Wow! Thanks Whit! Just what I need.<br clear="all"><br><br><br>chr1x2<br><br>
<br><br><div class="gmail_quote">On Thu, Mar 11, 2010 at 20:03, Whit Blauvelt <span dir="ltr">&lt;<a href="mailto:whit@transpect.com">whit@transpect.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">

Hi,<br>
<br>
I found this useful:<br>
<br>
<a href="http://lists.openswan.org/pipermail/users/2008-January/013810.html" target="_blank">http://lists.openswan.org/pipermail/users/2008-January/013810.html</a><br>
<br>
Best,<br>
<font color="#888888">Whit<br>
</font><div><div></div><div class="h5"><br>
On Thu, Mar 11, 2010 at 02:32:40PM +0800, chr1x2 wrote:<br>
&gt; Thanks Bob for replying.<br>
&gt;<br>
&gt; Yes I thought so it&#39;s firewall issue. I already tried to put the firewall down<br>
&gt; and still no luck.<br>
&gt;<br>
&gt; I also tried to define the forwarding on iptables. I don&#39;t know if this is<br>
&gt; correct or I&#39;m just missing something.<br>
&gt;<br>
&gt;<br>
&gt;      iptables -A FORWARD -s 0/0 -i eth0 -d 192.168.0.21 -p TCP --sport<br>
&gt;     1024:65535 -m multiport --dports 7777 -j ACCEPT<br>
&gt;<br>
&gt;      iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 7777 --sport<br>
&gt;     1024:65535 -j DNAT --to <a href="http://192.168.0.21:7777" target="_blank">192.168.0.21:7777</a><br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; Tthanks,<br>
&gt; chr1x2<br>
&gt;<br>
&gt;<br>
&gt; On Thu, Mar 11, 2010 at 13:30, Bob Miller &lt;<a href="mailto:bob@computerisms.ca">bob@computerisms.ca</a>&gt; wrote:<br>
&gt;<br>
&gt;     Since your tunnel is up but the ping packets don&#39;t seem to be going in<br>
&gt;     the tunnel, I would guess your firewall needs some tweaking.  There are<br>
&gt;     several examples on the net of how to mark your packets using iptables<br>
&gt;     for use with openswan.<br>
&gt;     but it&#39;s just a guess...<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;     On Thu, 2010-03-11 at 11:33 +0800, chr1x2 wrote:<br>
&gt;     &gt; Hi All,<br>
&gt;     &gt;<br>
&gt;     &gt; I&#39;m a bit new with Openswan and I&#39;m trying to setup a IPSec/VPN tunnel<br>
&gt;     &gt; connection and I need help. I already asked Google about it but I<br>
&gt;     &gt; cannot seem find the solution.<br>
&gt;     &gt;<br>
&gt;     &gt; Here&#39;s the problem. I can connect to the gateway but I cannot ping,<br>
&gt;     &gt; telnet or make any other connection on the internal lan. Thus making<br>
&gt;     &gt; the tunnel connection useless.<br>
&gt;     &gt;<br>
&gt;     &gt; Please see my configuration below.<br>
&gt;     &gt;<br>
&gt;     &gt; ipsec.conf<br>
&gt;     &gt;<br>
&gt;     &gt;         version 2.0<br>
&gt;     &gt;<br>
&gt;     &gt;         config setup<br>
&gt;     &gt;               plutostderrlog=&quot;/var/log/ipsec.log&quot;<br>
&gt;     &gt;               plutoopts=&quot;--perpeerlog&quot;<br>
&gt;     &gt;<br>
&gt;     &gt;<br>
&gt;     &gt;         conn L2TP-PSK<br>
&gt;     &gt;               authby=secret<br>
&gt;     &gt;               pfs=no<br>
&gt;     &gt;               rekey=no<br>
&gt;     &gt;               keyingtries=3<br>
&gt;     &gt;               left=%defaultroute<br>
&gt;     &gt;               leftnexthop=192.168.0.1<br>
&gt;     &gt;               leftprotoport=17/1701<br>
&gt;     &gt;               right=%any<br>
&gt;     &gt;               rightprotoport=17/%any<br>
&gt;     &gt;               auto=add<br>
&gt;     &gt;<br>
&gt;     &gt;         include /etc/ipsec.d/examples/no_oe.conf<br>
&gt;     &gt;<br>
&gt;     &gt;<br>
&gt;     &gt; # setkey -DP<br>
&gt;     &gt;         172.16.0.156[1701] 192.168.0.41[1701] udp<br>
&gt;     &gt;                 in ipsec<br>
&gt;     &gt;                 esp/transport//unique#16397<br>
&gt;     &gt;                 created: Mar 11 10:49:29 2010  lastused: Mar 11<br>
&gt;     &gt;         11:12:29 2010<br>
&gt;     &gt;                 lifetime: 0(s) validtime: 0(s)<br>
&gt;     &gt;                 spid=992 seq=7 pid=22104<br>
&gt;     &gt;                 refcnt=2<br>
&gt;     &gt;         192.168.0.41[1701] 172.16.0.156[1701] udp<br>
&gt;     &gt;                 out ipsec<br>
&gt;     &gt;                 esp/transport//unique#16397<br>
&gt;     &gt;                 created: Mar 11 10:49:29 2010  lastused: Mar 11<br>
&gt;     &gt;         11:12:29 2010<br>
&gt;     &gt;                 lifetime: 0(s) validtime: 0(s)<br>
&gt;     &gt;                 spid=1001 seq=6 pid=22104<br>
&gt;     &gt;                 refcnt=2<br>
&gt;     &gt;         ::/0[any] ::/0[any] any<br>
&gt;     &gt;                 in none<br>
&gt;     &gt;                 created: Mar 11 10:35:43 2010<br>
&gt;     &gt;         lastused:<br>
&gt;     &gt;                 lifetime: 0(s) validtime: 0(s)<br>
&gt;     &gt;                 spid=947 seq=5 pid=22104<br>
&gt;     &gt;                 refcnt=1<br>
&gt;     &gt;         <a href="http://0.0.0.0/0[any]" target="_blank">0.0.0.0/0[any]</a> <a href="http://0.0.0.0/0[any]" target="_blank">0.0.0.0/0[any]</a> any<br>
&gt;     &gt;                 in none<br>
&gt;     &gt;                 created: Mar 11 10:35:43 2010<br>
&gt;     &gt;         lastused:<br>
&gt;     &gt;                 lifetime: 0(s) validtime: 0(s)<br>
&gt;     &gt;                 spid=931 seq=4 pid=22104<br>
&gt;     &gt;                 refcnt=1<br>
&gt;     &gt;         <a href="http://0.0.0.0/0[any]" target="_blank">0.0.0.0/0[any]</a> <a href="http://0.0.0.0/0[any]" target="_blank">0.0.0.0/0[any]</a> any<br>
&gt;     &gt;                 in none<br>
&gt;     &gt;                 created: Mar 11 10:35:43 2010  lastused: Mar 11<br>
&gt;     &gt;         10:49:29 2010<br>
&gt;     &gt;                 lifetime: 0(s) validtime: 0(s)<br>
&gt;     &gt;                 spid=915 seq=3 pid=22104<br>
&gt;     &gt;                 refcnt=1<br>
&gt;     &gt;         ::/0[any] ::/0[any] any<br>
&gt;     &gt;                 out none<br>
&gt;     &gt;                 created: Mar 11 10:35:43 2010<br>
&gt;     &gt;         lastused:<br>
&gt;     &gt;                 lifetime: 0(s) validtime: 0(s)<br>
&gt;     &gt;                 spid=956 seq=2 pid=22104<br>
&gt;     &gt;                 refcnt=1<br>
&gt;     &gt;         <a href="http://0.0.0.0/0[any]" target="_blank">0.0.0.0/0[any]</a> <a href="http://0.0.0.0/0[any]" target="_blank">0.0.0.0/0[any]</a> any<br>
&gt;     &gt;                 out none<br>
&gt;     &gt;                 created: Mar 11 10:35:43 2010<br>
&gt;     &gt;         lastused:<br>
&gt;     &gt;                 lifetime: 0(s) validtime: 0(s)<br>
&gt;     &gt;                 spid=940 seq=1 pid=22104<br>
&gt;     &gt;                 refcnt=1<br>
&gt;     &gt;         <a href="http://0.0.0.0/0[any]" target="_blank">0.0.0.0/0[any]</a> <a href="http://0.0.0.0/0[any]" target="_blank">0.0.0.0/0[any]</a> any<br>
&gt;     &gt;                 out none<br>
&gt;     &gt;                 created: Mar 11 10:35:43 2010  lastused: Mar 11<br>
&gt;     &gt;         10:49:29 2010<br>
&gt;     &gt;                 lifetime: 0(s) validtime: 0(s)<br>
&gt;     &gt;                 spid=924 seq=0 pid=22104<br>
&gt;     &gt;                 refcnt=1<br>
&gt;     &gt;<br>
&gt;     &gt;<br>
&gt;     &gt; # ipsec auto --status<br>
&gt;     &gt;         000 interface lo/lo ::1<br>
&gt;     &gt;         000 interface lo/lo 127.0.0.1<br>
&gt;     &gt;         000 interface eth0/eth0 192.168.164.41<br>
&gt;     &gt;         000 %myid = (none)<br>
&gt;     &gt;         000 debug none<br>
&gt;     &gt;         000<br>
&gt;     &gt;         000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8,<br>
&gt;     &gt;         keysizemin=64, keysizemax=64<br>
&gt;     &gt;         000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8,<br>
&gt;     &gt;         keysizemin=192, keysizemax=192<br>
&gt;     &gt;         000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8,<br>
&gt;     &gt;         keysizemin=40, keysizemax=448<br>
&gt;     &gt;         000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0,<br>
&gt;     &gt;         keysizemin=0, keysizemax=0<br>
&gt;     &gt;         000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8,<br>
&gt;     &gt;         keysizemin=128, keysizemax=256<br>
&gt;     &gt;         000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8,<br>
&gt;     &gt;         keysizemin=128, keysizemax=256<br>
&gt;     &gt;         000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8,<br>
&gt;     &gt;         keysizemin=128, keysizemax=256<br>
&gt;     &gt;         000 algorithm ESP auth attr: id=1,<br>
&gt;     &gt;         name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128<br>
&gt;     &gt;         000 algorithm ESP auth attr: id=2,<br>
&gt;     &gt;         name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160<br>
&gt;     &gt;         000 algorithm ESP auth attr: id=5,<br>
&gt;     &gt;         name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256,<br>
&gt;     &gt;         keysizemax=256<br>
&gt;     &gt;         000 algorithm ESP auth attr: id=251, name=(null),<br>
&gt;     &gt;         keysizemin=0, keysizemax=0<br>
&gt;     &gt;         000<br>
&gt;     &gt;         000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC,<br>
&gt;     &gt;         blocksize=8, keydeflen=192<br>
&gt;     &gt;         000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC,<br>
&gt;     &gt;         blocksize=16, keydeflen=128<br>
&gt;     &gt;         000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>
&gt;     &gt;         000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>
&gt;     &gt;         000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024,<br>
&gt;     &gt;         bits=1024<br>
&gt;     &gt;         000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536,<br>
&gt;     &gt;         bits=1536<br>
&gt;     &gt;         000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048,<br>
&gt;     &gt;         bits=2048<br>
&gt;     &gt;         000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072,<br>
&gt;     &gt;         bits=3072<br>
&gt;     &gt;         000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096,<br>
&gt;     &gt;         bits=4096<br>
&gt;     &gt;         000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144,<br>
&gt;     &gt;         bits=6144<br>
&gt;     &gt;         000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192,<br>
&gt;     &gt;         bits=8192<br>
&gt;     &gt;         000<br>
&gt;     &gt;         000 stats db_ops.c: {curr_cnt, total_cnt,<br>
&gt;     &gt;         maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}<br>
&gt;     &gt;         000<br>
&gt;     &gt;         000 &quot;L2TP-PSK&quot;: <a href="http://192.168.0.41:17/1701---192.168.0.1...%any:17/%" target="_blank">192.168.0.41:17/1701---192.168.0.1...%any:17/%</a><br>
&gt;     &gt;         any; unrouted; eroute owner: #0<br>
&gt;     &gt;         000 &quot;L2TP-PSK&quot;:     srcip=unset; dstip=unset; srcup=ipsec<br>
&gt;     &gt;         _updown; dstup=ipsec _updown;<br>
&gt;     &gt;         000 &quot;L2TP-PSK&quot;:   ike_life: 3600s; ipsec_life: 28800s;<br>
&gt;     &gt;         rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<br>
&gt;     &gt;         000 &quot;L2TP-PSK&quot;:   policy: PSK+ENCRYPT+TUNNEL+DONTREKEY; prio:<br>
&gt;     &gt;         32,32; interface: eth0; encap: esp;<br>
&gt;     &gt;         000 &quot;L2TP-PSK&quot;:   newest ISAKMP SA: #0; newest IPsec SA: #0;<br>
&gt;     &gt;         000 &quot;L2TP-PSK&quot;[3]:<br>
&gt;     &gt;         <a href="http://192.168.0.41:17/1701---192.168.0.1...172.16.0.156:17/1701" target="_blank">192.168.0.41:17/1701---192.168.0.1...172.16.0.156:17/1701</a>;<br>
&gt;     &gt;         erouted; eroute owner: #6<br>
&gt;     &gt;         000 &quot;L2TP-PSK&quot;[3]:     srcip=unset; dstip=unset; srcup=ipsec<br>
&gt;     &gt;         _updown; dstup=ipsec _updown;<br>
&gt;     &gt;         000 &quot;L2TP-PSK&quot;[3]:   ike_life: 3600s; ipsec_life: 28800s;<br>
&gt;     &gt;         rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<br>
&gt;     &gt;         000 &quot;L2TP-PSK&quot;[3]:   policy: PSK+ENCRYPT+TUNNEL+DONTREKEY;<br>
&gt;     &gt;         prio: 32,32; interface: eth0; encap: esp;<br>
&gt;     &gt;         000 &quot;L2TP-PSK&quot;[3]:   newest ISAKMP SA: #5; newest IPsec SA:<br>
&gt;     &gt;         #6;<br>
&gt;     &gt;         000 &quot;L2TP-PSK&quot;[3]:   IKE algorithm newest:<br>
&gt;     &gt;         3DES_CBC_192-SHA1-MODP2048<br>
&gt;     &gt;         000<br>
&gt;     &gt;         000 #6: &quot;L2TP-PSK&quot;[3] <a href="http://172.16.0.156:500" target="_blank">172.16.0.156:500</a> STATE_QUICK_R2 (IPsec<br>
&gt;     &gt;         SA established); EVENT_SA_EXPIRE in 1967s; newest IPSEC;<br>
&gt;     &gt;         eroute owner<br>
&gt;     &gt;         000 #6: &quot;L2TP-PSK&quot;[3] 172.16.0.156 <a href="mailto:esp.a6aa4532@172.16.0.156">esp.a6aa4532@172.16.0.156</a><br>
&gt;     &gt;         <a href="mailto:esp.41471b19@192.168.0.41">esp.41471b19@192.168.0.41</a><br>
&gt;     &gt;         000 #5: &quot;L2TP-PSK&quot;[3] <a href="http://172.16.0.156:500" target="_blank">172.16.0.156:500</a> STATE_MAIN_R3 (sent<br>
&gt;     &gt;         MR3, ISAKMP SA established); EVENT_SA_EXPIRE in 27167s; newest<br>
&gt;     &gt;         ISAKMP; nodpd<br>
&gt;     &gt;         000<br>
&gt;     &gt;<br>
&gt;     &gt; route -n<br>
&gt;     &gt;         Kernel IP routing table<br>
&gt;     &gt;         Destination     Gateway         Genmask         Flags Metric<br>
&gt;     &gt;         Ref    Use Iface<br>
&gt;     &gt;         172.16.0.156   192.168.0.1   255.255.255.255 UGH   0      0<br>
&gt;     &gt;         0 eth0<br>
&gt;     &gt;         10.0.1.2        0.0.0.0         255.255.255.255 UH    0      0<br>
&gt;     &gt;         0 ppp0<br>
&gt;     &gt;         192.168.0.0   0.0.0.0         255.255.255.0   U     0      0<br>
&gt;     &gt;         0 eth0<br>
&gt;     &gt;         169.254.0.0     0.0.0.0         255.255.0.0     U     0      0<br>
&gt;     &gt;         0 eth0<br>
&gt;     &gt;         0.0.0.0         192.168.0.1   0.0.0.0         UG    0      0<br>
&gt;     &gt;         0 eth0<br>
&gt;     &gt;<br>
&gt;     &gt; # tcpdump -i ppp0<br>
&gt;     &gt;         11:25:58.314939 IP 192.168.0.240.1082 &gt; 192.168.0.21.8888: S<br>
&gt;     &gt;         2675286046:2675286046(0) win 64240 &lt;mss 1360,nop,nop,sackOK&gt;<br>
&gt;     &gt;         11:26:01.317168 IP 192.168.0.240.1082 &gt; 192.168.0.21.8888: S<br>
&gt;     &gt;         2675286046:2675286046(0) win 64240 &lt;mss 1360,nop,nop,sackOK&gt;<br>
&gt;     &gt;         11:26:07.326024 IP 192.168.0.240.1082 &gt; 192.168.0.21.8888: S<br>
&gt;     &gt;         2675286046:2675286046(0) win 64240 &lt;mss 1360,nop,nop,sackOK&gt;<br>
&gt;     &gt;         11:26:22.864028 IP 192.168.0.240 &gt; <a href="http://192.168.0.21" target="_blank">192.168.0.21</a>: icmp 40: echo<br>
&gt;     &gt;         request seq 2304<br>
&gt;     &gt;         11:26:28.088071 IP 192.168.0.240 &gt; <a href="http://192.168.0.21" target="_blank">192.168.0.21</a>: icmp 40: echo<br>
&gt;     &gt;         request seq 2560<br>
&gt;     &gt;         11:26:33.097248 IP 192.168.0.240 &gt; <a href="http://192.168.0.21" target="_blank">192.168.0.21</a>: icmp 40: echo<br>
&gt;     &gt;         request seq 2816<br>
&gt;     &gt;<br>
&gt;     &gt; l2tpd.conf<br>
&gt;     &gt;         [lns default]<br>
&gt;     &gt;         ip range = 192.168.0.240-192.168.0.250<br>
&gt;     &gt;         local ip = 192.168.0.41<br>
&gt;     &gt;         require chap = yes<br>
&gt;     &gt;         refuse pap = yes<br>
&gt;     &gt;         require authentication = yes<br>
&gt;     &gt;         name = ipsec<br>
&gt;     &gt;         ppp debug = yes<br>
&gt;     &gt;         pppoptfile = /etc/ppp/options.l2tpd<br>
&gt;     &gt;         length bit = yes<br>
&gt;     &gt;<br>
&gt;     &gt;<br>
&gt;     &gt; Any help would be appreciated.<br>
&gt;     &gt;<br>
&gt;     &gt;<br>
&gt;     &gt; Thanks,<br>
&gt;     &gt; chr1x2<br>
&gt;     &gt; _______________________________________________<br>
&gt;     &gt; <a href="mailto:Users@openswan.org">Users@openswan.org</a><br>
&gt;     &gt; <a href="http://lists.openswan.org/mailman/listinfo/users" target="_blank">http://lists.openswan.org/mailman/listinfo/users</a><br>
&gt;     &gt; Building and Integrating Virtual Private Networks with Openswan:<br>
&gt;     &gt; <a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
&gt;     Bob Miller<br>
&gt;     334-7117/633-3760<br>
&gt;     <a href="http://computerisms.ca" target="_blank">http://computerisms.ca</a><br>
&gt;     <a href="mailto:bob@computerisms.ca">bob@computerisms.ca</a><br>
&gt;     Network, Internet, Server,<br>
&gt;     and Open Source Solutions<br>
&gt;<br>
&gt;<br>
&gt;<br>
<br>
&gt; _______________________________________________<br>
&gt; <a href="mailto:Users@openswan.org">Users@openswan.org</a><br>
&gt; <a href="http://lists.openswan.org/mailman/listinfo/users" target="_blank">http://lists.openswan.org/mailman/listinfo/users</a><br>
&gt; Building and Integrating Virtual Private Networks with Openswan:<br>
&gt; <a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
<br>
</div></div></blockquote></div><br>