It's ok now. Thanks.<br><br><div class="gmail_quote">On Thu, Nov 20, 2008 at 3:12 PM, Peter McGill <span dir="ltr"><<a href="mailto:petermcgill@goco.net">petermcgill@goco.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Reza,<br>
<br>
Your firewall rules are wrong, IPSec uses protocol 50 not port 50.<br>
The IPSec permit rules should look like this:<br>
iptables -A INPUT -i eth1 -p 50 -j ACCEPT<br>
iptables -A INPUT -i eth1 -p udp --dport 500 -j ACCEPT<br>
<br>
Did you permit the subnet traffic through your firewall?<br>
You must do that for the traffic to pass.<br>
If using NETKEY:<br>
iptables -A INPUT -i eth1 -s <a href="http://192.168.10.0/24" target="_blank">192.168.10.0/24</a> -j ACCEPT<br>
iptables -A FORWARD -i eth1 -s <a href="http://192.168.10.0/24" target="_blank">192.168.10.0/24</a> -j ACCEPT<br>
If using KLIPS then substitute eth1 for ipsec0.<br>
Or better yet for NETKEY, mark the incoming IPSec packets, then<br>
permit marked packets on INPUT and FORWARD.<br>
<br>
Peter<br>
<br>
Issany Reza wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d">
Hello,<br>
<br>
I'm trying to configure ipsec with a zywall 2 plus router.<br>
I have successfully connect the zywall to my openswan box (debian + openswan).<br>
I'm using NETKEY The server is a server that only have the public interface. I have created new one :<br>
<br>
</div><a href="http://192.168.2.1/24" target="_blank">192.168.2.1/24</a> <<a href="http://192.168.2.1/24" target="_blank">http://192.168.2.1/24</a>> ---- public ip of openswanbox --------- BOX ------------------ public ip of zywall --- <a href="http://192.168.10.0/24" target="_blank">192.168.10.0/24</a> <<a href="http://192.168.10.0/24" target="_blank">http://192.168.10.0/24</a>><div class="Ih2E3d">
<br>
<br>
000 #4: "techvar":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27737s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate<br></div>
000 #4: "techvar" <a href="mailto:esp.531534b@217.128.239.227" target="_blank">esp.531534b@217.128.239.227</a> <mailto:<a href="mailto:esp.531534b@217.128.239.227" target="_blank">esp.531534b@217.128.239.227</a>> <a href="mailto:esp.fea97a54@88.191.91.113" target="_blank">esp.fea97a54@88.191.91.113</a> <mailto:<a href="mailto:esp.fea97a54@88.191.91.113" target="_blank">esp.fea97a54@88.191.91.113</a>> <a href="mailto:tun.0@217.128.239.227" target="_blank">tun.0@217.128.239.227</a> <mailto:<a href="mailto:tun.0@217.128.239.227" target="_blank">tun.0@217.128.239.227</a>> <a href="mailto:tun.0@88.191.91.113" target="_blank">tun.0@88.191.91.113</a> <mailto:<a href="mailto:tun.0@88.191.91.113" target="_blank">tun.0@88.191.91.113</a>> ref=0 refhim=4294901761<div class="Ih2E3d">
<br>
000 #1: "techvar":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2330s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate<br>
<br>
But, from each side, I can't ping any of other LAN subnet.<br>
<br>
I I had this route in the zywall :<br>
<br>
Destination<br>
</div><a href="http://192.168.2.0" target="_blank">192.168.2.0</a> <<a href="http://192.168.2.0" target="_blank">http://192.168.2.0</a>> / <a href="http://255.255.255.0" target="_blank">255.255.255.0</a> <<a href="http://255.255.255.0" target="_blank">http://255.255.255.0</a>><br>
<br>
Gateway<br>
<a href="http://192.168.10.1" target="_blank">192.168.10.1</a> <<a href="http://192.168.10.1" target="_blank">http://192.168.10.1</a>><br>
<br>
I can ping the server (<a href="http://192.168.2.1" target="_blank">192.168.2.1</a> <<a href="http://192.168.2.1" target="_blank">http://192.168.2.1</a>>).<div class="Ih2E3d"><br>
<br>
If I add this route in the server :<br></div>
route add -net <a href="http://192.168.10.0/24" target="_blank">192.168.10.0/24</a> <<a href="http://192.168.10.0/24" target="_blank">http://192.168.10.0/24</a>> gw <a href="http://192.168.2.1" target="_blank">192.168.2.1</a> <<a href="http://192.168.2.1" target="_blank">http://192.168.2.1</a>><br>
<br>
I can ping the router (<a href="http://192.168.10.1" target="_blank">192.168.10.1</a> <<a href="http://192.168.10.1" target="_blank">http://192.168.10.1</a>>) but I can't ping any of PC connected in the subnet <a href="http://192.168.10.0/24" target="_blank">192.168.10.0/24</a> <<a href="http://192.168.10.0/24" target="_blank">http://192.168.10.0/24</a>><br>
<br>
conn techvar<br>
#local<br>
left=<a href="http://88.191.91.113" target="_blank">88.191.91.113</a> <<a href="http://88.191.91.113" target="_blank">http://88.191.91.113</a>><br>
leftsubnet=<a href="http://192.168.2.0/24" target="_blank">192.168.2.0/24</a> <<a href="http://192.168.2.0/24" target="_blank">http://192.168.2.0/24</a>><br>
leftid=<a href="http://88.191.91.113" target="_blank">88.191.91.113</a> <<a href="http://88.191.91.113" target="_blank">http://88.191.91.113</a>><div class="Ih2E3d"><br>
authby=secret<br>
pfs=yes<br>
auth=esp<br>
aggrmode=no<br>
disablearrivalcheck=no<br>
esp=3des-md5-96<br>
# remote<br></div>
right=<a href="http://217.128.239.227" target="_blank">217.128.239.227</a> <<a href="http://217.128.239.227" target="_blank">http://217.128.239.227</a>><br>
rightsubnet=<a href="http://192.168.10.0/24" target="_blank">192.168.10.0/24</a> <<a href="http://192.168.10.0/24" target="_blank">http://192.168.10.0/24</a>><br>
rightid=<a href="http://217.128.239.227" target="_blank">217.128.239.227</a> <<a href="http://217.128.239.227" target="_blank">http://217.128.239.227</a>><div class="Ih2E3d"><br>
auto=start<br>
<br>
I'm using iptables on the server :<br>
# IPSEC<br>
iptables -A INPUT -i eth1 -p tcp --dport 50 -j ACCEPT<br>
iptables -A INPUT -i eth1 -p tcp --dport 51 -j ACCEPT<br>
iptables -A INPUT -i eth1 -p udp --destination-port 500 -j ACCEPT<br>
<br>
Any idea to solve this probem ?<br>
-- <br>
- reza -<br>
<br>
<br></div>
------------------------------------------------------------------------<br>
<br>
_______________________________________________<br>
<a href="mailto:Users@openswan.org" target="_blank">Users@openswan.org</a><br>
<a href="http://lists.openswan.org/mailman/listinfo/users" target="_blank">http://lists.openswan.org/mailman/listinfo/users</a><br>
Building and Integrating Virtual Private Networks with Openswan: <a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
</blockquote>
</blockquote></div><br><br clear="all"><br>-- <br>- reza -<br>