<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000066" bgcolor="#FFFFFF">
<p>Nothing. Hm.<br>
</p>
<br>
<div class="moz-cite-prefix">On 03/07/2018 06:47 AM, Info wrote:<br>
</div>
<blockquote type="cite"
cite="mid:36dcd919-e873-09bd-480f-525c7cf5191c@quantum-equities.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<p>Any input would be appreciated.<br>
</p>
<br>
<div class="moz-cite-prefix">On 03/05/2018 05:25 PM, Info wrote:<br>
</div>
<blockquote type="cite"
cite="mid:32674ef3-89d1-f2e2-6654-3a677c79e65f@quantum-equities.com">
<meta http-equiv="Content-Type" content="text/html;
charset=utf-8">
<br>
<div class="moz-cite-prefix">On 03/05/2018 12:13 PM, Info wrote:<br>
</div>
<blockquote type="cite"
cite="mid:3ba5fac9-fb33-a3b9-2afa-b6bc0d5e5ff6@quantum-equities.com">
<meta http-equiv="content-type" content="text/html;
charset=utf-8">
<p>I'm looking to VPN every machine in a LAN. I infer that
this would be something like a host-to-host config.</p>
<p>I'll use swanctl/vici and x509 certs.</p>
<p>I can't identify any configurations that seem right for
this at <br>
</p>
<p><a class="moz-txt-link-freetext"
href="https://www.strongswan.org/testing/testresults/swanctl/"
moz-do-not-send="true">https://www.strongswan.org/testing/testresults/swanctl/</a></p>
<p>Maybe? <a class="moz-txt-link-freetext"
href="https://www.strongswan.org/testing/testresults/swanctl/ip-pool/index.html"
moz-do-not-send="true">https://www.strongswan.org/testing/testresults/swanctl/ip-pool/index.html</a></p>
<p><br>
</p>
<p>Also, there is a machine outside on the Internet which I'd
like to join the party transparently. It's a mail server,
so somehow I'd like its mail traffic to not be VPNed, but
everything else to be. I guess this might be a roadwarrior
with some kind of split for the mail ports.</p>
</blockquote>
<br>
So my best idea, since IPSec is point-to-point, is to set up a
'hub and spoke' config. IOW designate one machine as the hub
and its remote_addrs are IPs of the multiple other members of
the LAN which will be in the VPN. Or maybe just the CIDR/24 of
the LAN. And all the other members would point to the hub with
their remote_addrs. The hub would be a juicy target for attack
though, and forwarding must be on.<br>
<br>
Of course the traffic selectors would be the CIDR/24 of the LAN,
although I haven't figured out how to include a remote machine
in the ts since its IP could change. Maybe I could use its
resolvable domain name, and DNAT it in through the firewall to
the hub. But this doesn't solve the problem of phones and
tablets which change outside IPs and don't have resolvable
domain names.<br>
<br>
And what would 'remote' id= be in the hub? %any?<br>
<br>
<br>
</blockquote>
<br>
</blockquote>
<br>
</body>
</html>