From: Ricardo Felix <felix.ricardo@gmail.com>
To: gentoo-user-br@lists.gentoo.org
Subject: [gentoo-user-br] VPN ipsec
Date: Wed, 24 Nov 2010 13:01:35 -0200 [thread overview]
Message-ID: <AANLkTin7Kx3du8sX5pwUVRFDbu7wbTV+y9m6c_ozLLTP@mail.gmail.com> (raw)
Boa tarde galera, uma pergunta aqui que já to suando.
Alguém por aqui já criou uma VPN Ipsec com openswan e um Juniper SSG520 ?
Consigo colocar a VPN no Ar, mas o tráfego não passa de uma ponta a outra....
meus arquivos de conf...
ipsec.conf
conn HQtoDC
type=tunnel
left=189.38.x.x
leftsubnet=172.16.16.0/24
leftnexthop=200.160.x.x
right=200.160.x.x
rightsubnet=172.16.18.0/24
pfs=yes
keyingtries=0
aggrmode=no
auto=start
auth=esp
esp=3des-sha1-96
ike=3des-sha1-96
authby=secret
minha tabela de rotas após subir o ipsec
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref
Use Iface
201.6.249.136 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
200.207.121.196 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
200.204.154.71 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
201.81.231.236 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
74.125.93.121 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
201.81.224.243 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
200.171.213.106 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
200.158.83.246 189.38.250.1 255.255.255.255 UGH 0 0 0 eth0
200.160.255.48 189.38.250.1 255.255.255.240 UG 0 0 0 eth0
172.16.18.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
189.38.250.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
172.16.16.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
187.38.0.0 0.0.0.0 255.255.240.0 U 0 0 0 eth3
10.0.0.0 10.0.0.1 255.255.0.0 UG 0 0 0 eth2
74.125.0.0 189.38.250.1 255.255.0.0 UG 0 0 0 eth0
0.0.0.0 187.38.0.1 0.0.0.0 UG 0 0 0 eth3
Comandos iptables para permitir o tráfego entre as redes.
iptables -t nat -A POSTROUTING -o eth0 -s 172.16.16.0/24 -d !
172.16.18.0/24 -j MASQUERADE
iptables -A FORWARD -p tcp -i eth0 -s 172.16.18.0/24 -o eth1 -d
172.16.16.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -i eth1 -s 172.16.16.0/24 -o eth0 -d
172.16.18.0/24 -j ACCEPT
Não pego pacotes sendo dropados no linux.
Alguma ideia iluminada...?
Abraços
Ricardo Felix do Nascimento
next reply other threads:[~2010-11-24 15:02 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-11-24 15:01 Ricardo Felix [this message]
2010-11-24 15:06 ` RES: [gentoo-user-br] VPN ipsec Eduardo Schoedler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=AANLkTin7Kx3du8sX5pwUVRFDbu7wbTV+y9m6c_ozLLTP@mail.gmail.com \
--to=felix.ricardo@gmail.com \
--cc=gentoo-user-br@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox