<div>Hello sir,</div>
<div>Thank you for reply ....Now the adsl modem is having four ethernet ports and one wireless .I have connected openswan gateway to one ethernet port...You have told to change the modem to pass the external public address to openswan gateway .Will you tell me how to pass the external address from modem to openswan gateway????</div>
<div> </div>
<div>Normally, which type of internet connection(adsl,leased line or any other..), the openswan can be deployed???? How you are using openswan through internet scenerio????</div>
<div> </div>
<div>Thanks in advance,</div>
<div>Regards,</div>
<div>Nirmala.<br><br> </div>
<div><span class="gmail_quote">On 7/2/08, <b class="gmail_sendername">Peter McGill</b> <<a href="mailto:petermcgill@goco.net">petermcgill@goco.net</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Nirmala,<br><br>Correct me if I'm wrong, but your scenario is this:<br>At each location you have a broadband internet router connected to the internet.<br>
This router is physically connected to your Openswan (Linux) gateway using the <a href="http://192.168.1.0/24">192.168.1.0/24</a><br>network which the router manages.<br>Then you connect the Openswan gateway to your internal LAN 192.169.x.x via another net card.<br>
(Note: 192.169.80/100.x are public internet addresses, unless they are assigned to you, you<br>shouldn't use them else you risk not being able to communicate with the real assigned computers.<br>perhaps you meant to use 192.168.80/100.x)<br>
<br>This means that both your Openswan gateways are natted before they reach the internet, this<br>is a double nat scenario and I do not think it possible to work.<br>If possible (modem connects only to Openswan gateway), then change the modem to pass the external<br>
public address through to the Openswan gateway rather than using the <a href="http://192.168.1.0/24">192.168.1.0/24</a> network.<br>Then Openswan gateway will have a public address of 59.90.235.x without nat, and this will work.<br>
<br>Note you should use something like this, don't set any other options unless you know what your doing.<br>Openswan has good secure defaults, unless your connecting to non-openswan you should not need to<br>change any encryption settings. Note the debug entries are removed also, they are for developer<br>
debugging not user troubleshooting and get in the way flooding your logs, only use if asked by a devel.<br><br>Don't use shared secrets unless necessary, use default rsa public keys instead.<br>As explained in doc/install.html and doc/config.html...<br>
On each machine do...<br>ipsec newhostkey --output /etc/ipsec.secrets --hostname `hostname -f`<br>chmod 0600 /etc/ipsec.secrets<br>ipsec showhostkey --left<br>Copy this output of the above command showhostkey to your ipsec.conf.<br>
<br>ipsec.conf (all indented lines are indented with single tab only not spaces):<br>version 2.0<br><br>config setup<br> interfaces="ipsec0=eth1" # assuming your using klips and eth1 is interface to internet<br>
<br>include /etc/ipsec.d/examples/no_oe.conf<br><br>conn testorig<br> left=<a href="http://59.90.235.34">59.90.235.34</a><br> leftsubnet=<a href="http://192.168.100.0/24">192.168.100.0/24</a><br> leftsourceip=<a href="http://192.168.100.1">192.168.100.1</a>? # lan address of openswan gateway<br>
# RSA nnnn bits <a href="http://hostname.example.net">hostname.example.net</a> ddd mmm dd hh:mm:ss yyyy<br> leftrsasigkey=0sAQNs...<br> right=<a href="http://59.90.235.36">59.90.235.36</a><br> rightsubnet=<a href="http://192.168.80.0/24">192.168.80.0/24</a><br>
rightsourceip=<a href="http://192.168.80.1">192.168.80.1</a>? # lan address of openswan gateway<br> # RSA nnnn bits <a href="http://hostname.example.net">hostname.example.net</a> ddd mmm dd hh:mm:ss yyyy<br>
rightrsasigkey=0sAQNs...<br> auto=start # add if you want to start/stop manualy, start for always on connections.<br><br>Peter McGill<br>IT Systems Analyst<br>Gra Ham Energy Limited<br><br>> -----Original Message-----<br>
> From: <a href="mailto:users-bounces@openswan.org">users-bounces@openswan.org</a><br>> [mailto:<a href="mailto:users-bounces@openswan.org">users-bounces@openswan.org</a>] On Behalf Of Nirmala Balu<br>> Sent: July 2, 2008 5:30 AM<br>
> To: <a href="mailto:users-request@openswan.org">users-request@openswan.org</a><br>> Cc: <a href="mailto:users@openswan.org">users@openswan.org</a><br>> Subject: [Openswan Users] how to connect openswan to<br>> broadband---full detail!!!<br>
><br>> My network diagram is shown below.<br>> openswan gateway1<----->modem1<----> internet <-------><br>> modem2<-------->openswan gateway2<br>> IP addresses:<br>><br>
> (1)openswan gateway1--192.168.1.102<br>> (2)modem 1 internal ip address----192.168.1.1<br>> (3)modem 1 external(static)ip address----59.90.235.34<br>> (4)modem 2 external(static)ip address----59.90.235.36<br>
> (5)modem 2 internal ip address----192.168.1.1<br>> (6)openswan gateway 2--192.168.1.2<br>><br>> My ipsec.conf and ipsec.conf is given below:<br>> IPSEC.CONF<br>> -------------------<br>
> version 2.0<br>> config setup<br>> interfaces="ipsec0=eth1"<br>> plutodebug=all<br>> klipsdebug=all<br>> uniqueids=yes<br>> conn testorig<br>
> left=<a href="http://192.168.1.102">192.168.1.102</a> <<a href="http://192.168.1.102/">http://192.168.1.102/</a>><br>> ike=aes128-sha-modp8192<br>> esp=aes256-sha1<br>><br>
> - Ignored:<br>> #leftsubnet=<a href="http://192.169.100.0/24">192.169.100.0/24</a><br>> leftnexthop=<a href="http://192.168.1.1">192.168.1.1</a> <<a href="http://192.168.1.1/">http://192.168.1.1/</a>><br>
> right=<a href="http://192.168.1.2">192.168.1.2</a> <<a href="http://192.168.1.2/">http://192.168.1.2/</a>><br>> #rightsubnet=<a href="http://192.169.80.0/24">192.169.80.0/24</a><br>> rightnexthop=<a href="http://192.168.1.1">192.168.1.1</a> <<a href="http://192.168.1.1/">http://192.168.1.1/</a>><br>
> authby=secret<br>> pfs=no<br>> ikelifetime=1h<br>> keylife=1d<br>> auto=ignore<br>> compress=no<br>> rekey=no<br>> failureshunt=passthrough<br>
> auth=esp<br>><br>> include /etc/ipsec.d/examples/no_oe<br>> .conf<br>><br>> IPSEC.SECRETS<br>> --------------------------<br>> <a href="http://192.168.1.102">192.168.1.102</a> <<a href="http://192.168.1.102/">http://192.168.1.102/</a>> <a href="http://192.168.1.2">192.168.1.2</a><br>
> <<a href="http://192.168.1.2/">http://192.168.1.2/</a>> : PSK "secret"<br>><br>> When i gave "up " command ,tunnel is not coming up.<br>><br>> [root@vpn1 ~]# ipsec auto --up testorig<br>
> 104 "testorig" #1: STATE_MAIN_I1: initiate<br>> 010 "testorig" #1: STATE_MAIN_I1: retransmission; will<br>> wait 20s for response<br>><br>> In barf message, it is giving following error:<br>
> "*ERROR: asynchronous network error report on eth1<br>> (sport=500) for message<br>> to <a href="http://192.168.1.2">192.168.1.2</a> <<a href="http://192.168.1.2/">http://192.168.1.2/</a>> port 500,<br>
> complainant <a href="http://192.168.1.102">192.168.1.102</a> <<a href="http://192.168.1.102/">http://192.168.1.102/</a>> : No route<br>> to host [errno<br>> 113, origin ICMP type 3 code 1 (not authenticated)]"*<br>
> ......<br>> .....<br>> Jul 2 19:45:25 vpn1 pluto[4038]: | inserting event<br>> EVENT_RETRANSMIT,<br>> timeout in 10 seconds for #1<br>> Jul 2 19:45:25 vpn1 pluto[4038]: | next event<br>
> EVENT_RETRANSMIT in 10<br>> seconds for #1<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | rejected packet:<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | f1 15 14 43 0d 09<br>> 72 48 00 00 00 00<br>> 00 00 00 00<br>
> Jul 2 19:45:28 vpn1 pluto[4038]: | 01 10 02 00 00 00<br>> 00 00 00 00 00 78<br>> 0d 00 00 38<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | 00 00 00 01 00 00<br>> 00 01 00 00 00 2c<br>> 00 01 00 01<br>
> Jul 2 19:45:28 vpn1 pluto[4038]: | 00 00 00 24 00 01<br>> 00 00 80 0b 00 01<br>> 80 0c 0e 10<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | 80 01 00 07 80 02<br>> 00 02 80 03 00 01<br>> 80 04 00 12<br>
> Jul 2 19:45:28 vpn1 pluto[4038]: | 80 0e 00 80 0d 00<br>> 00 10 4f 45 4e 55<br>> 7a 5e 71 5f<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | 6a 7b 61 4a 00 00<br>> 00 14 af ca d7 13<br>> 68 a1 f1 c9<br>
> Jul 2 19:45:28 vpn1 pluto[4038]: | 6b 86 96 fc 77 57 01 00<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | control:<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | 18 00 00 00 00 00<br>> 00 00 08 00 00 00<br>
> 01 00 00 00<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | c0 a8 01 66 c0 a8<br>> 01 66 2c 00 00 00<br>> 00 00 00 00<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | 0b 00 00 00 71 00<br>> 00 00 02 03 01 00<br>
> 00 00 00 00<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | 00 00 00 00 02 00<br>> 00 00 c0 a8 01 66<br>> 00 00 00 00<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | 00 00 00 00<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | name:<br>
> Jul 2 19:45:28 vpn1 pluto[4038]: | 02 00 01 f4 c0 a8<br>> 01 02 00 00 00 00<br>> 00 00 00 00<br>> Jul 2 19:45:28 vpn1 pluto[4038]: "testorig" #1: *ERROR:<br>> asynchronous<br>> network error report on eth1 (sport=500) for message to<br>
> <a href="http://192.168.1.2">192.168.1.2</a> <<a href="http://192.168.1.2/">http://192.168.1.2/</a>> port<br>> 500, complainant <a href="http://192.168.1.102">192.168.1.102</a> <<a href="http://192.168.1.102/">http://192.168.1.102/</a>> :<br>
> No route to host [errno 113, origin ICMP<br>> type 3 code 1 (not authenticated)]*<br>> Jul 2 19:45:28 vpn1 pluto[4038]: | next event<br>> EVENT_RETRANSMIT in 7 seconds<br>> for #1<br>> Jul 2 19:45:35 vpn1 pluto[4038]: |<br>
> Jul 2 19:45:35 vpn1 pluto[4038]: | *time t<br>><br>><br>> can you tell me what is the mistake in this configuration?????<br>> what to do to solve this problem???<br>><br>> thanks in advance,<br>
> Regards,<br>> Nirmala<br>><br><br></blockquote></div><br>