----- Original Message ----- 
From: "James P. Howard, II" <[EMAIL PROTECTED]>
Sent: Tuesday, June 29, 2004 2:57 PM
Subject: Routing problem in IPv4/IPSec VPN environment

> As a personal favor, I am building a VPN for a small business.  I
> have chosen FreeBSD for this due to my greater familiarity.  The
> project will consist of linking four sites, each with a FreeBSD
> system providing DHCP, NAT, and VPN services.  I have built DHCP and
> NAT servers before, but the IPSec and VPN is new to me.
> Right now, the first two systems are nearly complete.  The two
> machines are named goldengate and waltwhitman.  Here's the IP
> config, currently:
>   goldengate:  external internal
>   waltwhitman: external internal
> The external interfaces are in the reserved space because testing is
> taking place behind a cable/DSL router providing NAT services.  The
> output of "gifconfig -a; ifconfig -a; netstat -rn" for each will be
> provided at the end of this message.
> IPSec, with Racoon, is properly exchanging keys.  From goldengate, I
> can ping and from waltwhitman I can ping
> If a Windows computer is connected behind either system, they
> receive an IP (10.1.x.254, where x is the network number).
> The problem is, if behind the firewall, I cannot ping
> and vice-versa.  I assume, at this point, this is some type
> of routing issue and not a problem with IPSec.  This seems to be
> confirmed by the fact tracerouting to the local internal interface
> goes through the *other* internal interface first:


Not to be disrespectful, but did you do what I've done in the past and
forget to enable forwarding so the systems can route traffic?

[EMAIL PROTECTED]/>sysctl -a |grep forward
net.inet.ip.forwarding: 1

If not, make sure that gateway_enable="YES" in rc.conf and reboot, or sysctl
net.inet.ip.forwarding=1 from command line to enable it without a reboot.


Micheal Patterson
TSG Network Administration

Confidentiality Notice:  This e-mail message, including any attachments, is
for the sole use of the intended recipient(s) and may contain confidential
and privileged information. Any unauthorized review, use, disclosure or
distribution is prohibited. If you are not the intended recipient, please
contact the sender by reply e-mail and destroy all copies of the original

[EMAIL PROTECTED] mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to