<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
<font size="-1"><font face="Arial">I am trying this setup and am
curious to see if it is allowed.<br>
<br>
VPN server:<br>
2.6.22.9-61.fc6<br>
Linux Openswan U2.4.5/K2.6.22.9-61.fc6 (netkey)<br>
</font></font><small><font face="Arial">1 WAN NIC, 2 LAN NICs on
separate subnets<br>
eth0 = WAN<br>
eth1 = 10.243.102.230<br>
eth2 = 10.241.100.230<br>
<br>
I want to create a VPN connection between the 2 subnets using this
machine.<br>
<br>
conn ggh-gghdev<br>
# Left Security gateway, subnet behind it, next hop toward right<br>
left=WAN IP<br>
leftsubnet=10.241.0.0/16<br>
leftnexthop=WAN GATEWAY<br>
# Right Security gateway, subnet behind it, next hop towards
left<br>
right=WAN IP<br>
rightsubnet=10.243.0.0/16<br>
rightnexthop=WAN GATEWAY<br>
keyingtries=0<br>
authby=secret<br>
type=tunnel<br>
auto=start<br>
<br>
[root@vpn sysconfig]# ipsec auto --status | grep ggh-gghdev<br>
000 "ggh-gghdev":
10.243.0.0/16===216.191.52.91---216.191.52.65...216.191.52.65---216.191.52.91===10.241.0.0/16;
unrouted; eroute owner: #0<br>
000 "ggh-gghdev": srcip=unset; dstip=unset; srcup=ipsec _updown;
dstup=ipsec _updown;<br>
000 "ggh-gghdev": ike_life: 3600s; ipsec_life: 28800s; rekey_margin:
540s; rekey_fuzz: 100%; keyingtries: 0<br>
000 "ggh-gghdev": policy: PSK+ENCRYPT+TUNNEL+PFS; prio: 16,16;
interface: ;<br>
000 "ggh-gghdev": newest ISAKMP SA: #0; newest IPsec SA: #0;<br>
<br>
NATing part of /etc/sysconfig/iptables:<br>
*nat<br>
:PREROUTING ACCEPT [0:0]<br>
:POSTROUTING ACCEPT [0:0]<br>
:OUTPUT ACCEPT [0:0]<br>
-A POSTROUTING -d ! 10.0.0.0/255.0.0.0 -o eth0 -j MASQUERADE<br>
COMMIT</font></small><br>
<small><font face="Arial"><br>
Now, before I spend too much time troubleshooting this, is the above
scenario possible/doable ? The VPN connection spans the same machine
as both left and right albeit between different subnets.<br>
</font></small>
<pre class="moz-signature" cols="72">--
Regards,
Arjun Datta</pre>
</body>
</html>