Re: IPSec vs. NAT vs. Route

You'll get better answers on the general OpenBSD (or any Unix)
lists than the limited audience here.

That said, the two OpenBSD boxes labelled below should be
able to IPSEC to each other and you send packets for the
OTHER network through the IPsec tunnel.  So 192.168.1.4
has a route for 192.168.2/24 through OpenBSD (left).
OpenBSD (left) has a route for 192.168.2/24 through it's
IPSec device.

Quoting David Simmons ([email protected]):
> First off, I'd like to thank those who recently helped shed some light onto
> the whole topic of secure VPN connections!
> 
> It seems like I'm missing the last piece of the puzzle that stumps me as to
> the best approach to take:  NAT / Route / rdr ??
> 
> Alot of this roots back to one of my original questions that I haven't found
> a good answer on, how does a network route traffic to this VPN connection
> without a change in Gateways?
> 
> Here's my current setup:
> 
>          Toronto:                                   Dallas:
> 192.168.1.4<->OpenBSD<->Static<->Internet<->Static<->OpenBSD<->192.168.2.1
>   ^^Not Gateway                                              IS Gateway^^
> 
> While I currently have encrypted connections running between the two Unix
> machines (with Windows users 'past' them) - it seems I still have a routing
> problem, because I can ping in one direction, but can't the other.  While
> working on one machine in Toronto, if I add a static route to the new
> network with a different gateway, it worked liked a charm (using:  route add
> 192.168.2.0 mask 255.255.255.0 192.168.1.4)...and it keeps aludes me as to
> how the packets will find the 'new' network without a proper gateway or
> route? (ie. I'd like to NOT have to manually type a route command on all
> machines)
> 
> Q:  Do I need to setup NAT on the Unix machine so that it will translate the
> 'others' network packets to the 'local'(seems counter productive to the
> whole reason for a VPN)?  Do you just have to manually route each machine?
> Or do you modify the current Gateway with re-direct type command if packets
> show up for the alternate network (basically doing a redirect to the new
> gateway)?
> 
> Thanks again...I can see the light...and I'm hoping it's not the oncoming
> train....
> 
> dave