<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=white lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Hi Nick,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Yes, I have done this. I know the Draytek router doesn’t
know anything about the other subnets and cannot route <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>traffic otherwise. I was able to receive the ICMP requests on my
Linux server so they travel across the vpn to the<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>head office. They just don’t travel to the other side.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>I have no idea why I enabled NAT Traversal. I think I saw it in
an example somewhere when I first tried to get things<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>working and left it in there. Direct VPN’s between the
Drayteks will not work because the local offices do not have<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>a static IP address. That’s why I want everything to go
through the head office. And besides, it will create a lot of<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>overhead. There are about 7 regional offices and I would need a
lot of vpn connections to get all the offices to talk<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>to each other.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";
color:windowtext'><o:p> </o:p></span></p>
</div>
</div>
<p class=MsoNormal>Dennis,<br>
<br>
Are you sure the Draytek at Remote Office 1 is routing traffic to Remote Office
2 via the head office? I don't believe it would normally do that unless you
have set up a specific route.<br>
<br>
As an aside, why have you enabled NAT Traversal?<br>
Not an Openswan solution, but can you not set up direct VPN's between the
Drayteks?<br>
<br>
<br>
<br>
On 19/03/2010 08:40, Dennis van der Meer wrote: <o:p></o:p></p>
<p class=MsoNormal><span lang=NL style='font-family:"Calibri","sans-serif"'>Hi,</span><o:p></o:p></p>
<p class=MsoNormal><span lang=NL style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>I have the
following situation:</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>We have
several sales offices that connect to our head office via an ipsec connection, which
is</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>established
by a Draytek router. On our server side we have a Linux server running with
openswan</span><o:p></o:p></p>
<p class=MsoNormal><span lang=NL style='font-family:"Calibri","sans-serif"'>(Linux
Openswan U2.6.20/K2.6.27.7-smp (netkey)).</span><o:p></o:p></p>
<p class=MsoNormal><span lang=NL style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Our head
office internal network range is 192.168.2.x/24 and our sales offices are in
the range of</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>10.0.x.0/24.
So, e.g.:</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Remote
office LAN 1</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>(10.0.2.0/24)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>|</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Draytek
router (10.0.2.1)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>|</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Internet</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>|</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Linux
server (ext. ip: a.b.c.d)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>(192.168.2.3)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>|</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Head office
LAN</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>(192.168.2.0/24)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>The remote
offices are for the most part connected to internet with a dynamic ip address
(roadwarrior)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>and so I
have used an ID to keep them apart.</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>My
ipsec.conf file is as followed:</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>#
/etc/ipsec.conf - Openswan IPsec configuration file</span><o:p></o:p></p>
<p class=MsoNormal><span lang=NL style='font-size:8.0pt;font-family:"Courier New"'>#
RCSID $Id: ipsec.conf.in,v 1.16 2005/07/26 12:29:45 ken Exp $</span><o:p></o:p></p>
<p class=MsoNormal><span lang=NL style='font-size:8.0pt;font-family:"Courier New"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>#
This file: /usr/local/share/doc/openswan/ipsec.conf-sample</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>#</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>#
Manual: ipsec.conf.5</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>version
2.0 # conforms to second version of ipsec.conf
specification</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>#
basic configuration</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>config
setup</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
uniqueids=yes</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
nat_traversal=yes</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
virtual_private=%v4:10.0.0.0/16,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
protostack=netkey</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
plutodebug=none</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
klipsdebug=none</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>conn
%default</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
keyingtries=0</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
disablearrivalcheck=no</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
authby=secret</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
dpddelay=60</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
dpdtimeout=120</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
dpdaction=clear</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>conn
Office1</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
auto=add</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
left=a.b.c.d
(=external ip Linux server)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
leftsourceip=192.168.2.3 (=internal LAN address Linux server)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
leftsubnet=192.168.2.0/24 (=internal subnet on head office side)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
right=%any
(=other side uses dynamic ip so have to use %any here)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
rightsourceip=10.0.2.1 (=local ip address of Draytek router
from other side)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
rightsubnet=10.0.2.0/24 (=local subnet of remote office 1)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
rightid=@RemoteOffice1 (=ID for office to identify which
tunnel to use)</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
keyexchange=ike</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
keyingtries=5</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
type=tunnel</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
disablearrivalcheck=no</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
authby=secret</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
pfs=yes</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>conn
Office2</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
auto=add</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
left=a.b.c.d</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
leftsourceip=192.168.2.3</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
leftsubnet=192.168.2.0/24</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
right=%any</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
rightsourceip=10.0.3.1</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
rightsubnet=10.0.3.0/24</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
rightid=@RemoteOffice2</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
keyexchange=ike</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
keyingtries=5</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
type=tunnel</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
disablearrivalcheck=no</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
authby=secret</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New"'>
pfs=yes</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>And there
are more offices configured in the file but they are much the same, except for
the subnet.</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>The Draytek
routers can connect without any problem and I can ping the remote subnets from
the Linux server.</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>I can also
ping the remote computers in the remote offices from the Head Office LAN.</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>It is
however not possible to ping a system in Remote Office 2 from Remote Office 1:</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>e.g. In
Remote Office 1: ping 10.0.3.1</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>After using
a “tcpdump –n icmp” I saw that traffic is going from the
computer in Remote Office 1 to the Linux server</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>but from
there it doesn’t travel to the Remote Office 2.</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>How will I
be able to access services in Remote Office 2 from Remote Office 1 (e.g. ping
or access to a web server)?</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Regards,</span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Dennis</span><o:p></o:p></p>
<pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>_______________________________________________<o:p></o:p></pre><pre><a
href="mailto:Users@openswan.org">Users@openswan.org</a><o:p></o:p></pre><pre><a
href="http://lists.openswan.org/mailman/listinfo/users">http://lists.openswan.org/mailman/listinfo/users</a><o:p></o:p></pre><pre>Building and Integrating Virtual Private Networks with Openswan: <o:p></o:p></pre><pre><a
href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><o:p></o:p></pre><pre> <o:p></o:p></pre></div>
</body>
</html>