[strongSwan] Multiple connections same virtual pool without sharing FIXED

[Marwan Khalili]

Hi Tobias,

How does it do that?  Do you mean it allocates addresses from
10.0.0.0/24 to those clients?  (Without the server being aware of that,
which is not a good idea.)  Or does it NAT traffic from these devices to
the IP address it received from the VPN server?

The idea is that the client has its connection configured with e.g. “leftsubnet=192.168.1.0/24” and each device located on the 192.168.1.0/24 subnet allocates a virtual IP address from 10.0.0.0/24.

So why not use distinct subnets?  Reaching these devices from other
hosts (e.g. behind the VPN server, or the server itself) could be tricky
if they have the same IP addresses assigned.  And depending on the
traffic selector on the server's side and whether you use marks this
will actually result in duplicate IPsec policies, which won't work.

Many of our customers that are setting up these "clients" are already connected to a VPN when they wish to connect to the devices. To avoid conflicts, we thought the customer could select the virtual subnet. If it is possible to set up duplicate subnets, there is no need to check if a certain subnet is available for the customer to use.

And are you sure this would be easier with a site-to-site setup instead
of using virtual IP pools in the first place?  The IP addresses used on
the client end could still be "virtual IPs", i.e. only usable inside the
VPN, but they wouldn't be assigned by the server (to use duplicate
subnets is still tricky, though).

Yeah, any setup will do as long as we can duplicate the subnets. I was hoping that it could be done as I read in the Virtual IP wiki that it might have been possible before: “previously each connection would use it's own copy and the same virtual IP may have been handed out to different clients”.

Regards,

Marwan



On 16 Oct 2018, at 12:28, Tobias Brunner <tobias at strongswan.org<mailto:tobias at strongswan.org>> wrote:

Hi Marwan,

3. Client1 connects multiple devices to the VPN, each device has a
unique virtual IP address and can be accessed through Client1’s VPN

How does it do that?  Do you mean it allocates addresses from
10.0.0.0/24 to those clients?  (Without the server being aware of that,
which is not a good idea.)  Or does it NAT traffic from these devices to
the IP address it received from the VPN server?

6. Same as step3, however these devices are not accessible from
Client1’s VPN and vice versa

So why not use distinct subnets?  Reaching these devices from other
hosts (e.g. behind the VPN server, or the server itself) could be tricky
if they have the same IP addresses assigned.  And depending on the
traffic selector on the server's side and whether you use marks this
will actually result in duplicate IPsec policies, which won't work.

And are you sure this would be easier with a site-to-site setup instead
of using virtual IP pools in the first place?  The IP addresses used on
the client end could still be "virtual IPs", i.e. only usable inside the
VPN, but they wouldn't be assigned by the server (to use duplicate
subnets is still tricky, though).

Regards,
Tobias

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20181016/ed2652da/attachment-0001.html>