<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:courier,monaco,monospace,sans-serif;font-size:12pt"><div>Here's my setup:
<br>
<br>
<br>Servers with static public IPs <------> main router (static IP)<br> A A<br> | |<br> | V<br>
+---> Linksys Router (static IP) <--> Internet<br> A<br> |<br>Branch A <--> Linksys Router (static IP) <----+<br> |<br>
Branch B <--> Linksys Router (static IP) <----+<br>
|<br>
Roadwarrior (gets dynamic public IP) <--------+<br><br><br>All linksys routers connect the local subnets behind them via to the servers via VPN.<br>The linksys in the servers subnet is for VPN traffic.<br><br>The roadwarrior is a PC with Ubuntu 7.10 with OpenSWAN 2.4.8 installed. It uses PPP<br>to gain Internet access using a GPRS/HSDPA modem.<br><br>The roadwarrior can connect and establish a tunnel with the servers' Linksys router<br>(it's an RV042). But no traffic seems to go through the tunnel. It behaves the<br>same whether the firewall is up or down.<br><br>Pinging a servers behind the Linksys router gives me 'TTL exceed' errors, which<br>
makes me suspect the traffic is not going through the tunnel.<br>
<br>
I hope somebody can tell me what I'm missing.<br><br>Below are some, hopefully, pertinent data. I've replaced static IP addresses with <br>bogus ones.<br><br>Regards.<br><br><br>--- mike t.<br><br><br><br>Here's my ipsec.conf:<br>---BEGIN<br><br># /etc/ipsec.conf - Openswan IPsec configuration file<br># RCSID $Id: ipsec.conf.in,v 1.15.2.4 2006/07/11 16:17:53 paul Exp $<br><br># This file: /usr/share/doc/openswan/ipsec.conf-sample<br>#<br># Manual: ipsec.conf.5<br><br><br>version 2.0 # conforms to second version of ipsec.conf specification<br><br># basic configuration<br>config setup<br> interfaces=%defaultroute<br> # plutodebug / klipsdebug = "all", "none" or a combation from below:<br> # "raw crypt parsing emitting control klips pfkey natt x509
private"<br> # eg:<br> # plutodebug="control parsing"<br> plutodebug="none"<br> klipsdebug="none"<br> #<br> # Only enable klipsdebug=all if you are a developer<br> #<br> # NAT-TRAVERSAL support, see README.NAT-Traversal<br> # nat_traversal=yes<br> # virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12<br> #<br> # enable this if you see "failed to find any available worker"<br> nhelpers=1<br><br># Add
connections here<br><br># We keep with tradition - left = local, right = remote<br><br>conn office<br> #<br> left=%defaultroute<br> leftid=@roadie<br> leftsubnet=192.168.45.0/24<br> #leftnexthop=%defaultroute<br> #<br> right=111.111.111.111<br> rightsubnet=222.222.222.0/24<br> #<br> keyexchange=ike<br> ikelifetime=480m<br> keylife=60m<br> pfs=yes<br>
compress=no<br> authby=secret<br> auto=start<br> aggrmode=yes<br> ike=3des-md5-modp1536<br> esp=3des-md5<br> pfsgroup=modp1536<br><br># sample VPN connections, see /etc/ipsec.d/examples/<br><br>#Disable Opportunistic Encryption<br>include /etc/ipsec.d/examples/no_oe.conf<br><br><br>
---END<br><br>Here's the output of route -n after the tunnel has been established:<br>---BEGIN<br><br>Kernel IP routing table<br>Destination Gateway Genmask Flags Metric Ref Use Iface<br>10.64.64.64 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0<br>192.168.45.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0<br>222.222.222.0 0.0.0.0 255.255.255.0 U 0
0 0 ppp0<br>169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eth0<br>0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 ppp0<br><br>---END<br><br><br>ifconfig's (at roadwarrior's end) output:<br>---BEGIN<br><br>eth0 Link encap:Ethernet HWaddr 00:19:DB:83:C9:15<br> inet addr:192.168.45.20 Bcast:192.168.45.255 Mask:255.255.255.0<br> UP BROADCAST RUNNING MULTICAST
MTU:1500 Metric:1<br> RX packets:0 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:1000<br> RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)<br> Interrupt:18 Base address:0xe400<br><br>lo Link encap:Local Loopback<br> inet addr:127.0.0.1 Mask:255.0.0.0<br> UP LOOPBACK RUNNING MTU:16436 Metric:1<br> RX packets:0 errors:0 dropped:0 overruns:0
frame:0<br> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:0<br> RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)<br><br>ppp0 Link encap:Point-to-Point Protocol<br> inet addr:122.52.36.27 P-t-P:10.64.64.64 Mask:255.255.255.255<br> UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1272 Metric:1<br> RX packets:99961 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:79733 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0
txqueuelen:3<br> RX bytes:109641293 (104.5 MB) TX bytes:6484561 (6.1 MB)<br><br>---END<br><br><br>and the output of setkey -DP (also at roadwarrior's end):<br>---BEGIN<br><br>222.222.222.0/24[any] 192.168.45.0/24[any] any<br> in ipsec<br> esp/tunnel/111.111.111.111-122.52.36.27/unique#16385<br> created: Dec 5 09:54:32 2007 lastused:<br> lifetime: 0(s) validtime: 0(s)<br> spid=112 seq=1 pid=10457<br> refcnt=1<br>192.168.45.0/24[any] 222.222.222.0/24[any] any<br> out ipsec<br>
esp/tunnel/122.52.36.27-111.111.111.111/unique#16385<br> created: Dec 5 09:54:32 2007 lastused:<br> lifetime: 0(s) validtime: 0(s)<br> spid=105 seq=2 pid=10457<br> refcnt=1<br>222.222.222.0/24[any] 192.168.45.0/24[any] any<br> fwd ipsec<br> esp/tunnel/111.111.111.111-122.52.36.27/unique#16385<br> created: Dec 5 09:54:32 2007 lastused:<br> lifetime: 0(s) validtime: 0(s)<br> spid=122 seq=3 pid=10457<br> refcnt=1<br>(per-socket policy)<br> in
none<br> created: Dec 5 09:54:29 2007 lastused:<br> lifetime: 0(s) validtime: 0(s)<br> spid=91 seq=4 pid=10457<br> refcnt=1<br>(per-socket policy)<br> in none<br> created: Dec 5 09:54:29 2007 lastused:<br> lifetime: 0(s) validtime: 0(s)<br> spid=75 seq=5 pid=10457<br> refcnt=1<br>(per-socket policy)<br> in none<br> created: Dec 5 09:54:29 2007 lastused: Dec 5 10:18:24 2007<br> lifetime: 0(s) validtime:
0(s)<br> spid=59 seq=6 pid=10457<br> refcnt=1<br>(per-socket policy)<br> out none<br> created: Dec 5 09:54:29 2007 lastused:<br> lifetime: 0(s) validtime: 0(s)<br> spid=100 seq=7 pid=10457<br> refcnt=1<br>(per-socket policy)<br> out none<br> created: Dec 5 09:54:29 2007 lastused:<br> lifetime: 0(s) validtime: 0(s)<br> spid=84 seq=8 pid=10457<br> refcnt=1<br>(per-socket policy)<br> out
none<br> created: Dec 5 09:54:29 2007 lastused: Dec 5 10:18:24 2007<br> lifetime: 0(s) validtime: 0(s)<br> spid=68 seq=0 pid=10457<br> refcnt=1<br><br>---END<br><br><br><br></div></div></body></html>