Re: IPSec, IPTables, multiple subnets
- From: Clifford Kite <kite@xxxxxxxxxxxxxxxxx>
- Date: Thu, 29 Mar 2007 13:38:43 -0500
SilkBC <swasak@xxxxxxxxxxx> wrote:
On Mar 27, 1:46 pm, Clifford Kite <k...@xxxxxxxxxxxxxxxxx> wrote:
Given that I'm no IPSec or iptables expert, you might try this:
iptables -t nat -A POSTROUTING -o eth0 -d ! 10.175.0.0/16 -j MASQUERADE
I had considered the above, but thought it would have prevented the
LAN traffic at the main site (10.175.0.0/24) from being masquerated/
nat'd out to the Internet. I gave it a try anyway, and it doesn't
seem to affect that traffic.
Having done that, I have made some progress: from the 10.175.0.0/24
(main site) network, I am able to ping the private gateway IPs of the
routers at the different sites (10.175.x.254) whereas I was not able
to do so previously. I am unable to ping any of the PCs behind the
gateways, however (though I can do so if I SSH to the gateway itself
and start pinging the IPs of the PCs).
I was thinking this may be a routing issue until I was actually able
to ping just one of the PCs in the 10.175.3.0/24 subnet, though I
cannot ping any of the others behind it.
The firewall is not an issue, as it is running the exact same one as
the site with the 10.175.1.0/24 subnet (which is working 100% as it
should). The routing tables are also exactly the same, except for the
local subnet and of course the ISP gateway they have to go through.
Open to any other suggestions... :-)
It smacks of the lack of IP forwarding on the VPN gateways, except
for the one for 10.175.1.0/24 of course. You also might enquire as to
whether there is anything special about the PC that responds to pinging.
That seems to contradict my suggestion: if IP forwarding is missing
on the gateway then no PC should respond and if it isn't then all PCs
should respond.
Anyway, since 10.175.1.0/24 is still 100% with the new rule it seems
like the other subnets should also work with it.
corncob:~# cat /proc/sys/net/ipv4/ip_forward
1
-Alan M.
--
Clifford Kite
.
- References:
- IPSec, IPTables, multiple subnets
- From: SilkBC
- Re: IPSec, IPTables, multiple subnets
- From: Clifford Kite
- Re: IPSec, IPTables, multiple subnets
- From: SilkBC
- IPSec, IPTables, multiple subnets
- Prev by Date: Re: Sending a "ping": Which (ICMP) ports must be open in firewall to receive answer ?
- Next by Date: Re: Kernel module
- Previous by thread: Re: IPSec, IPTables, multiple subnets
- Next by thread: Is it possible, bind has done but the OS still respond with ICMP destination unreachable
- Index(es):
Relevant Pages
|
