[Openswan Users] New OpenSwan User - Hub and Spoke questions
tcp97b at yahoo.com
Fri Oct 19 01:19:48 EDT 2012
I know the basic concepts of vpns, and over the last five days have been trying to soak up OpenSwan, but now I have some questions. I am trying to setup a hub and spoke configuration with all spokes sending all traffic to the hub for routing to other spokes or to the internet as approptiate. I have been able to get a tunnel up from one spoke to the hub, but haven't been able to get a ping back from the hub. The hub has only one interface, the public ip address.
This is a basic outline of what I'm looking for and some questions I had from reading the mailing list archives.
1. Spokes route all traffic through VPN Hub.
2. VPN Hub routes traffic from 10.1.y.0/24 to destination 10.1.x.0/24 net via proper VPN tunnel.
3. VPN hub routes traffic from 10.1.x.0/24 to internet when destination is public ip.
4. Should rightsourceip / leftsourceip be used?
5. What should the "left" value on the spoke be? the internal ip (ex. 10.1.1.1) or the public address?
6. Does a virtual ip (private) get created on the server? Currently running KLIPS ipsec0 gets assigned the public ip of the server.
This is what I *think* I'm looking for:
(hope that makes sense)
Notes on the configuration. I am currently using KLIPS because the FW/Router that we will be using is running KLIPS. I am currently testing tunnels from a linux system. I don't know if I have to run KLIPS on the Gateway. I can run NETKEY just as easy. I also don't know what to use for left subnet on the gateway config since the GW has only one interface/ip the public one. I could only get the tunnel up by specifying a specific "right subnet" of 10.1.1.0/24. Since I will have more that one spoke, how can I configure that? I tried 10.1.0.0/16, but the tunnel would not connect.
ipsec.conf - client and gateway
vpnconnection.conf - client
#note public ip of GW
#note - 0.0.0.0/0 to force routing of all traffic to Gateway
vpnconnection.conf - server
#Note: Public IP of GW
I hope this makes sense. Thank you in advance for any help.
More information about the Users