Re: Network config question

From: Jason Dixon (jason_at_dixongroup.net)
Date: 08/25/03

  • Next message: Kevin Fjelsted: "Using download feature of webmin" 
    To: Red Hat Mailing List <redhat-list@redhat.com>
Date: 24 Aug 2003 18:06:43 -0400

    On Sun, 2003-08-24 at 17:45, Jay Mallar wrote:
    > I have a networking issue I need some help with.
    >
    > I use 192.168.0.10 to connect via VPN to my office. When I do so, the
    > VPN software automatically excludes my local intranet traffic, so
    > 192.168.0.10 can no longer see my internal network. The rest of my
    > local net is unaffected but can no longer see 192.168.0.10 - and this
    > is my main issue - because 192.168.0.10 is disconnected from the local
    > intranet, the other machines can no longer access my printer.
    >
    > After connectiong to the VPN:
    >
    > # route
    > Kernel IP routing table
    > Destination Gateway Genmask Flags Metric Ref
    > Use Iface
    > 192.168.0.0 * 255.255.255.0 U 0 0
    > 0 eth0
    > 169.254.0.0 * 255.255.0.0 U 0 0
    > 0 eth0
    > 127.0.0.0 * 255.0.0.0 U 0 0
    > 0 lo
    > default <namehidden> 0.0.0.0 UG 0 0
    > 0 eth0
    >
    Therein lies the problem. You've setup your routing so that when the
    VPN connection is active, all traffic is routed through the VPN, even
    your local LAN traffic. This is something I routinely run into while
    setting up IPsec for wireless Windows systems. In my circumstance, I
    have to do what I refer to as "reflection", where I "bounce" all traffic
    off the VPN gateway, back into the LAN. All LAN hosts also have a
    static route pointing LAN traffic through the gateway, rather than
    delivering on the local segment.

    Yours should be easier to fix. If possible, change your VPN routing so
    that only traffic on the far end of the VPN tunnel is routed through
    your VPN connection. If, for example, the remote network is
    10.0.0.0/24, you'll want a static route for that block to head out the
    VPN gateway.

    If that doesn't work, you should be able to override your LAN route with
    a simple static route on this host back to itself. Something like this
    should work:

    route add -net 192.168.0.0 netmask 255.255.255.0 gw 192.168.0.10

    If it doesn't work, the "reflection" trick is still possible, but seems
    a bit complex for your situation. Please let me know how this works for
    you. 

    -- 
Jason Dixon, RHCE
DixonGroup Consulting
http://www.dixongroup.net
-- 
redhat-list mailing list
unsubscribe mailto:redhat-list-request@redhat.com?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
  • Next message: Kevin Fjelsted: "Using download feature of webmin"

    Relevant Pages

    • Re: VPN usage question
      ... Exactly the same as a LAN. ... > A VPN is a network connection on top of another connection. ...
      (microsoft.public.windowsxp.general)
    • Re: [Full-disclosure] Remote Desktop Command Fixation Attacks
      ... This set of steps is redundant in many places, and it's also enormously expensive, since you're using no less than three different expensive bits of networking hardware (AP, PIX, VPN Concentrator), in addition to a bunch of x86 server hardware, windows server licenses, and at least one ISA license. ... Your computers necessarily don't have full access to your network infrastructure when they aren't logged on, so GPOs, software updates, etc can't be applied at the times you want them to be applied. ... Turning on, enabling, and implementing every possible security setting and device you think of is not defence in depth, and will probably only have two effects - your users won't use your wireless network, and you'll burn so much cash you won't have any left to spend on *useful* security measures. ...
      (Full-Disclosure)
    • Re: VPN routing from NAT to NAT
      ... You have two routes to the 192.168.1.0 network using different ... think you are connecting to the 192.168.1.125 gateway is that it is ... VPN connections are finicky depending on your exact network ... >it is a remote machine and not on my 100BaseTX LAN. ...
      (microsoft.public.windowsxp.work_remotely)
    • My First VPN and my first Problem
      ... network and my LAN at home. ... (No small feat for a network newbie). ... The VPN Gateway at home is a LinkSys BEFVP41 Router Firmware Version ... The remote VPN Client software is TheGreenbowVPN. ...
      (microsoft.public.isa.vpn)
    • TidBITS#792/15-Aug-05
      ... We also note the release of Security Update 2005-007, ... Macintosh FTP client, free for educational and charitable use. ... mentioned virtual private network (VPN) technologies. ...
      (comp.sys.mac.digest)