Re: IPSec vs. NAT vs. Route

Quoting David Simmons ([email protected]):
> > You'll get better answers on the general OpenBSD (or any Unix)
> > lists than the limited audience here.
> 
> quite honestly - I'm sure you've seen the tension/flamewar..seems best to
> search for knowledge elsewhere?

Yeah?  And...

The answers are there.  Asbestos is only harmful in real life,
not e-land.  OTOH, you could start using NetBSD.  It's not as
unsecure as Open zealots would make it; it's just as portable,
perhaps a bit more innovative.  Far less hostile.


> > That said, the two OpenBSD boxes labelled below should be
> > able to IPSEC to each other and you send packets for the
> > OTHER network through the IPsec tunnel.  So 192.168.1.4
> > has a route for 192.168.2/24 through OpenBSD (left).
> > OpenBSD (left) has a route for 192.168.2/24 through it's
> > IPSec device.
> 
> Very true...but my goal is to have the windows users on the two 192.168.*
> networks to be able to 'play together' (ie. file transfer/printers/etc).
> Which leads me to the NAT and/or Routing questions..it's how to get the
> other computers on those networks to talk 'through' the IPSec machine (which
> are NOT currently the gateways)

You use ROUTING to get the packets from the networks they are on
to the interfaces you need.  A VPN is a (virtual) NETWORK.  Traverse
it.  Ignore the comments about default routes, you can just use
a routing protocol.  Even Windows 3.1 speak routed(8).