<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<div class="moz-text-html" lang="x-unicode"><tt>Hi list,</tt><tt><br>
</tt><tt><br>
</tt><tt>I have a running config that must be updated because some of the routing is not working.</tt><tt><br>
</tt><tt>The remote site is not managed by us so we can't easily change its configuration (but it may not be necessary thought).</tt><tt><br>
</tt><tt><br>
</tt><tt>As of today, from the local server (10.15.130.5), we can ping the remote site, but we can't ping the local machines (10.15.130.254 for
</tt><tt>example</tt><tt>).</tt><tt><br>
</tt><tt>From the local network (say 10.15.130.2), we can ping the remote side when a gateway is set to the
</tt><tt>local vpn server (10.15.130.5).</tt><tt><br>
</tt><tt>From another local network (10.20.0.0/24, out of the remote network range) I can ssh to the local vpn host (the gateway 10.15.130.254 is working fine)</tt><tt><br>
</tt><tt><br>
</tt><tt>Note that the remote use a 10.0.0.0/12 network that overlap our network side (10.15.130.0/24). I tried to set up an exclusion with "virtual_private".</tt><tt><br>
</tt><tt><br>
</tt><tt>This is driving me nut !<br>
Could someone have a look at this configuration and spot the mistake we made ?</tt><tt><br>
</tt><tt><br>
I can't understand how this could work now (can't ping the gateway but the traffic is going thru, can't ping same network hosts)</tt><tt>, also I don't know why the ip xfrm policy show 4 times the same 0.0.0.0 rules<br>
</tt><tt><br>
</tt><tt>Here are the details of the actual setup, and again any help appreciated !</tt><tt><br>
</tt><tt><br>
</tt><tt>---<br>
Linux Openswan U2.6.49/K3.2.0-4-amd64 (netkey)</tt><tt><br>
</tt><tt>Debian 3.2.68-1+deb7u3 x86_64 GNU/Linux<br>
</tt><tt>---</tt><tt><br>
</tt><tt>config setup</tt><tt><br>
</tt><tt> nat_traversal=yes</tt><tt><br>
</tt><tt> protostack=netkey</tt><tt><br>
</tt><tt> interfaces=%defaultroute</tt><tt><br>
</tt><tt> oe=off</tt><tt><br>
</tt><tt> # we exclude our local network from </tt><tt>being</tt><tt> routed through the tunnel</tt><tt><br>
</tt><tt> virtual_private=%v4:10.0.0.0/12,%v4:!10.15.130.0/24</tt><tt><br>
</tt><tt><br>
</tt><tt>conn mypeer</tt><tt><br>
</tt><tt> type=tunnel</tt><tt><br>
</tt><tt> compress=yes</tt><tt><br>
</tt><tt> aggrmode=no</tt><tt><br>
</tt><tt> authby=secret</tt><tt><br>
</tt><tt> forceencaps=yes</tt><tt><br>
</tt><tt> ikev2=no</tt><tt><br>
</tt><tt> ike=aes256-sha1</tt><tt><br>
</tt><tt> ikelifetime=24h</tt><tt><br>
</tt><tt> keylife=1h</tt><tt><br>
</tt><tt> pfs=yes</tt><tt><br>
</tt><tt> dpddelay=0</tt><tt><br>
</tt><tt> dpdtimeout=0</tt><tt><br>
</tt><tt> auto=start</tt><tt><br>
</tt><tt><br>
</tt><tt> left=10.15.130.5</tt><tt><br>
</tt><tt> leftsourceip=10.15.130.5</tt><tt><br>
</tt><tt> leftsubnet=10.15.130.0/24</tt><tt><br>
</tt><tt><br>
</tt><tt> right=<remote_public_ip></tt><tt><br>
</tt><tt> rightsourceip=<remote_public_ip></tt><tt><br>
</tt><tt> rightsubnet=10.0.0.0/12</tt><tt><br>
</tt><tt><br>
</tt><tt>---</tt><tt><br>
</tt><tt><br>
</tt><tt>ip route show</tt><tt><br>
</tt><tt>default via 10.15.130.254 dev eth0 </tt><tt><br>
</tt><tt>10.0.0.0/12 dev eth0 scope link src 10.15.130.5 </tt><tt><br>
</tt><tt>10.15.130.0/24 dev eth0 proto kernel scope link src 10.15.130.5</tt><tt><br>
</tt><tt><br>
</tt><tt>---</tt><tt><br>
</tt><tt><br>
</tt><tt>ip xfrm policy</tt><tt><br>
</tt><tt>src 10.15.130.0/24 dst 10.0.0.0/12</tt><tt><br>
</tt><tt> dir out priority 2356 ptype main</tt><tt><br>
</tt><tt> tmpl src 10.15.130.5 dst </tt><tt><remote_public_ip></tt><tt><br>
</tt><tt> proto esp reqid 16385 mode tunnel</tt><tt><br>
</tt><tt>src 10.0.0.0/12 dst 10.15.130.0/24 </tt><tt><br>
</tt><tt> dir fwd priority 2356 ptype main </tt><tt><br>
</tt><tt> tmpl src </tt><tt><remote_public_ip></tt><tt> </tt><tt>dst 10.15.130.</tt><tt>5</tt><tt><br>
</tt><tt> proto esp reqid 16385 mode tunnel</tt><tt><br>
</tt><tt>src 10.0.0.0/12 dst 10.15.130.0/24 </tt><tt><br>
</tt><tt> dir in priority 2356 ptype main </tt><tt><br>
</tt><tt> tmpl src </tt><tt><remote_public_ip></tt><tt> dst 10.15.13</tt><tt>0.5</tt><tt><br>
</tt><tt> proto esp reqid 16385 mode tunnel</tt><tt><br>
</tt><tt>src 0.0.0.0/0 dst 0.0.0.0/0 </tt><tt><br>
</tt><tt> socket out priority 0 ptype main </tt><tt><br>
</tt><tt>src 0.0.0.0/0 dst 0.0.0.0/0 </tt><tt><br>
</tt><tt> socket in priority 0 ptype main </tt><tt><br>
</tt><tt>src 0.0.0.0/0 dst 0.0.0.0/0 </tt><tt><br>
</tt><tt> socket out priority 0 ptype main </tt><tt><br>
</tt><tt>src 0.0.0.0/0 dst 0.0.0.0/0 </tt><tt><br>
</tt><tt> socket in priority 0 ptype main </tt><tt><br>
</tt><tt>src 0.0.0.0/0 dst 0.0.0.0/0 </tt><tt><br>
</tt><tt> socket out priority 0 ptype main </tt><tt><br>
</tt><tt>src 0.0.0.0/0 dst 0.0.0.0/0 </tt><tt><br>
</tt><tt> socket in priority 0 ptype main </tt><tt><br>
</tt><tt>src 0.0.0.0/0 dst 0.0.0.0/0 </tt><tt><br>
</tt><tt> socket out priority 0 ptype main </tt><tt><br>
</tt><tt>src 0.0.0.0/0 dst 0.0.0.0/0 </tt><tt><br>
</tt><tt> socket in priority 0 ptype main</tt><tt><br>
</tt><tt><br>
</tt><tt>---</tt><tt><br>
</tt></div>
<p><br>
</p>
<p><br>
<!--?php header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header ("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); // Date du passé //definition du type de contenu header("Content-Type: image/png");
?--></p>
<p><span style="font-family:verdana,geneva,sans-serif"><span style="font-size:17px"><strong>Vincent Gatignol</strong></span><br>
<span style="font-size:14px"><em>IT Infrastructure Manager</em></span></span></p>
<p><span style="font-family:verdana,geneva,sans-serif"><span style="font-size:13px"><strong>+33 (0)6 64 61 86 97</strong></span><br>
<span style="font-size:14px"><a href="http://braincube.com?utm_source=signature&utm_medium=e-mail&utm_campaign=lien_site_braincube">www.braincube.com
</a></span></span></p>
<p><a href="http://braincube.com/magazine/?utm_source=signature&utm_medium=e-mail&utm_campaign=connected_factory_1" target="_blank"><img src="https://cdn.mybraincube.com/mail/img.png"></a></p>
<p> </p>
</body>
</html>