[Openswan Users] How to debug routing problem

[Joost Kraaijeveld]

Hi all,

I have a net-net tunnel between 2 OpenSwan Debian machines (1 with 2.2 from Debian and 1 with a custom 2.3 from source). The tunnel is working (that is, I can see it with setkey -D on the 2.2 side and eith ipsec eroute on the 2.3 side, the auth.log on both side show tunnel up and no errors).

When I ping from net1 to net2 I see the ping arriving at the VPN host-net1 with tcpdump. But I do not see the ping leaving at VPN host-net2. So I wonder if my ping actually enters the tunnel.

So I have the following questions:

- is there a way to check if a ping actually enters a tunnel on the source on the outgoing interface?
- is there a way to check if a ping actually enters a tunnel on the destination on the incoming interface?

Groeten,

Joost Kraaijeveld
Askesis B.V.
Molukkenstraat 14
6524NB Nijmegen
tel: 024-3888063 / 06-51855277
fax: 024-3608416
e-mail: J.Kraaijeveld at Askesis.nl
web: www.askesis.nl