MESSAGE
DATE | 2002-11-09 |
FROM | Ruben I Safir
|
SUBJECT | Subject: [hangout] Can't Ping Subnet Behind VPN
|
Hello
I have a network which looks like this on GNU/Linux - Win200 _____________________________________ |64.0.231.99 192.168.0.130 | _______________ ________________________________ |---------|RH 7.2 VPN Gateway |------| |192.168.1.100 | |192.168.1.1 66.114.66.239| | |____________________________________| | | w200 |----|SUSE 8.0 VPN Gatewat|---DSL Gateway ------DSL Router/GW----| | |______________| |______________________________| 66.114.66.1 64.0.231.97 | | | _______________________________________ HUB---- |--------|64.0.231.98 192.168.0.100 | | | |RH 7.2 GW | | | | |------ | |______________________________________| | | _______________________________________________ | | 192.168.0.110 RH Gateway SMB Server Intrantet| | |______SUPERMAN________________________________| | |------------------------------------------------------------------------------------------------------------------------|
My problem is I can ping the intranet server SUPERMAN from the outside I can not ping the W200 Machine from inside from the 64.0.231.99 FrereSWAN Gateway.
I'm very puzzled by this
The internal Routing looks like this on the VPN gateway
[root-at-phantom /root]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 216.254.100.195 64.0.231.97 255.255.255.255 UGH 0 0 0 ipsec0 64.105.122.138 64.0.231.97 255.255.255.255 UGH 0 0 0 ipsec0 66.114.66.239 64.0.231.97 255.255.255.255 UGH 0 0 0 ipsec0 64.0.231.96 0.0.0.0 255.255.255.248 U 0 0 0 eth1 64.0.231.96 0.0.0.0 255.255.255.248 U 0 0 0 ipsec0 10.0.0.0 64.0.231.97 255.255.255.0 UG 0 0 0 ipsec0 192.168.1.0 64.0.231.97 255.255.255.0 UG 0 0 0 ipsec0 192.168.0.0 192.168.0.130 255.255.255.0 UG 0 0 0 eth0 192.168.0.0 192.168.0.100 255.255.255.0 UG 0 0 0 eth0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 64.0.231.97 0.0.0.0 UG 0 0 0 eth1
The routing on the EXTERNAL VPN Gateway looks like this currently.
david:~ # route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 64.0.231.99 66.114.66.1 255.255.255.255 UGH 0 0 0 ipsec0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 192.168.0.0 66.114.66.1 255.255.255.0 UG 0 0 0 ipsec0 66.114.66.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 66.114.66.0 0.0.0.0 255.255.255.0 U 0 0 0 ipsec0 0.0.0.0 66.114.66.1 0.0.0.0 UG 0 0 0 eth0
I've tried adding a gw route to the 192.168.1.0 network and it seems to do something weird
route add 192.168.1.0 gw david-gw dev eth1
david:~ # route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.1.0 192.168.1.1 255.255.255.255 UGH 0 0 0 eth1 64.0.231.99 66.114.66.1 255.255.255.255 UGH 0 0 0 ipsec0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 192.168.0.0 66.114.66.1 255.255.255.0 UG 0 0 0 ipsec0 66.114.66.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 66.114.66.0 0.0.0.0 255.255.255.0 U 0 0 0 ipsec0 0.0.0.0 66.114.66.1 0.0.0.0 UG 0 0 0 eth0
That seems to give it a 192.168.1.0 255.255.255.255 host mask?
I also have port forwarding an IP Tables up for Masquarading on the outside iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE echo 1 > /proc/sys/net/ipv4/ip_forward
And the same for the inside
Traceroute from the outside looks right: traceroute to superman.rm-cpa.com (192.168.0.110), 30 hops max, 40 byte packets 1 ghost.rm-cpa.com (64.0.231.99) 25 ms 26 ms 25 ms 2 superman.rm-cpa.com (192.168.0.110) 24 ms 25 ms 25 ms
>From the inside in stalls traceroute to david-home.rm-cpa.com (192.168.1.100), 30 hops max, 38 byte packets 1 * * * 2 * * * 3 * * *
Ruben
__________________________ Brooklyn Linux Solutions __________________________ DRM is THEFT - We are the STAKEHOLDERS http://fairuse.nylxs.com
http://www.mrbrklyn.com - Consulting http://www.inns.net <-- Happy Clients http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive or stories and articles from around the net http://www2.mrbrklyn.com/downtown.html - See the New Downtown Brooklyn....
1-718-382-0585 ____________________________ New Yorker Free Software Users Scene Fair Use - because it's either fair use or useless....
|
|