<div dir="ltr">Hi Everyone,<div><br></div><div>I am in the deep end with Openswan and possibly the following will show that. Apologies!</div><div><br></div><div>So far I have been relying heavily on this - <a href="http://www.jacco2.dds.nl/networking/openswan-l2tp.html">http://www.jacco2.dds.nl/networking/openswan-l2tp.html</a></div>
<div><br></div><div>A little bit of background first. We have a just opened a new office and not all the infrastructure is in place as yet.</div><div><br></div><div>So the idea is to use a site to site VPN back to the current office so that all resources can be reached.</div>
<div><br></div><div>There is a server acting as the openswan VPN\gateway etc in both offices - current office and new office.</div><div><br></div><div>The current office has a number of site to site configs already in place to third parties. I have configured a server side which looks like this:</div>
<div><br></div><div><div><i>conn server</i></div><div><i> authby=secret</i></div><div><i> pfs=no</i></div><div><i> auto=add</i></div><div><i> keyingtries=3</i></div><div><i> type=transport</i></div>
<div><i> forceencaps=yes</i></div><div><i> right=%any</i></div><div><i> #rightsubnet=vhost:%priv,%no</i></div><div><i> rightprotoport=17/%any</i></div><div><i> # Using the magic port of "0" means "any one single port". This is</i></div>
<div><i> # a work around required for Apple OSX clients that use a randomly</i></div><div><i> # high port, but propose "0" instead of their port. Could also be 17/%any</i></div><div><i> left=<my outside fixed IP address></i></div>
<div><i> leftnexthop=<my outside fixed IP address next hop></i></div><div><i> leftprotoport=17/1701</i></div><div><i> # Apple iOS doesn't send delete notify so we need dead peer detection</i></div>
<div><i> # to detect vanishing clients</i></div><div><i> dpddelay=10</i></div><div><i> dpdtimeout=90</i></div><div><i> dpdaction=clear</i></div></div><div><br></div><div>behind that is some ppp and xl2tp settings that work well for some of our remote types. but I am looking at pure Ipsec at this point.</div>
<div><br></div><div>In the new office I have set up a conn like this:</div><div><br></div><div><div><i>conn aconn</i></div><div><i> authby=secret</i></div><div><i> left=192.168.3.3</i></div><div><i> #left=%any</i></div>
<div><i> leftid=@vpn</i></div><div><i> leftnexthop=%defaultroute</i></div><div><i> leftsourceip=192.168.3.3</i></div><div><i> leftsubnet=<a href="http://192.168.3.0/24">192.168.3.0/24</a></i></div>
<div><i> right=</i><i><my outside fixed IP address></i></div><div><i> rightsubnets={<a href="http://10.134.162.59/32">10.134.162.59/32</a> <a href="http://10.134.210.64/28">10.134.210.64/28</a> <a href="http://192.168.1.0/24">192.168.1.0/24</a>}</i></div>
<div><i> type=tunnel</i></div><div><i> auto=start</i></div><div><i> pfs=no</i></div><div><i> salifetime=28800s</i></div><div><i> ikelifetime=86400s</i></div></div><div><br></div><div>It sits behind a router so left is the local interface. And the subnets are back in the current office.</div>
<div><br></div><div>It comes up ok:</div><div><br></div><div><div><i># service ipsec status</i></div><div><i>IPsec running - pluto pid: 11869</i></div><div><i>pluto pid 11869</i></div><div><i>3 tunnels up</i></div><div><i>some eroutes exist</i></div>
</div><div><br></div><div>I see the routes come up ok on the new office side:</div><div><br></div><div><div><i># ip xfrm policy</i></div><div><i>src <a href="http://192.168.3.0/24">192.168.3.0/24</a> dst <a href="http://10.134.162.59/32">10.134.162.59/32</a></i></div>
<div><i> dir out priority 2336 ptype main</i></div><div><i> tmpl src 192.168.3.3 dst 203.215.150.142</i></div><div><i> proto esp reqid 16385 mode tunnel</i></div><div><i>src <a href="http://10.134.162.59/32">10.134.162.59/32</a> dst <a href="http://192.168.3.0/24">192.168.3.0/24</a></i></div>
<div><i> dir fwd priority 2336 ptype main</i></div><div><i> tmpl src 203.215.150.142 dst 192.168.3.3</i></div><div><i> proto esp reqid 16385 mode tunnel</i></div><div><i>src <a href="http://10.134.162.59/32">10.134.162.59/32</a> dst <a href="http://192.168.3.0/24">192.168.3.0/24</a></i></div>
<div><i> dir in priority 2336 ptype main</i></div><div><i> tmpl src 203.215.150.142 dst 192.168.3.3</i></div><div><i> proto esp reqid 16385 mode tunnel</i></div><div><i>src <a href="http://192.168.3.0/24">192.168.3.0/24</a> dst <a href="http://10.134.210.64/28">10.134.210.64/28</a></i></div>
<div><i> dir out priority 2340 ptype main</i></div><div><i> tmpl src 192.168.3.3 dst 203.215.150.142</i></div><div><i> proto esp reqid 16389 mode tunnel</i></div><div><i>src <a href="http://10.134.210.64/28">10.134.210.64/28</a> dst <a href="http://192.168.3.0/24">192.168.3.0/24</a></i></div>
<div><i> dir fwd priority 2340 ptype main</i></div><div><i> tmpl src 203.215.150.142 dst 192.168.3.3</i></div><div><i> proto esp reqid 16389 mode tunnel</i></div><div><i>src <a href="http://10.134.210.64/28">10.134.210.64/28</a> dst <a href="http://192.168.3.0/24">192.168.3.0/24</a></i></div>
<div><i> dir in priority 2340 ptype main</i></div><div><i> tmpl src 203.215.150.142 dst 192.168.3.3</i></div><div><i> proto esp reqid 16389 mode tunnel</i></div><div><i>src <a href="http://192.168.3.0/24">192.168.3.0/24</a> dst <a href="http://192.168.1.0/24">192.168.1.0/24</a></i></div>
<div><i> dir out priority 2344 ptype main</i></div><div><i> tmpl src 192.168.3.3 dst 203.215.150.142</i></div><div><i> proto esp reqid 16393 mode tunnel</i></div><div><i>src <a href="http://192.168.1.0/24">192.168.1.0/24</a> dst <a href="http://192.168.3.0/24">192.168.3.0/24</a></i></div>
<div><i> dir fwd priority 2344 ptype main</i></div><div><i> tmpl src 203.215.150.142 dst 192.168.3.3</i></div><div><i> proto esp reqid 16393 mode tunnel</i></div><div><i>src <a href="http://192.168.1.0/24">192.168.1.0/24</a> dst <a href="http://192.168.3.0/24">192.168.3.0/24</a></i></div>
<div><i> dir in priority 2344 ptype main</i></div><div><i> tmpl src 203.215.150.142 dst 192.168.3.3</i></div><div><i> proto esp reqid 16393 mode tunnel</i></div></div><div><br></div><div>Can't ping anything back in the current office from the new office even though I can see encapsulated traffic going across at the time of my ping - nothing comes back.</div>
<div><br></div><div>I also don't see anything being created in the xfrm policy for the current office and if I add a rightsubnet(s) line to the current office config then the road runners types can't connect.</div>
<div><br></div><div>Is what I am trying to do even possible?</div><div><br></div><div>Thanks,</div><div>Paul</div></div>