Re: IPSec vs. NAT vs. Route

David,

keep your hands off NAT and rdr, and IMHO even "classic" routing. As Chuck
says, IPsec is a virtual network.

What you are trying to do should work as you expect. There must be an
error in one of your machine's config, namely the section where
the other side's network parameters are configured something like...

[Net-Toronto]
ID-type=		IPV4_ADDR_SUBNET
Network=		192.168.1.0
Netmask=		255.255.255.0

[Net-Dallas]
ID-type=		IPV4_ADDR_SUBNET
Network=		192.168.2.0
Netmask=		255.255.255.0

When the tunnel is up, routes are automatically added. This is why you
CANNOT have the same subnets on either side and why you CAN route to RFC
1918 addresses.

ALso: do a netstat -rn -f encap on both machines and look for errors.

And read the FAQ!

Regards

Dirk 

On Mon, 22 Jul 2002, David Simmons wrote:

> First off, I'd like to thank those who recently helped shed some light onto
> the whole topic of secure VPN connections!
> 
> It seems like I'm missing the last piece of the puzzle that stumps me as to
> the best approach to take:  NAT / Route / rdr ??
> 
> Alot of this roots back to one of my original questions that I haven't found
> a good answer on, how does a network route traffic to this VPN connection
> without a change in Gateways?
> 
> Here's my current setup:
> 
>          Toronto:                                   Dallas:
> 192.168.1.4<->OpenBSD<->Static<->Internet<->Static<->OpenBSD<->192.168.2.1
>   ^^Not Gateway                                              IS Gateway^^
> 
> While I currently have encrypted connections running between the two Unix
> machines (with Windows users 'past' them) - it seems I still have a routing
> problem, because I can ping in one direction, but can't the other.  While
> working on one machine in Toronto, if I add a static route to the new
> network with a different gateway, it worked liked a charm (using:  route add
> 192.168.2.0 mask 255.255.255.0 192.168.1.4)...and it keeps aludes me as to
> how the packets will find the 'new' network without a proper gateway or
> route? (ie. I'd like to NOT have to manually type a route command on all
> machines)
> 
> Q:  Do I need to setup NAT on the Unix machine so that it will translate the
> 'others' network packets to the 'local'(seems counter productive to the
> whole reason for a VPN)?  Do you just have to manually route each machine?
> Or do you modify the current Gateway with re-direct type command if packets
> show up for the alternate network (basically doing a redirect to the new
> gateway)?
> 
> Thanks again...I can see the light...and I'm hoping it's not the oncoming
> train....
> 
> dave
> 
>