<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(0,0,255)">Just to know without trolling the post.</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(0,0,255)"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(0,0,255)">I also have an instance on Amazon. I am acting like client in the connection with the remote.</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(0,0,255)"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(0,0,255)">Why should I need NAT ? Why is it important ?</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(0,0,255)"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small;color:rgb(0,0,255)">I have followed this guide here <a href="https://github.com/xelerance/Openswan/wiki/Amazon-ec2-example">https://github.com/xelerance/Openswan/wiki/Amazon-ec2-example</a></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-12-18 9:28 GMT+01:00 david coleman <span dir="ltr"><<a href="mailto:david.coleman@promenta.com" target="_blank">david.coleman@promenta.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="auto">
<div>Thanks for reply</div>
<div>However I have seen that kind of advise before but I need more detail.</div>
<div><br>
</div>
<div>I have openswan on a aws Linux box with public ip. So do I set up Nat in that same box and then I use ip tables for the Nat? Or do I set up a new server ? If a new server does it need to be in the same subnet or maybe it needs two ip addresses?</div>
<div><br>
</div>
<div>Openswan is in the same subnet as my real servers</div>
<div><br>
</div>
<div>When I read the (many) posts about Nat with ip tables there was no example with IPSec traffic apart from some people saying they could not get it to work </div>
<div><br>
</div>
<div>If you have any links on actual examples of the Nat with openswan/IPSec that would be great</div>
<div><br>
</div>
<div>Thanks</div>
<div>Dave<br>
<br>
Sent from my iPhone</div><div><div class="h5">
<div><br>
On 17 Dec 2015, at 23:54, Daniel Cave <<a href="mailto:dan.cave@me.com" target="_blank">dan.cave@me.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div>Nat ( network address translation) everything coming out of your network to something they're not using , like to 172.18.101.1 and set that to be your client lan VPN gw <br>
<br>
Sent from my iPhone</div>
<div><br>
On 17 Dec 2015, at 19:51, david coleman <<a href="mailto:david.coleman@promenta.com" target="_blank">david.coleman@promenta.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div>
<p class="MsoNormal">Hello – I have a common problem but I have spent a few hours researching and cannot find the definitive answer.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We are setting up a vpn (site-to-site) to a customer (juniper firewall). We have found that their subnet and our subnet are overlapping.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">So our subnet is on <a href="http://10.180.11.0/24" target="_blank">10.180.11.0/24</a> and theirs is <a href="http://10.180.0.0/16" target="_blank">10.180.0.0/16</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We have set up site-to-site vpns using openswan before with success but not with this scenario.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Can we setup the system so that some kind of routing using iptables will make our side look like something that does not overlap like <a href="http://10.220.11.0/24" target="_blank">10.220.11.0/24</a>?
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I mean we would leave our internal network alone but put something in openswan/iptables that “translates” or converts how the other side sees our ip address
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Diagram:<u></u><u></u></p>
<p class="MsoNormal">Their side (<a href="http://10.180.0.0/16" target="_blank">10.180.0.0/16</a>) <span style="font-family:Wingdings">
à</span> Their VPN Firewall (public ip) <span style="font-family:Wingdings">à</span> Internet
<span style="font-family:Wingdings">à</span> our openswan (public) [viewed as <a href="http://10.220.11.0/24" target="_blank">10.220.11.0/24</a>]
<span style="font-family:Wingdings">à</span> some magic fix to map <a href="http://10.220.11.0/24" target="_blank">10.220.11.0/24</a> to our “real network” of <a href="http://10.180.11.0/24" target="_blank">10.180.11.0/24</a>
<span style="font-family:Wingdings">à</span> our real servers<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We actually only have 3 servers to be accessed in our network so if we need to do some setup for each individual ip that is fine
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks dave<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span><a href="mailto:Users@lists.openswan.org" target="_blank">Users@lists.openswan.org</a></span><br>
<span><a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a></span><br>
<span>Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">
https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a></span><br>
<span>Building and Integrating Virtual Private Networks with Openswan:</span><br>
<span><a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></span></div>
</blockquote>
</div>
</blockquote>
</div></div></div>
<br>_______________________________________________<br>
<a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/mailman/listinfo/users" rel="noreferrer" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" rel="noreferrer" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" rel="noreferrer" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><i><span style="color:rgb(51,102,255)">------------------------------------------------------------------------------------------------------------------------------------------------<br>Kwaye Kant</span><span style="color:rgb(51,102,255)"></span><br style="color:rgb(51,102,255)"><span style="color:rgb(51,102,255)">Skype: g.kwaye</span><br style="color:rgb(51,102,255)"><span style="color:rgb(51,102,255)">(00) 237 677315145<br>Douala - Cameroon<br></span></i></div><div><i><span style="color:rgb(51,102,255)"><a href="http://www.ksoft-solutions.com" target="_blank">www.ksoft-solutions.com</a></span></i></div></div></div>
</div>