* [gentoo-user-br] VPN ipsec
@ 2010-11-24 15:01 Ricardo Felix
2010-11-24 15:06 ` RES: " Eduardo Schoedler
0 siblings, 1 reply; 2+ messages in thread
From: Ricardo Felix @ 2010-11-24 15:01 UTC (permalink / raw
To: gentoo-user-br
Boa tarde galera, uma pergunta aqui que já to suando.
Alguém por aqui já criou uma VPN Ipsec com openswan e um Juniper SSG520 ?
Consigo colocar a VPN no Ar, mas o tráfego não passa de uma ponta a outra....
meus arquivos de conf...
ipsec.conf
conn HQtoDC
type=tunnel
left=189.38.x.x
leftsubnet=172.16.16.0/24
leftnexthop=200.160.x.x
right=200.160.x.x
rightsubnet=172.16.18.0/24
pfs=yes
keyingtries=0
aggrmode=no
auto=start
auth=esp
esp=3des-sha1-96
ike=3des-sha1-96
authby=secret
minha tabela de rotas após subir o ipsec
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref
Use Iface
201.6.249.136 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
200.207.121.196 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
200.204.154.71 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
201.81.231.236 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
74.125.93.121 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
201.81.224.243 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
200.171.213.106 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
200.158.83.246 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
200.160.255.48 189.38.250.1 255.255.255.240 UG 0 0 0 eth0
172.16.18.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
189.38.250.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
172.16.16.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
187.38.0.0 0.0.0.0 255.255.240.0 U 0 0 0 eth3
10.0.0.0 10.0.0.1 255.255.0.0 UG 0 0 0 eth2
74.125.0.0 189.38.250.1 255.255.0.0 UG 0 0 0 eth0
0.0.0.0 187.38.0.1 0.0.0.0 UG 0 0 0 eth3
Comandos iptables para permitir o tráfego entre as redes.
iptables -t nat -A POSTROUTING -o eth0 -s 172.16.16.0/24 -d !
172.16.18.0/24 -j MASQUERADE
iptables -A FORWARD -p tcp -i eth0 -s 172.16.18.0/24 -o eth1 -d
172.16.16.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -i eth1 -s 172.16.16.0/24 -o eth0 -d
172.16.18.0/24 -j ACCEPT
Não pego pacotes sendo dropados no linux.
Alguma ideia iluminada...?
Abraços
Ricardo Felix do Nascimento
^ permalink raw reply [flat|nested] 2+ messages in thread
* RES: [gentoo-user-br] VPN ipsec
2010-11-24 15:01 [gentoo-user-br] VPN ipsec Ricardo Felix
@ 2010-11-24 15:06 ` Eduardo Schoedler
0 siblings, 0 replies; 2+ messages in thread
From: Eduardo Schoedler @ 2010-11-24 15:06 UTC (permalink / raw
To: gentoo-user-br
Talvez o pessoal do MASOCH-L conseguirá te ajudar melhor...
https://eng.registro.br/mailman/listinfo/masoch-l
Abraço,
--
Eduardo Schoedler
> -----Mensagem original-----
> De: Ricardo Felix [mailto:felix.ricardo@gmail.com]
> Enviada em: quarta-feira, 24 de novembro de 2010 13:02
> Para: gentoo-user-br@lists.gentoo.org
> Assunto: [gentoo-user-br] VPN ipsec
>
> Boa tarde galera, uma pergunta aqui que já to suando.
> Alguém por aqui já criou uma VPN Ipsec com openswan e um Juniper SSG520
> ?
>
> Consigo colocar a VPN no Ar, mas o tráfego não passa de uma ponta a
> outra....
>
> meus arquivos de conf...
>
> ipsec.conf
>
> conn HQtoDC
> type=tunnel
> left=189.38.x.x
> leftsubnet=172.16.16.0/24
> leftnexthop=200.160.x.x
> right=200.160.x.x
> rightsubnet=172.16.18.0/24
> pfs=yes
> keyingtries=0
> aggrmode=no
> auto=start
> auth=esp
> esp=3des-sha1-96
> ike=3des-sha1-96
> authby=secret
>
>
> minha tabela de rotas após subir o ipsec
>
> Kernel IP routing table
> Destination Gateway Genmask Flags Metric Ref
> Use Iface
> 201.6.249.136 189.38.250.1 255.255.255.255 UGH 0 0 0
> eth0
> 200.207.121.196 189.38.250.1 255.255.255.255 UGH 0 0 0
> eth0
> 200.204.154.71 189.38.250.1 255.255.255.255 UGH 0 0 0
> eth0
> 10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0
> tun0
> 201.81.231.236 189.38.250.1 255.255.255.255 UGH 0 0 0
> eth0
> 74.125.93.121 189.38.250.1 255.255.255.255 UGH 0 0 0
> eth0
> 201.81.224.243 189.38.250.1 255.255.255.255 UGH 0 0 0
> eth0
> 200.171.213.106 189.38.250.1 255.255.255.255 UGH 0 0 0
> eth0
> 200.158.83.246 189.38.250.1 255.255.255.255 UGH 0 0 0
> eth0
> 200.160.255.48 189.38.250.1 255.255.255.240 UG 0 0 0
> eth0
> 172.16.18.0 0.0.0.0 255.255.255.0 U 0 0 0
> eth0
> 10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0
> eth2
> 189.38.250.0 0.0.0.0 255.255.255.0 U 0 0 0
> eth0
> 10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0
> tun0
> 172.16.16.0 0.0.0.0 255.255.255.0 U 0 0 0
> eth1
> 187.38.0.0 0.0.0.0 255.255.240.0 U 0 0 0
> eth3
> 10.0.0.0 10.0.0.1 255.255.0.0 UG 0 0 0
> eth2
> 74.125.0.0 189.38.250.1 255.255.0.0 UG 0 0 0
> eth0
> 0.0.0.0 187.38.0.1 0.0.0.0 UG 0 0 0
> eth3
>
>
> Comandos iptables para permitir o tráfego entre as redes.
>
> iptables -t nat -A POSTROUTING -o eth0 -s 172.16.16.0/24 -d !
> 172.16.18.0/24 -j MASQUERADE
> iptables -A FORWARD -p tcp -i eth0 -s 172.16.18.0/24 -o eth1 -d
> 172.16.16.0/24 -j ACCEPT
> iptables -A FORWARD -p tcp -i eth1 -s 172.16.16.0/24 -o eth0 -d
> 172.16.18.0/24 -j ACCEPT
>
>
> Não pego pacotes sendo dropados no linux.
> Alguma ideia iluminada...?
>
> Abraços
> Ricardo Felix do Nascimento
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-11-24 15:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-11-24 15:01 [gentoo-user-br] VPN ipsec Ricardo Felix
2010-11-24 15:06 ` RES: " Eduardo Schoedler
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox