<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title></title><style type="text/css">.felamimail-body-blockquote {margin: 5px 10px 0 3px;padding-left: 10px;border-left: 2px solid #000088;} </style></head><body>Hello,<div>I hope someone can help me with my issue.</div><div><br></div><div>I am trying to run a openswan ipsec on a raspberry pi 2 towards a ipsec server.</div><div>The tunnel is up and running, but I need to access to the rpi2 from the host site over an virtual IP.</div><div><br></div><div>For example:</div><div>The rpi2 has the local IP: 192.16.4.84/24 and his gateway is 192.168.4.1. The WAN IP is dynamic.</div><div><br></div><div>The rpi2 is starting the tunnel towards the server x.x.x.180</div><div>It also added the virtual IP to the interface eth0</div><div><br></div><div>But I can't reach anything over the connected vpn.</div><div>Without the virutal ip, so just the physical IP the vpn works.</div><div><br></div><div>It seems that the rpi doesn't know how it can reach the tunnel over virtual ip.</div><div><br>Here is the ipsec.conf</div><div><br></div><div><div>config setup<br clear="none">
# uniqueids=no<br clear="none">
virtual_private=%v4:172.17.0.0/28,%v4:172.17.201.253/32<br clear="none">
protostack=netkey<br clear="none">
nat_traversal=yes<br clear="none">
keep_alive=30<br clear="none">
plutodebug=none<br clear="none">
klipsdebug=none<br clear="none">
plutoopts="--perpeerlog"<br clear="none">
plutostderrlog=/tmp/pluto.log</div><p>conn tunnelipsec-Stanley</p><div>type= tunnel<br clear="none">
auto= start<br clear="none">
## This side ##<br clear="none">
left=%defaultroute<br clear="none">
leftsubnet=172.17.201.253/32<br clear="none">
leftsourceip=172.17.201.253<br clear="none">
leftid=172.17.201.253<br clear="none">
## peer side ##<br clear="none">
right=x.x.x.180 # remote peer hostname or IP address<br clear="none">
rightsubnet=172.17.0.0/28 # network behind the head end<br clear="none">
rightid=x.x.x.180 # this makes setting the PSK much easier<br clear="none">
## phase 1 ##<br clear="none">
keyexchange= ike<br clear="none">
ike=3des-md5;modp1024 # This is the phase 1 policy.<br clear="none">
ikelifetime=86400s<br clear="none">
aggrmode=yes<br clear="none">
authby= secret<br clear="none">
rekey=yes
<div><br></div><div>## phase 2 ##</div><div>phase2=esp</div><div>phase2alg=3des-md5;modp1024</div><div><span style="font-family: Tahoma; orphans: 2; text-align: -webkit-auto; widows: 2; font-size: medium;">pfs= yes</span><p style="font-family: Tahoma; orphans: 2; text-align: -webkit-auto; widows: 2; font-size: medium;"><br clear="none"></p></div></div><span id="felamimail-body-signature" style="font-size: 13px;">Thanks</span></div></body></html>