problem with ipsec through a private IP gateway with the public IP segment bound to the DMZ

Hi list!

I have a somewhat annoying problem with a project of mine. The task sounds very simple: I had to establish a net-to-net connection between to linux-based firewalls (kernel 2.4.22 + xfs patch + MPPE/MPPC patch + strongswan 2.0.2 patch, just for info). The infrastructure looks like this:

Network 1:
 --------------------------     -------------------------------
| net 10.5.0.0/16 (LAN)    |---| eth1 (10.5.5.250)             |    ---------------
 --------------------------    |                               |   | Cisco Router  |
                               |            (192.168.1.1) eth0 |---| 192.168.1.254 |---> Internet
 --------------------------    |   (81.52.13.52=eth2:1) ipsec0 |   |               |   
| net 81.52.13.48/29 (DMZ) |---| eth2 (81.52.13.49)            |    ---------------    
 --------------------------    |                               |                       
                                -------------------------------                        

Network 2:
 --------------------------     -------------------------------
| net 10.48.0.0/16 (LAN)   |---| eth1 (10.48.5.250)            |    ---------------
 --------------------------    |                               |   | Cisco Router  |
                               |          (82.29.111.138) eth0 |---| 82.29.111.137 |---> Internet
                               |                   eth0=ipsec0 |   |               |   
                               | eth2 (N/A)                    |    ---------------    
                               |                               |
                                -------------------------------

the main goal is to establish a connection between 10.5.0.0/16 and 10.48.0.0/16 and so the problems began... The gateway in network1 doesn't accept the %defaultroute variable for the leftnexthop parameter, /var/run/ipsec.info only contains that line: "#dr: no default route" Without the "leftnexthop" parameter freeswan tries to set a route which looks like this "ip route add 10.48.0.0/16 via 82.29.111.138 dev ipsec0" and so the tunnel fails with a "network unreachable" error. This seems to be clear and so I tried to do what I thought is the next best thing: use the IP of the default gateway (which is 192.168.1.254). Well that brought me no step further, same error, only with the 192.168.1.254 instead of 82.29.111.138. So I'll tried a little trick: I'll used 81.52.13.49 as "gateway" address - and the result was:

002 "net-to-net" #3: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP {using isakmp#1}
112 "net-to-net" #3: STATE_QUICK_I1: initiate
002 "net-to-net" #3: sent QI2, IPsec SA established {ESP=>0x7849df36 <0xaf023a59}
004 "net-to-net" #3: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x7849df36 <0xaf023a59}

seems good to me...

the gateway in network2 was easier to handle: it worked with %defaultroute, but now I had (formally) two different setup's which I ignored, because I thought the result would be the same. Here the actual setup:

gateway #1:
version 2.0     # conforms to second version of ipsec.conf specification

config setup
        interfaces="ipsec0=eth2:1"
        klipsdebug=all
        plutodebug=all
        nat_traversal=no
        strictcrlpolicy=no

conn block
        auto=ignore

conn clear
        auto=ignore

conn private
        auto=ignore

conn private-or-clear
        auto=ignore

conn clear-or-private
        auto=ignore

conn packetdefault
        auto=ignore

conn net-to-net
    type=tunnel
    left=81.52.13.52
    leftsubnet=10.5.0.0/16
    leftid=@leftid
    leftrsasigkey=0sAQOHq.....
    leftnexthop=81.52.13.49
    right=82.29.111.138
    rightsubnet=10.48.0.0/16
    rightid=@rightid
    rightrsasigkey=0sAQOgO7....
    auto=start
    authby=rsasig
    disablearrivalcheck=no

gateway #2:
conn net-to-net
    type=tunnel
    left=81.52.13.52
    leftsubnet=10.5.0.0/16
    leftid=@leftid
    leftrsasigkey=0sAQOHq...
    leftnexthop=%defaultroute
    right=82.29.111.138
    rightsubnet=10.48.0.0/16
    rightid=@rightid
    rightrsasigkey=0sAQOg...
    rightnexthop=%defaultroute
    auto=add
    authby=rsasig

on both sides, the tunnels appear to be up, but... if I ping from e. g. 10.5.2.22 to 10.48.5.250 I can't see any traffic running through eth0 on gateway #1. I do see the ping on ipsec0 on gateway #1, and I do see ESP packets (and IKE as well) going between the two security gateways, but ESP only from gatway #2 to gateway #1 not the other way round. I thought this might be the result of my "false" routing on gateway #1 (ip route add 10.48.0.0/16 via 80.120.2.49 dev ipsec0), so I deleted the route manually and added the following: ip route add 10.48.0.0/16 dev ipsec0 - with the same results. The debug messages of Pluto and klips doesn't show up any error so where's the problem?
Please help me, before I go insane with that stuff... 

Greetings and many thanks for any help in advance,
Horst

Horst Rohrweck
Software Engineer
 
itsoft Software GmbH
Ennser Straße 154
A-4407 Dietach
 
PHONE: +43.7252.39002.207
FAX: +43.7252.39002.400
E-MAIL: horst <DOT> rohrweck <AT> itsoft <DOT> at
WEB: http://www.itsoft.at