[Openswan Users] iptables rules, tunnel up network unreachable
Mitsue A Murakami
mitsue at webcenter.com.br
Wed Jul 22 07:27:06 EDT 2015
You are totally right.
It is working now. Actually, the problem was caused by the SNAT rule. It
was very silly of me to insert this rule.
Thank you very much for your help.
On 22-07-2015 06:21, Mittelsdorf, Björn wrote:
> Hi all,
> if I am not mistaken the SNAT rule is wrong.
> You must not SNAT the left network traffic to the public ip because only pakets originating from the private network enter the tunnel.
> In my cases I use a route (ip route ...) on the private network machines to reach the left tunnel end point. As soon as they reach the tunnel endpoint they are detected by IPsec and automatically pushed through the tunnel.
> Short version: Delete the last iptables rule :-)
> Best regards
>> iptables -A INPUT -p udp --dport 500 -j ACCEPT
>> iptables -A INPUT -p tcp --dport 4500 -j ACCEPT
>> iptables -A INPUT -p udp --dport 4500 -j ACCEPT
>> iptables -t nat -A POSTROUTING -s 192.168.4.0/24 -d 192.168.13.0/24 -j
>> SNAT --to (debian fw public IP)
>> I forgot to mention that traceroute shows that traffic is going to the
>> Internet, not through the tunnel.
>> Users mailing list
>> Users at lists.openswan.org
>> End of Users Digest, Vol 135, Issue 7
> Users at lists.openswan.org
> Micropayments: https://flattr.com/thing/38387/IPsec-for-Linux-made-easy
> Building and Integrating Virtual Private Networks with Openswan:
More information about the Users