<HTML><HEAD></HEAD>
<BODY dir=ltr>
<DIV dir=ltr>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt">
<DIV> </DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt">Hi all,</DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt"> </DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt">I made a
tunnel between openswan (as a linux router) and a watchgard X core router.</DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt"> </DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt">Everything
works on the computers on the lan side of the linux router. (ping, access
etc...)</DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt"> </DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt">but, on the
linux router itself, I can’t ping or have access to the other side of the
tunnel.</DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt"> </DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt">Is there some
iptables rule I need to add to make the linux router see the lan on the other
side of the watchguard ?</DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt"> </DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt">Here are the
iptables rules I have setup to make the linux LAN side see the watchguard’s LAN
side: </DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt"> </DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt">On my setup:
linux router LAN is 192.168.112.0/24</DIV>
<DIV
style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt">
watchguard LAN is 192.168.10.0/24</DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt"> </DIV>
<DIV>iptables -t filter -A INPUT -p 17 --dport 500 -j ACCEPT # udp/isakmp</DIV>
<DIV>iptables -t filter -A INPUT -p 50 -j ACCEPT # esp</DIV>
<DIV>iptables -t mangle -A PREROUTING -p 17 --dport 500 -j MARK --set-mark 1 #
udp/isakmp</DIV>
<DIV>iptables -t mangle -A PREROUTING -p 50 -j MARK --set-mark 1 # esp</DIV>
<DIV>iptables -t filter -A INPUT -m mark --mark 1 -j ACCEPT</DIV>
<DIV>iptables -t filter -A FORWARD -m mark --mark 1 -j ACCEPT</DIV>
<DIV>iptables -t filter -A OUTPUT -j ACCEPT</DIV>
<DIV>iptables -t filter -A FORWARD -s 192.168.112.0/24 -j ACCEPT</DIV>
<DIV>iptables -t nat -I POSTROUTING -d 192.168.10.0/24 -j ACCEPT</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>thanks for any help on this.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Jeff C.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt"> </DIV>
<DIV
style="FONT-FAMILY: 'Arial'; COLOR: #000000; FONT-SIZE: 10pt"> </DIV></DIV></DIV></BODY></HTML>