[Openswan Users] L2TP over IPsec over WLAN for OS-X Panther and others ...

Beat Zahnd beat.zahnd at phim.unibe.ch
Fri Jul 22 09:55:38 CEST 2005

Jacco de Leeuw wrote:

> I don't understand why you changed the IP addresses. The previous
> ones should have worked.

My existing wired net is I made a mistake when trying to 
get the gateway working.

>> Client           air         AP         air       VPN Gateway
>> ~~~~~~~~~ ~~~~~~      Debian sarge
>> OS X                                         \
>>                                               ~ eth1
> This won't fly if the AP is bridging.
> can still reach and IPsec is working. Anything 
else too since is not firewalled at the moment.

>> set bind_address
> This should be the external (wireless) address if you are using
> NETKEY. If you are using KLIPS you can bind it to the internal
> address and do a NAT mapping.

I use KLIPS. I tried the NAT mapping yesterday without success:

iptables -t nat --append PREROUTING -i ipsec0 -p udp --dport 1701 -j 
DNAT --to-destination

L2TPNS creates a tun0 interface which gets the address defined with 

tun0      Link encap:UNSPEC  HWaddr 
           inet addr:  P-t-P:  Mask:
           UP POINTOPOINT RUNNING  MTU:1500  Metric:1

I will try what happens if bind_address is set to the address of the 
inner interface As I understand tun0 is the same as ppp0 
when using l2tpd/ppp. Therefore I used for the inner 
interface eth0 and for tun0. Alan Whinery seems not to use 
the bind_address and tun0 gets the default address

Im curious to what the interface paremeter in ipsec.conf has to be set. 
If interface is not specified ipsec0 is on my internal interface eth0 
because the default route is set to it. This is the wrong one I think. I 
set it to "ipsec0=eth1" 'external' wireless interface.

> I have not yet used l2tpns so I can't help you with this. Check out
> Alan Whinery's notes at:
> http://thundarr.its.hawaii.edu/advanced/make_work/IPSec/Openswan_Windows_x509/index.html 

I saw this page and l2tpns is up an d running but it gets nothing from 
the IPsec part.


Physics Institute
University of Bern                   phone  +41 31 631 3466
Sidlerstrasse 5                      fax    +41 31 631 4405
CH-3012 Bern (Switzerland)  mailto:beat.zahnd at phim.unibe.ch

More information about the Users mailing list