lkml.org 
[lkml]   [1999]   [May]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectmasq + VPN tunnel rules? weird lack of routing...
Hi guys.  Just purchased your O'Reilly VPN book, and am having a spot of
trouble. Would it be possible to look over the text below? I promise
that I am not a clueless newbie. :)

The problem: Setting up an ssh/PPP tunnel between two masq'd LANs, I
cannot ping any machine _past_ either gateway from a remote machine.
It seems like a routing or forward problem, but not sure. Below are
the current routing and forwarding rules.

Our setup is pretty simple. We have several Linux-based gateways at
each site. Each gateway has a static IP with some ISP, and that site's
LAN masqerades behind that. All our internal machines can talk through
the gateway to the Internet with no problem, so I know basic routing
and masquerading works fine.

On each gateway, in addition to the connection to the outside world, we
want to add a VPN to each site.

I have successfully constructing a tunnel using ssh and PPP. For example,
consider networks 10.0.1.0 and 10.10.10.0. Any machine on 10.10.10.0 can
ping the remote gateway (10.0.1.16), and any machine on 10.0.1.0 can ping
their remote gateway (10.10.10.1). However, any machine cannot ping any
other machine _beyond_ the remote gateway.

After the ssh/PPP tunnel is established, I simply add a single routing
rule for the remote VPN network (route add -net 10.10.10.0 gw 192.168.0.8)
on each side.

Any ideas why packets stop at the remote gateway? Maybe a masq or regular
forwarding rule needs to be added?

I have already tried a straightforward ipfwadm forwarding rule on each
gateway, without success.
Thanks for any insight,

Jeff




---------------------------------------------------------------------------
Atlanta office (10.0.1.0 net, 10.0.1.16 gateway, 2.0.36 stock RedHat kernel)
---------------------------------------------------------------------------
[slave9@finale slave9]$ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.0.1.254 0.0.0.0 255.255.255.255 UH 0 0 0 eth0:0
207.15.208.16 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0
192.168.0.8 0.0.0.0 255.255.255.255 UH 0 0 2 ppp2
10.0.1.0 0.0.0.0 255.255.255.0 U 0 0 182 eth0
10.10.10.0 192.168.0.8 255.255.255.0 UG 0 0 4 ppp2
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 62 lo
0.0.0.0 207.15.208.16 0.0.0.0 UG 0 0 824 ppp0

[slave9@finale slave9]$ ipfwadm -F -l
IP firewall forward rules, default policy: deny
type prot source destination ports
acc/m all 10.0.1.0/24 anywhere n/a

---------------------------------------------------------------------------
Atlanta home (10.10.10.0 net, 10.10.10.1 gateway, 2.0.36 stock RH kernel)
---------------------------------------------------------------------------
[jgarzik@bs-gw jgarzik]$ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.0.9 0.0.0.0 255.255.255.255 UH 0 0 2 ppp0
10.10.10.0 0.0.0.0 255.255.255.0 U 0 0 134 eth1
10.0.1.0 192.168.0.9 255.255.255.0 UG 0 0 3 ppp0
216.77.228.0 0.0.0.0 255.255.252.0 U 0 0 779 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 2 lo

[jgarzik@bs-gw jgarzik]$ ipfwadm -F -l
IP firewall forward rules, default policy: deny
type prot source destination ports
acc/m all 10.10.10.0/24 anywhere n/a


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:51    [W:0.028 / U:0.464 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site