[Openswan Users] When IPSec tunnel up, cannot communicate with local LAN

[Peter McGill]

Yes overlapping subnets have worked just fine in the past.
And it greatly simplifies administration.
1 tunnel per site instead of many
star network vs full mesh

I have another site using openswan 2.4.6 on Slackware Linux 10.0 also with
overlapping subnets.
And it has no problems.
It's much older and running KLIPS however.

root at lark:~# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.37/K3.2.0-4-amd64 (netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                           [N/A]
 NETKEY:  Testing XFRM related proc values                      [OK]
        [FAILED]

  Please disable /proc/sys/net/ipv4/conf/*/accept_redirects
  or NETKEY will accept bogus ICMP redirects!

        [OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [FAILED]
Two or more interfaces found, checking IP forwarding            [FAILED]
Checking NAT and MASQUERADEing                                  [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [WARNING]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]

root at lark:~# sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.eth0.arp_notify = 1
vm.swappiness = 0


Peter McGill
Systems Analyst and Administrator
Gra Ham Energy Limited
519-284-3420 x204