Messages in this thread | | | Date | Fri, 14 May 1999 12:11:25 -0400 (EDT) | From | Jeff Garzik <> | Subject | masq + VPN tunnel rules? weird lack of routing... |
| |
Hi guys. Just purchased your O'Reilly VPN book, and am having a spot of trouble. Would it be possible to look over the text below? I promise that I am not a clueless newbie. :)
The problem: Setting up an ssh/PPP tunnel between two masq'd LANs, I cannot ping any machine _past_ either gateway from a remote machine. It seems like a routing or forward problem, but not sure. Below are the current routing and forwarding rules.
Our setup is pretty simple. We have several Linux-based gateways at each site. Each gateway has a static IP with some ISP, and that site's LAN masqerades behind that. All our internal machines can talk through the gateway to the Internet with no problem, so I know basic routing and masquerading works fine.
On each gateway, in addition to the connection to the outside world, we want to add a VPN to each site.
I have successfully constructing a tunnel using ssh and PPP. For example, consider networks 10.0.1.0 and 10.10.10.0. Any machine on 10.10.10.0 can ping the remote gateway (10.0.1.16), and any machine on 10.0.1.0 can ping their remote gateway (10.10.10.1). However, any machine cannot ping any other machine _beyond_ the remote gateway.
After the ssh/PPP tunnel is established, I simply add a single routing rule for the remote VPN network (route add -net 10.10.10.0 gw 192.168.0.8) on each side.
Any ideas why packets stop at the remote gateway? Maybe a masq or regular forwarding rule needs to be added?
I have already tried a straightforward ipfwadm forwarding rule on each gateway, without success. Thanks for any insight,
Jeff
--------------------------------------------------------------------------- Atlanta office (10.0.1.0 net, 10.0.1.16 gateway, 2.0.36 stock RedHat kernel) --------------------------------------------------------------------------- [slave9@finale slave9]$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.1.254 0.0.0.0 255.255.255.255 UH 0 0 0 eth0:0 207.15.208.16 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0 192.168.0.8 0.0.0.0 255.255.255.255 UH 0 0 2 ppp2 10.0.1.0 0.0.0.0 255.255.255.0 U 0 0 182 eth0 10.10.10.0 192.168.0.8 255.255.255.0 UG 0 0 4 ppp2 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 62 lo 0.0.0.0 207.15.208.16 0.0.0.0 UG 0 0 824 ppp0
[slave9@finale slave9]$ ipfwadm -F -l IP firewall forward rules, default policy: deny type prot source destination ports acc/m all 10.0.1.0/24 anywhere n/a
--------------------------------------------------------------------------- Atlanta home (10.10.10.0 net, 10.10.10.1 gateway, 2.0.36 stock RH kernel) --------------------------------------------------------------------------- [jgarzik@bs-gw jgarzik]$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.0.9 0.0.0.0 255.255.255.255 UH 0 0 2 ppp0 10.10.10.0 0.0.0.0 255.255.255.0 U 0 0 134 eth1 10.0.1.0 192.168.0.9 255.255.255.0 UG 0 0 3 ppp0 216.77.228.0 0.0.0.0 255.255.252.0 U 0 0 779 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 2 lo
[jgarzik@bs-gw jgarzik]$ ipfwadm -F -l IP firewall forward rules, default policy: deny type prot source destination ports acc/m all 10.10.10.0/24 anywhere n/a
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |