<div dir="ltr">thanks the problem was the postrouting i must do src nat the source with<br><br>-A POSTROUTING -d 148.171xxx.xx/32 -j SNAT --to-source 54.86.xxx.xxx so the 10.x will we traslated to 54.86 <br><br></div><div class="gmail_extra"><br><div class="gmail_quote">2014-11-17 10:22 GMT-03:00 Nick Howitt <span dir="ltr"><<a href="mailto:nick@howitts.co.uk" target="_blank">nick@howitts.co.uk</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Alejandro,<br>
<br>
Routing is set up through the use of left/rightsubnet(s) and not iptables or "ip route"<br>
<br>
You will need to have the subnet on which 10.0.0.1.37 is located as one of your left/rightsubnets. Don't subnets have to be between { and }, not ""?<br>
<br>
Nick<div><div class="h5"><br>
<br>
<br>
<br>
On 2014-11-17 12:57, Alejandro Perretta wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
Hi i have this ipsec.conf<br>
<br>
conn test1<br>
left=10.0.1.196<br>
# esp=aes256-sha1!<br>
phase2alg=aes128<br>
leftid=54.86.xxx.xx<br>
leftsourceip=54.86.34.213<br>
leftsubnets="54.86.34.xxx/32 54.86.xx.54/32"<br>
right=12.10.219.57<br>
rightsubnets="148.171.xxx.0/22 148.171.xxx.0/22"<br>
authby=secret<br>
ike=aes-128<br>
ikelifetime=86400s<br>
pfs=yes<br>
auto=start<br>
<br>
the telnet from the vpn server to test one host on 148.171.221.92 and<br>
works fine. but if i send a telnet from 10.0.0.1.37 ( one host on my<br>
private network) cant connect the service.<br>
<br>
My iptables<br>
<br>
filter<br>
:INPUT ACCEPT [362601:2929633039]<br>
:FORWARD ACCEPT [0:0]<br>
:OUTPUT ACCEPT [311889:27000502]<br>
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT<br></div></div>
-A FORWARD -s <a href="http://10.6.0.0/24">10.6.0.0/24</a> [1] -j ACCEPT<br>
-A FORWARD -s <a href="http://10.128.88.0/24">10.128.88.0/24</a> [2] -j ACCEPT<span class=""><br>
-A FORWARD -s 148.xxx.xxx.xxx -j ACCEPT<br>
-A FORWARD -s 54.86.xxx.xxx -j ACCEPT<br></span>
-A FORWARD -s <a href="http://10.0.1.0/24">10.0.1.0/24</a> [3] -j ACCEPT<span class=""><br>
-A FORWARD -j REJECT --reject-with icmp-port-unreachable<br>
COMMIT<br>
# Completed on Fri Nov 14 21:43:05 2014<br>
# Generated by iptables-save v1.4.21 on Fri Nov 14 21:43:05 2014<br>
*nat<br>
:PREROUTING ACCEPT [4:642]<br>
:INPUT ACCEPT [0:0]<br>
:OUTPUT ACCEPT [11:765]<br>
:POSTROUTING ACCEPT [11:765]<br>
#-A PREROUTING -d 54.86.xxx.xxx/32 -j DNAT --to-destination<br>
10.0.1.217<br>
#-A POSTROUTING -s 10.0.1.217 -j MASQUERADE<br>
<br>
COMMIT<br>
# Completed on Fri Nov 14 21:43:05 2014<br>
<br>
--<br>
<br>
Alejandro Perretta<br>
Geopagos<br>
<br>
<br></span>
Links:<br>
------<br>
[1] <a href="http://10.6.0.0/24">http://10.6.0.0/24</a><br>
[2] <a href="http://10.128.88.0/24">http://10.128.88.0/24</a><br>
[3] <a href="http://10.0.1.0/24">http://10.0.1.0/24</a><br>
<br>
______________________________<u></u>_________________<br>
<a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/">https://lists.openswan.org/</a><u></u>mailman/listinfo/users<br>
Micropayments: <a href="https://flattr.com/thing/">https://flattr.com/thing/</a><u></u>38387/IPsec-for-Linux-made-<u></u>easy<br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/">http://www.amazon.com/gp/</a><u></u>product/1904811256/104-<u></u>3099591-2946327?n=283155<br>
</blockquote>
</blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr"><div>Alejandro Perretta<br></div>Geopagos<br></div></div>
</div>