<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-family: Arial,Helvetica,sans-serif'>
<p>Shouldn't the left/rightsubnets be in braces {} and not quotes ""? And can you, in any case, cheat and just specify a single subnet 192.168.100.0/23?</p>
<p>On 2013-06-11 13:28, Binand Sethumadhavan wrote:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<pre>I have an Openswan VPN between locations A and B.
At A, Openswan is running on a CentOS 6 box behind a NAT gateway (called AA).
At B, Openswan is running on a CentOS 6 box which is also the NAT
gateway (called BB).
Most things are fine with the tunnel, as below:
- Every machine in the LAN of AA can reach every machine in the LAN behind BB.
- Every machine in the LAN behind BB can reach every machine in the LAN of AA.
- AA itself can reach every machine in the LAN behind BB.
- AA can reach BB directly too.
- BB cannot reach any machine in the LAN of AA
- BB cannot reach AA directly either.
When I do a tcpdump on BB, I can see that packets for AA go out with
the WAN IP of BB as source, onto the public Internet.
Config on AA:
conn BB
left=10.13.16.217
leftid=10.13.16.217
leftsourceip=10.13.16.217
leftsubnet=10.13.16.0/23
right=a.b.c.d
rightid=a.b.c.d
rightsourceip=192.168.100.1
rightsubnets="192.168.100.0/24 192.168.101.0/24"
type=tunnel
authby=secret
auto=start
ike=aes-sha1;modp1024
phase2=esp
phase2alg=aes-sha1;modp1024
aggrmode=no
Config on BB:
conn AA
left=a.b.c.d
leftid=a.b.c.d
leftnexthop=a.b.c.d-1
leftsourceip=192.168.100.1
leftsubnets="192.168.100.0/24 192.168.101.0/24"
right=x.y.z.t # This IP has a static mapping to 10.13.16.217
on the edge firewall
rightid=10.13.16.217
rightsourceip=10.13.16.217
rightsubnet=10.13.16.0/23
type=tunnel
authby=secret
auto=start
ike=aes-sha1;modp1024
phase2=esp
phase2alg=aes-sha1;modp1024
aggrmode=no
I can see in tcpdump that the source IP of packets from BB endpoint to
AA endpoint is set to the WAN-side IP of BB. Why is this so?
Binand
_______________________________________________
<a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a>
<a href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
</body></html>