Re: Checkpoint-Firewall and routing in green Network

On Tue, 17 Oct 2017, David Sims wrote:

>
>
> On Tue, 17 Oct 2017, Christoph Mitteregger wrote:
>
> > Hello All,
> >
> >
> >
> > I already searched the net but couldn't find an answer.
> >
> > Perhaps someone can help me with my problem.
> >
> >
> >
> > I have an IpCop Firewall version 2.1.9.
> >
> > I have a green and red network.
> >
> >
> >
> > We got a Checkpoint-Firewall(establish VPN) from another company which
> > should allow the traffic between these two networks.
> >
> > The VPN Tunnel is already established by allowing the traffic from source IP
> > over the red interface to the Checkpoint-Firewall.
> >
> >
> >
> > Now my Problem:
> >
> > Let's say the internal green Network is 192.168.15.0/24.
> >
> > The gateway(IPCOP Firewall) has 192.168.15.2
> >
> > The Checkpoint-Firewall has 172.21.105.0/24.
> >
> > The IP of the Checkpoint-Firewall is 172.21.105.1
> >
> > The IP of the Checkpoint-Firewall for establishing the VPN in our net is
> > 192.168.15.250
> >
> >
> >
> > I now want to enable the routing between these two networks which both are
> > on the green Network.
> >
> > I read that to allow routing between green and green I have to add
> >
> >  /sbin/iptables -A CUSTOMFORWARD -i lan-1 -o -lan-1 -j ACCEPT
> >
> > to rc.firewall.local. Lan-1 is the interface of the green network.
> >
> >
> >
> > I also added
> >
> > /sbin/iptables -I FORWARD -I lan-1 -s 192.168.15.0/24 -d 172.21.105.0/24 -j
> > ACCEPT
> >
> > /sbin/iptables -I FORWARD -I lan-1 -s 172.21.105.0/24 -d 192.168.15.0/24 -j
> > ACCEPT
> >
> > to rc.firewall.local
> >
> >
> >
> >
> >
> > And the next line in
> >
> > route add -net 172.21.105.0/24 gw 192.168.15.250
> >
> > rc.event.local.
> >
> >
> >
> > But nothing is working. I'm unable to reach 172.21.105.0 from 192.168.15.0
> > and the other way around.
> >
> > The Costumer from whom I have the Checkpoint-Firewall also told me that I
> > have to set up e.g. 172.21.105.x on our firewall so that all routing/traffic
> > is going over this IP.
> >
> >
> >
> > What am I missing at this point?
> >
> > It would be great if someone could help me please.
>
> Hi Christoph,
>
>   From the console of the IPCop machine, can you ping a host on the LAN
> behind the Checkpoint?? Does the IPCop VPN page show the tunnel as UP??
>
>   It's been a while since I have used IPSec with IPCop, but in the past I
> have made it work fairly reguarly, even with LinkSys VPN boxes... The only
> thing I remember that you have to do is to match up the available crypto
> on the IPCop box with the available crypto at the other end of the
> tunnel.. Look on the IPCop VPN "advanced" page....
>
> Regards,
>
> Dave Sims
>

Hi again,

On further review of your setup above, it doesn't look like you have any
public addressing referred to.... Is the tunnel you are trying to
establish supposed to traverse the Internet or is it on a private
network??

Dave

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user