[Openswan Users] help:about exact IP range configuration on super-freeswan

Paul Wouters paul at xtdnet.nl
Sat Jan 17 04:02:44 CET 2004

On Sat, 17 Jan 2004, swcims wrote:

> 	Can super-freeswan support exact IP range configuration in local/remote subnet ? I find that I only can write "left(or right)subnet=".But exact IP range,such as in the left or right subnet,is required by some customers.Also,I can't connect super-freeswan on Redhat linux with Linksys VPN router,when the latter configure exact IP range.

What you are trying to do is export a non-logical subnet. A subnet of seems like a manager or salesguy decision. It is 
not a technical decision.

You can somewhat address this issue by using multiple tunnels for "proper"
subnets. Though again, you have picked ackward numbers. Since you are using
private space anyway, I suggest you try to make subnets on better fitting
subnet boundaries, such as and Once you pick sane
boundaries, you can easily write the tunnel subnet definitions, eg:

rightsubnet= to cover -

and perhaps a second tunnel to the same place with:

rightsubnet= to cover -

If you are starting from scratch on some big chunk of IP space, say a /24
like 192.168.1/0/24, then I recommend using one half of the space for smaller
subnets, and the other half of the space for bigger subnets.

But your current scheme will get you in a lot of trouble, even if you would
manage to fix the freeswan issues.


More information about the Users mailing list