
<br>
Hello :-)<br>
Alex a écrit :
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com"
type="cite">
<pre wrap="">On Wednesday 13 June 2007 18:58, Julien GROSJEAN - Proxiad wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hello,
</pre>
</blockquote>
<pre wrap=""><!---->
Man, i told you that i just installed openswan yesterday. I have no experience
with this new implementation, but... anyway, read my commnets inline:
First: why are not using my config files on your machines? Just change IP
addresses according to your network design.
</pre>
</blockquote>
Because i wrote you a private mail ;-)<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com"
type="cite">
<pre wrap=""> </pre>
<blockquote type="cite">
<pre wrap="">version 2.0 # conforms to second version of ipsec.conf specification
# basic configuration
config setup
nat_traversal=yes
</pre>
</blockquote>
<pre wrap=""><!---->is ok here
</pre>
<blockquote type="cite">
<pre wrap=""> interfaces="ipsec0=eth1"
</pre>
</blockquote>
<pre wrap=""><!---->are you using KLIPS? If no, remove this line. NETKEY does not use it anymore!
</pre>
</blockquote>
No don't use... i remove this line...<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap="">conn net-to-net
type=tunnel
</pre>
</blockquote>
<pre wrap=""><!---->don't need this line. Tunel is default type!
</pre>
</blockquote>
Done.<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap=""> authby=secret
left=10.1.11.39
</pre>
</blockquote>
<pre wrap=""><!---->WOW. Here could be a problem. Here should come your IP address from external
interface of your left router!
</pre>
</blockquote>
If i put my private ip of my router, when i restart ipsec service, i
get this error :<br>
<br>
[root@vpnleft~]# ipsec auto --up net-to-net<br>
022 "net-to-net": We cannot identify ourselves with either end of this
connection.<br>
<br>
IPSEC wait for the local IP of my VPN box, which is 10.1.11.39 fot the
left side... :-|<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap=""> leftsubnet=10.1.11.0/24
</pre>
</blockquote>
<pre wrap=""><!---->WOW: here is smoething wrong. should come your network class behind the router
(connected from your second interface - internal interface of your router)
</pre>
</blockquote>
My left router is 10.1.11.21 private ip and 193.x.x.x public ip<br>
All my stations are in 10.1.11.x /24 ... so i should put 10.1.11.0/24
in leftsubnet no ?<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap=""> leftnexthop=10.1.11.21
</pre>
</blockquote>
<pre wrap=""><!---->assuming that left=10.1.11.39 is ok, here may be ok. </pre>
</blockquote>
That's the ip adress of the local interface of the vpn box<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com"
type="cite">
<pre wrap="">Here you should put the
addres of your next connected device (in general your gateway IP address from
your left router), so, should be something from the same class with your
external IP address of your router.</pre>
</blockquote>
You wrote : "external ip of my router" ? my external ip is my ISP
adress... 193.x.x.x my public adress.<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com"
type="cite">
<pre wrap=""> To be sure, you can replace with:
leftnexthop=%defaultroute
</pre>
<blockquote type="cite">
<pre wrap=""> right=217.x.x.xx
</pre>
</blockquote>
<pre wrap=""><!---->here is ok
</pre>
<blockquote type="cite">
<pre wrap=""> rightsubnet=192.168.10.0/24
</pre>
</blockquote>
<pre wrap=""><!---->ok too. Also add here:
rightnexthop=%defaultroute
</pre>
<blockquote type="cite">
<pre wrap=""> keyexchange=ike
</pre>
</blockquote>
<pre wrap=""><!---->add here: auth=esp
</pre>
<blockquote type="cite">
<pre wrap=""> esp=3des-md5
</pre>
</blockquote>
<pre wrap=""><!---->replace with:
esp=3des-md5-96
also add:
keylife=8h
pfs=no
</pre>
<blockquote type="cite">
<pre wrap=""> auto=add
</pre>
</blockquote>
<pre wrap=""><!---->No, forget about add (i know that add is writed in howto, but forget about)...
put here:
auto=start
</pre>
<blockquote type="cite">
<pre wrap="">#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf
</pre>
</blockquote>
<pre wrap=""><!---->
rest of crap deleted!
and now, start ipsec on booth sides: service ipsec start ...
Also, be sure that you are not firewalled on the left/right side and ESP
traffic can pass your firewall rules!
</pre>
</blockquote>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com"
type="cite">
<pre wrap="">That's all.
</pre>
</blockquote>
All the rest is ok ;-)<br>
<blockquote cite="mid200706132154.58767.rluglinux@gmail.com"
type="cite">
<pre wrap="">Regards,
Alx
</pre>
</blockquote>
Thanks<br>
<br>
<pre wrap="">_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@openswan.org">Users@openswan.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
</body>
</html>