<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 7/20/2017 16:46, peljasz wrote:<br>
</div>
<blockquote type="cite"
cite="mid:04aeb58b-dff4-d578-5094-e9e7ddada663@yahoo.co.uk">
<br>
<br>
On 20/07/17 21:57, Karl Denninger wrote:
<br>
<blockquote type="cite">
<br>
That can be made to work provided you do not need inbound
connections to things on the client side.
<br>
<br>
<br>
</blockquote>
exactly like that.
<br>
How to even phrase a query to find docs/howtos on such a setup?
<br>
Or, tips on setup/config much appreciated - I have a working
client to site setup - is it only strongswan or/and routing/nating
outside of swan?
<br>
<br>
many thanks.
<br>
L
<br>
<br>
</blockquote>
<br>
There's really nothing specific related to StrongSwan there other
than not mapping your own client NAT implementation on top of
whatever address/subnet the VPN gateway gives you.<br>
<br>
Essentially your client is responsible for NATting the
client-attached traffic which is then sent to the VPN gateway, which
(presumably) will NAT it again. It should work with few potential
issues (the big one being if you have a UDP client of some sort and
the intermediate NAT times out on stateful tables you'll lose some
replies, but this usually isn't much of a factor.)<br>
<br>
This is, in essence, what running a Hotspot that is also a
StrongSwan client back to a server winds up being -- the VPN server
is NATing traffic to the Internet, and the Hotspot is NATing traffic
for its attached clients. It should all "just work" in most cases.<br>
<br>
Since you said you have no control over the server I'm assuming you
can't have the server side hand you a subnet which you can then hand
out hosts from and are forced to NAT into a single
dynamically-assigned IP address that the gateway hands you (and
which is likely to change with each connection.)<br>
<br>
<blockquote type="cite"
cite="mid:04aeb58b-dff4-d578-5094-e9e7ddada663@yahoo.co.uk">
<blockquote type="cite">On 7/20/2017 15:50, peljasz wrote:
<br>
<blockquote type="cite">hi fellas
<br>
a novice here, whois reading up but was hoping someone
knowsalready and can shed some light on..
<br>
<br>
how to, if possible at all, have a client that calls out to a
server(site) and that client would route(nat) other nodes on
it's local lan to the site(server)?
<br>
<br>
I'd only hope that if possible that this is all down to the
"client" as over the server I have nocontrolwhatsoever.
<br>
<br>
many thanks
<br>
L.
<br>
</blockquote>
<br>
-- <br>
Karl Denninger
<br>
<a class="moz-txt-link-abbreviated" href="mailto:karl@denninger.net">karl@denninger.net</a> <a class="moz-txt-link-rfc2396E" href="mailto:karl@denninger.net"><mailto:karl@denninger.net></a>
<br>
/The Market Ticker/
<br>
/[S/MIME encrypted email preferred]/
<br>
</blockquote>
<br>
</blockquote>
<br>
<div class="moz-signature">-- <br>
Karl Denninger<br>
<a href="mailto:karl@denninger.net">karl@denninger.net</a><br>
<i>The Market Ticker</i><br>
<font size="-2"><i>[S/MIME encrypted email preferred]</i></font>
</div>
</body>
</html>