[strongSwan] virtual interfaces for net to net tunneling (is it possible?)

[Martin Willi]

Hi Anthony,

> but I’m using a virtual interface to route this machines together

"virtual" interfaces (along with ifconfig) are an outdated concept on
Linux 2.6. I'd recommend the "ip" command from iproute2 to simply add an
additional address to the interface.

Assuming 
> 66.199.171.245
is external, and
> 192.168.100.181
is internal.

The problem is:
>     rightsourceip=192.168.100.0/24
is the same subnet as on the local LAN. LAN hosts won't route traffic to
the gateway. They expect that the host is on the LAN and try to find
them with ARP.

I recently have developed the farp plugin, an ARP faker (--enable-farp).
It fakes ARP responses for all IP addresses that you have assigned to
VPN clients, allowing the gateway to route that traffic.

Also check for address conflicts, you probably will assign already used
LAN addresses to VPN clients with this config. You might have a look at
the dhcp plugin (--enable-dhcp), it gets local LAN addresses from the
DHCP server (set rightsourceip=%dhcp).

Finally double check if IP forwarding is enabled
(/proc/sys/net/ipv4/ip_forward).

Regards
Martin