[Openswan Users] Hub-and-Spoke routing

Mike C smith.not.western at gmail.com
Mon Feb 25 10:19:37 EST 2013

FYI, My pluto configuration was using the wrong subnet mask for the
spoke (/16, when it should have been /24). Changed that, and the ping
works as expected.



On Mon, Feb 25, 2013 at 12:45 PM, Mike C <smith.not.western at gmail.com> wrote:
> Hi,
> I am trying to figure out if it is possible to perform a hub-and-spoke
> ipsec setup where the hub can route traffic between spokes. I.e.
> Situations where spokes are NAT'd but the Hub is not, so is reachable
> by all. I'm trying to get A to reach C via B: A->B->C. Using openswan
> 2.6.36, linux with klips.
> My attempts to do so locally have failed so far. I have:
> Spoke A:, WAN
> Hub     B:, WAN
> Spoke C:, WAN
> I created a VPN between the spokes and B using a /16 subnet so traffic
> for C will be routed over the VPN:
>  A-B:<-->
>  C-B:<-->
> A can ping B and B can ping A.
> C can ping B and B can ping C.
> I found the eroute list looked wrong on B (hub). Everything was going
> via the second route. So changed it from (public IPs masked):
> # /libexec/ipsec/eroute
> 0     ->    => tun0x1012 at
> 168    ->     => tun0x1001 at
> to:
> # /libexec/ipsec/eroute
> 84     ->    => tun0x1012 at
> 1103     ->    => tun0x1001 at
> When I try have A ping C, and run wireshark on C, I see no traffic. As
> far as I can see, the eroute counters on B don't increment at all
> whereas they did when doing direct A-B, C-B pings.
> Routing table for B:
> dev ppp0  proto kernel  scope link  src
> dev ipsec0  scope link  src
> dev eth0  scope link  src
> dev ipsec0  scope link  src
> dev lo  scope link
> default via dev ppp0  src
> Any ideas as to what is wrong, or if I'm barking up the wrong tree? If
> I'm on the wrong track, can you advise on possible alternatives that I
> could look into?
> Thanks,
> Mike

More information about the Users mailing list