[Openswan Users] Local router unable to send packets to remote LAN

[lists]

Hi All,

I've recently configured and IPsec VPN between my OpenSUSE 10.2 router
firewall running shorewall 3.4.4 and a friends Draytek Vigor 2930 ADSL
modem/router/firewall. All is good other than my router can't ping
anything on my friends (remote) LAN, however machines on my (local) LAN
behind the local firewall can ping machines on the remote LAN without
problem.

The routing table on the route looks like this:


      1.2.3.0/24 dev eth2 proto kernel scope link src 1.2.3.4
      10.0.0.0/24 dev eth2 proto kernel scope link src 10.0.0.1
      192.168.1.0/24 via 1.2.3.1 dev eth2
      192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.1
      169.254.0.0/16 dev eth0 scope link
      127.0.0.0/8 dev lo scope link
      default via 1.2.3.1 dev eth2



Where:
1.2.3.4 is my public IP
1.2.3.1 is my ISP router at the other end of my ADSL line
192.168.0.0/24 is the local LAN
192.168.1.0/24 is the remote LAN
eth0 is the internal interface
eth2 is the external interface

If I "ping 192.168.1.1 -I eth0" to force ping requests via the local
interface I get responses from the remote address. This also works for
any other live IP on the remote LAN. This proves that it's technically
possible to access the remote LAN from my router.

If I delete the route to the remote LAN via eth2 (external NIC) and add
a new one via the internal NIC then no machines on my local LAN can
access the remote LAN. It basically screws the VPN.

I use shorewall for firewall/routing duties and have tried disabling it
but it made no difference.

I also added what I think are the correct entries to
/etc/racoon/setkey.conf but that didn't make any difference.

It seems like I need to force all packets destined for the remote LAN
that originate on the local router to go via the internal NIC instead of
going via the external NIC. Is that possible? And if so, how?

Also, would anyone happen to know if this is normal behaviour? I've
configured IPsec VPNs (using FreeS/WAN) under 2.4 in the past and never
had this problem. However, under 2.4 I'm sure the routing table was
different because there was a ipsec0 interface involved thus simplifying
the routing table. Well, it might not have simplified it per se but it
made would be a lot easier to direct packets for the remote LAN via an
interface designed specifically to pick up and push packets for the
remote LAN.

What am I missing?

Kind regards,

Steve.