[Openswan Users] Can't connect Win98 MSL2TP clienttoOpenSwanServer

[Mark Cave-Ayland]

> -----Original Message-----
> From: users-bounces at openswan.org 
> [mailto:users-bounces at openswan.org] On Behalf Of Jacco de Leeuw
> Sent: 05 July 2005 13:56
> To: users at openswan.org
> Subject: Re: [Openswan Users] Can't connect Win98 MSL2TP 
> clienttoOpenSwanServer

(cut)

> I'm not sure if you understand. The private subnets listed in 
> virtual_private are the ones that are allowed for use by 
> (Windows) clients behind NAT. In most cases you don't know in 
> advance what subnets the folks at home are using, so usually 
> you list all possible subnets. However, you also need to 
> *exclude* subnets used by the VPN router, otherwise your IP 
> routing does not work (can't use the same subnet on disjoint 
> networks).
> 
> Jacco


Hi Jacco,

I think I see now - I've tried to draw a rough ASCII diagram of the
roadwarrior setup I'm trying to implement below (apologies if it doesn't
come out as expected):


      REMOTE
LOCAL


                    		|----------------------------------|
NAT router          		|                                  |   NAT
router (IPSec GW)
192.168.2.1    		80.1.2.3.4                            213.x.x.x
192.168.2.1
(internal, can vary)    (external, can vary)                  (external)
(internal)
     |
|
Roadwarrior
|
192.168.2.2
(servers required by
	
roadwarrier)			

So when the roadwarrior connects to the local IPSec GW, then even after
NAT-T then openswan will see the connection as being between 192.168.2.2 and
213.x.x.x, and not from between 80.1.2.3.4 and 213.x.x.x? In that case,
would that mean my roadwarrior in the diagram above would be unable to
connect? :(


Many thanks,

Mark.

------------------------
WebBased Ltd
17 Research Way
Tamar Science Park
Plymouth
PL6 8BT 

T: +44 (0)1752 797131
F: +44 (0)1752 791023
W: http://www.webbased.co.uk