[Openswan Users] Not able to ping other subnet

Mon Mar 22 04:10:17 EDT 2010

Hi Nick,

Yes, I have done this. I know the Draytek router doesn't know anything
about the other subnets and cannot route 

traffic otherwise. I was able to receive the ICMP requests on my Linux
server so they travel across the vpn to the

head office. They just don't travel to the other side.

I have no idea why I enabled NAT Traversal. I think I saw it in an
example somewhere when I first tried to get things

working and left it in there. Direct VPN's between the Drayteks will not
work because the local offices do not have

a static IP address. That's why I want everything to go through the head
office. And besides, it will create a lot of

overhead. There are about 7 regional offices and I would need a lot of
vpn connections to get all the offices to talk

to each other.

Dennis,

Are you sure the Draytek at Remote Office 1 is routing traffic to Remote
Office 2 via the head office? I don't believe it would normally do that
unless you have set up a specific route.

As an aside, why have you enabled NAT Traversal?
Not an Openswan solution, but can you not set up direct VPN's between
the Drayteks?

On 19/03/2010 08:40, Dennis van der Meer wrote: 

Hi,

I have the following situation:

We have several sales offices that connect to our head office via an
ipsec connection, which is

established by a Draytek router. On our server side we have a Linux
server running with openswan

(Linux Openswan U2.6.20/K2.6.27.7-smp (netkey)).

Our head office internal network range is 192.168.2.x/24 and our sales
offices are in the range of

10.0.x.0/24. So, e.g.:

Remote office LAN 1

(10.0.2.0/24)

|

Draytek router (10.0.2.1)

|

Internet

|

Linux server (ext. ip: a.b.c.d)

(192.168.2.3)

|

Head office LAN

(192.168.2.0/24)

The remote offices are for the most part connected to internet with a
dynamic ip address (roadwarrior)

and so I have used an ID to keep them apart.

My ipsec.conf file is as followed:

# /etc/ipsec.conf - Openswan IPsec configuration file

# RCSID $Id: ipsec.conf.in,v 1.16 2005/07/26 12:29:45 ken Exp $

# This file:  /usr/local/share/doc/openswan/ipsec.conf-sample

#

# Manual:     ipsec.conf.5

version 2.0     # conforms to second version of ipsec.conf specification

# basic configuration

config setup

        uniqueids=yes

        nat_traversal=yes

virtual_private=%v4:10.0.0.0/16,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v

        protostack=netkey

        plutodebug=none

        klipsdebug=none

conn %default

        keyingtries=0

        disablearrivalcheck=no

        authby=secret

        dpddelay=60

        dpdtimeout=120

        dpdaction=clear

conn Office1

        auto=add

        left=a.b.c.d              (=external ip Linux server)

        leftsourceip=192.168.2.3  (=internal LAN address Linux server)

        leftsubnet=192.168.2.0/24 (=internal subnet on head office side)

        right=%any                (=other side uses dynamic ip so have
to use %any here)

        rightsourceip=10.0.2.1    (=local ip address of Draytek router
from other side)

        rightsubnet=10.0.2.0/24   (=local subnet of remote office 1)

        rightid=@RemoteOffice1    (=ID for office to identify which
tunnel to use)

        keyexchange=ike

        keyingtries=5

        type=tunnel

        disablearrivalcheck=no

        authby=secret

        pfs=yes

conn Office2

        auto=add

        left=a.b.c.d

        leftsourceip=192.168.2.3

        leftsubnet=192.168.2.0/24

        right=%any

        rightsourceip=10.0.3.1

        rightsubnet=10.0.3.0/24

        rightid=@RemoteOffice2

        keyexchange=ike

        keyingtries=5

        type=tunnel

        disablearrivalcheck=no

        authby=secret

        pfs=yes

And there are more offices configured in the file but they are much the
same, except for the subnet.

The Draytek routers can connect without any problem and I can ping the
remote subnets from the Linux server.

I can also ping the remote computers in the remote offices from the Head
Office LAN.

It is however not possible to ping a system in Remote Office 2 from
Remote Office 1:

e.g. In Remote Office 1: ping 10.0.3.1

After using a "tcpdump -n icmp" I saw that traffic is going from the
computer in Remote Office 1 to the Linux server

but from there it doesn't travel to the Remote Office 2.

How will I be able to access services in Remote Office 2 from Remote
Office 1 (e.g. ping or access to a web server)?

Regards,

Dennis

_______________________________________________
Users at openswan.org
http://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with Openswan: 
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20100322/a12e3582/attachment-0001.html 