<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Well , <br>
try this command line instead of yours<br>
<br>
iptables -t nat -A POSTROUTING -d W.X.Y.Z -o <font color="#ff0000">YourNetworkAdapterName</font>
-j MASQUERADE <br>
<br>
after that , you dont need to warry about your dynamtic Ip address
at all.<br>
<br>
<div class="moz-cite-prefix">On 09/20/2015 05:55 PM, Daniel Cave
wrote:<br>
</div>
<blockquote cite="mid:91B963D5-D3B2-43D9-AE37-C6AB42460D9D@me.com"
type="cite">
<pre wrap="">Sorry Olivier. I meant to refer to the dynamic ip. I think you'll know what I meant
Sent from my iPhone
</pre>
<blockquote type="cite">
<pre wrap="">On 20 Sep 2015, at 08:55, Olivier Thomas <a class="moz-txt-link-rfc2396E" href="mailto:othomas@webtyss.com"><othomas@webtyss.com></a> wrote:
Hi,
I want to connect to a Cisco VPN gateway located at my customer by using Openswan.
My customer gave me credentials with a PCF file which is for a client to site VPN configuration. It was not possible to get site to site config.
>From a windows host with the Cisco Client, it works. Then I successfully installed Openswan on my linux box which acts as a router/NAT gateway for my other machines behind. I converted the PCF file to an openswan configuration file and I succesfully established IPSec connexion from openswan.
The command "ipsec look" shows me the dynamically assigned IP address received from the Cisco gateway and the routes pushed by the Cisco gateway.
However I have two problems :
- If I try to connect from my Openswan machine to one of the authorized servers behind the Cisco gateway (ex: telnet or wget, whatever protocol...), it does't work. the command "ip xfrm monitor" doesn't display any packet going through the tunnel. I suspect I may need to add some iptable rules but it seems stange for me because if I do the parallel with Windows Cisco VPN client, it works immediately and I can reach machines behind the Cisco gateway.
- I also would like to connect from my hosts behind my Linux Openswan to the other machines behing the Cisco gateway by doing some kind of NAT or masquerading of their source IP addresses. First it doesn't work, but if I add on the Openswan box an iptable rule like "iptables -t nat -A POSTROUTING -d W.X.Y.Z -j SNAT --to A.B.C.D " , where W.X.Y.Z stands for the server I try to reach and A.B.C.D stands for the dynamic address assigned by the Cisco gateway, then it works !!! But the problem is that A.B.C.D is dynamic so it may change and I don't want to have to change this rule manually all the time...
Maybe something is wrong with my ipsec.conf or I miss an option...here it is :
conn myconf
ike=3des-md5-modp1024
aggrmode=yes
authby=secret
left=%defaultroute
leftid=@myself
leftxauthclient=yes
leftxauthusername=mylogin
leftmodecfgclient=yes
right=H.I.J.K
rightxauthserver=yes
rightmodecfgserver=yes
pfs=no
auto=start
remote_peer_type=cisco
ipsec.secrets
@myself H.I.J.K : PSK "aaaaaaaaaaa"
@mylogin : XAUTH "bbbbbbbbb"
Thanks for your support !
O.
_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a>
<a class="moz-txt-link-freetext" href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a class="moz-txt-link-freetext" href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a>
</pre>
</blockquote>
<pre wrap="">_______________________________________________
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a>
<a class="moz-txt-link-freetext" href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a>
Micropayments: <a class="moz-txt-link-freetext" href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a>
Building and Integrating Virtual Private Networks with Openswan:
<a class="moz-txt-link-freetext" href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></pre>
</blockquote>
<br>
</body>
</html>