<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;"><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: medium; "><font class="Apple-style-span" face="arial" size="2">Good Afternoon and I immediately apologize if this has been sent to the wrong distribution list -</font><div style="font-family: arial; font-size: 10pt; "><br></div><div style="font-family: arial; font-size: 10pt; ">Currently I have a tunnel up from OpenSwan to an ASA using Nat-T.</div><div style="font-family: arial; font-size: 10pt; "><br></div><div style="font-family: arial; font-size: 10pt; ">Host A (172.20.1.15) --> OpenSwan --> Internet <-- ASA <-- Host B (192.168.1.2)</div><div style="font-family: arial; font-size: 10pt; "><br></div><div style="font-family: arial; font-size: 10pt; ">What is working:</div><div style="font-family: arial; font-size: 10pt; ">Ping/RDP from Host B to Host A</div><div
style="font-family: arial; font-size: 10pt; ">Ping from OpenSwan to Host B</div><div style="font-family: arial; font-size: 10pt; "><br></div><div style="font-family: arial; font-size: 10pt; ">What isn't working:</div><div style="font-family: arial; font-size: 10pt; ">Ping/RDP from Host A to Host B</div><div style="font-family: arial; font-size: 10pt; "><br></div><div style="font-family: arial; font-size: 10pt; ">I seem to be struggling with the iptables setup on the OpenSwan Server, however this is my current setup:</div><div style="font-family: arial; font-size: 10pt; "><br></div><div><div><span class="Apple-style-span" style="font-family: arial; font-size: small; ">Table: mangle</span></div><div><font class="Apple-style-span" face="arial" size="2">Chain PREROUTING (policy ACCEPT)</font></div><div><font class="Apple-style-span" face="arial" size="2">num target prot opt source
destination</font></div><div><font class="Apple-style-span" face="arial" size="2"><br></font></div><div><font class="Apple-style-span" face="arial" size="2">Chain INPUT (policy ACCEPT)</font></div><div><font class="Apple-style-span" face="arial" size="2">num target prot opt source destination</font></div><div><font class="Apple-style-span" face="arial" size="2"><br></font></div><div><font class="Apple-style-span" face="arial" size="2">Chain FORWARD (policy ACCEPT)</font></div><div><font class="Apple-style-span" face="arial" size="2">num target prot opt source destination</font></div><div><font class="Apple-style-span" face="arial" size="2">1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED</font></div><div><font class="Apple-style-span" face="arial" size="2">2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0</font></div><div><font class="Apple-style-span" face="arial" size="2"><br></font></div><div><font class="Apple-style-span" face="arial" size="2">Chain OUTPUT (policy ACCEPT)</font></div><div><font class="Apple-style-span" face="arial" size="2">num target prot opt source destination</font></div><div><font class="Apple-style-span" face="arial" size="2"><br></font></div><div><font class="Apple-style-span" face="arial" size="2">Chain POSTROUTING (policy ACCEPT)</font></div><div><font class="Apple-style-span" face="arial" size="2">num target prot opt source destination</font></div><div><font class="Apple-style-span"
face="arial" size="2"><br></font></div><div><font class="Apple-style-span" face="arial" size="2">Table: filter</font></div><div><font class="Apple-style-span" face="arial" size="2">Chain INPUT (policy ACCEPT)</font></div><div><font class="Apple-style-span" face="arial" size="2">num target prot opt source destination</font></div><div><font class="Apple-style-span" face="arial" size="2">1 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:500 dpt:500</font></div><div><font class="Apple-style-span" face="arial" size="2">2 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:50 dpt:50</font></div><div><font class="Apple-style-span" face="arial" size="2">3 ACCEPT
esp -- 0.0.0.0/0 0.0.0.0/0</font></div><div><font class="Apple-style-span" face="arial" size="2"><br></font></div><div><font class="Apple-style-span" face="arial" size="2">Chain FORWARD (policy ACCEPT)</font></div><div><font class="Apple-style-span" face="arial" size="2">num target prot opt source destination</font></div><div><font class="Apple-style-span" face="arial" size="2"><br></font></div><div><font class="Apple-style-span" face="arial" size="2">Chain OUTPUT (policy ACCEPT)</font></div><div><font class="Apple-style-span" face="arial" size="2">num target prot opt source destination</font></div><div><font class="Apple-style-span" face="arial" size="2">1 ACCEPT udp -- 0.0.0.0/0
0.0.0.0/0 udp spt:500 dpt:500</font></div><div><font class="Apple-style-span" face="arial" size="2">2 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:50 dpt:50</font></div><div><font class="Apple-style-span" face="arial" size="2">3 ACCEPT esp -- 0.0.0.0/0 0.0.0.0/0</font></div><div><font class="Apple-style-span" face="arial" size="2"><br></font></div><div><font class="Apple-style-span" face="arial" size="2">Table: nat</font></div><div><font class="Apple-style-span" face="arial" size="2">Chain PREROUTING (policy ACCEPT)</font></div><div><font class="Apple-style-span" face="arial" size="2">num target prot opt source destination</font></div><div><font
class="Apple-style-span" face="arial" size="2"><br></font></div><div><font class="Apple-style-span" face="arial" size="2">Chain OUTPUT (policy ACCEPT)</font></div><div><font class="Apple-style-span" face="arial" size="2">num target prot opt source destination</font></div><div><font class="Apple-style-span" face="arial" size="2"><br></font></div><div><font class="Apple-style-span" face="arial" size="2">Chain POSTROUTING (policy ACCEPT)</font></div><div><font class="Apple-style-span" face="arial" size="2">num target prot opt source destination</font></div><div><font class="Apple-style-span" face="arial" size="2">1 MASQUERADE all -- 0.0.0.0/0 !192.168.1.0/24</font></div></div><div style="font-family: arial; font-size: 10pt; "><br></div><div
style="font-family: arial; font-size: 10pt; "><b>And my ipsec.conf:</b></div><div style="font-family: arial; font-size: 10pt; "><br></div><div><div><font class="Apple-style-span" face="arial" size="2">config setup</font></div><div><font class="Apple-style-span" face="arial" size="2"> nat_traversal=yes</font></div><div><span class="Apple-style-span" style="font-family: arial; font-size: small; "> virtual_private=%v4:192.168.1.0/24,%v4:!172.20.1.0/24</span></div><div><font class="Apple-style-span" face="arial" size="2"> oe=off</font></div><div><font class="Apple-style-span" face="arial" size="2"> protostack=netkey</font></div><div><font class="Apple-style-span" face="arial" size="2">conn os-to-cisco</font></div><div><font class="Apple-style-span" face="arial" size="2"> connaddrfamily=ipv4</font></div><div><font
class="Apple-style-span" face="arial" size="2"> type=tunnel</font></div><div><font class="Apple-style-span" face="arial" size="2"> authby=secret</font></div><div><font class="Apple-style-span" face="arial" size="2"> esp=3DES-SHA1</font></div><div><font class="Apple-style-span" face="arial" size="2"> ike=3des-sha1</font></div><div><font class="Apple-style-span" face="arial" size="2"> forceencaps=yes</font></div><div><font class="Apple-style-span" face="arial" size="2"> pfs=yes</font></div><div><font class="Apple-style-span" face="arial" size="2"> compress=no</font></div><div><font class="Apple-style-span" face="arial" size="2"> </font> left=%defaultroute</div><div><font class="Apple-style-span" face="arial" size="2">
leftid=x.x.x.x</font></div><div><font class="Apple-style-span" face="arial" size="2"> leftsubnet=172.20.1.0/24</font></div><div><font class="Apple-style-span" face="arial" size="2"> leftnexthop=%defaultroute</font></div><div><font class="Apple-style-span" face="arial" size="2"> right=x.x.x.x</font></div><div><font class="Apple-style-span" face="arial" size="2"> rightsubnet=192.168.1.0/24</font></div><div><font class="Apple-style-span" face="arial" size="2"> rightnexthop=%defaultroute</font></div><div><font class="Apple-style-span" face="arial" size="2"> auto=add</font></div><div style="font-family: arial; font-size: 10pt; "><br></div></div><div style="font-family: arial; font-size: 10pt; ">At this point, I'm not sure if it's a routing issue or a firewall issue. When I attempt to ping
from Host A to Host B and perform a tcpdump icmp on the OpenSwan server, I don't see any traffic coming from Host A (however I'm not sure if I should). I have setup a static route on Host A pointing all traffic destined to 192.168.1.0 to the OpenSwan server. I've been working at this for 2 days now, have read countless forums and OpenSwan documentation, and am about out of ideas. Any assistance is much appreciated!!!</div><div style="font-family: arial; font-size: 10pt; "><br></div><div style="font-family: arial; font-size: 10pt; ">Thank you!</div><div style="font-family: arial; font-size: 10pt; "><br></div><div style="font-family: arial; font-size: 10pt; ">Trevor</div></span></td></tr></table>