On Thu, 13 May 1999, Fuzzy Fox wrote: > Jeff Garzik <[EMAIL PROTECTED]> wrote: > > Thanks much, I will try that. I have a feeling it is something else > > though... since we can ping the remote gateway from _any_ internal > > machine, but we cannot ping machines across the VPN besides the > > gateways. > > Hmm, I thought I read you saying that the two gateway machines could > ping each other, but that's all. > > I guess the question comes up, do machines on the far side of each VPN > know that they need to route packets to their particular gateway in > order to reach machines on the other side? For instance, a packet might > reach a machine on the remote network, and it has no idea how to route > the reply back through the right host. I just don't do a good job of explaining myself :) Our setup is pretty simple. We have several Linux-based gateways at each site. Each gateway has a static IP with some ISP, and that site's LAN masqerades behind that. All our internal machines can talk through the gateway to the Internet with no problem, so I know basic routing and masquerading works fine. On each gateway, in addition to the connection to the outside world, we want to add a VPN to each site. (used VPN howto: http://metalab.unc.edu/LDP/HOWTO/mini/VPN.html) I have successfully constructing a tunnel using ssh and PPP. For example, consider networks 10.0.1.0 and 10.10.10.0. Any machine on 10.10.10.0 can ping the remote gateway (10.0.1.16), and any machine on 10.0.1.0 can ping their remote gateway (10.10.10.1). However I cannot ping any machine _past_ either gateway from a remote machine. It seems like a routing or forward problem, but not sure. Below are the current routing and forwarding rules. After the ssh/PPP tunnel is established, I simply add a single routing rule for the remote VPN network (route add -net 10.10.10.0 gw 192.168.0.8) on each side. Any ideas why packets stop at the remote gateway? Maybe a masq or regular forwarding rule needs to be added? Thanks for any insight, and all the help so far, Jeff --------------------------------------------------------------------------- Atlanta office (10.0.1.0 net, 10.0.1.16 gateway) --------------------------------------------------------------------------- [slave9@finale slave9]$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.1.254 0.0.0.0 255.255.255.255 UH 0 0 0 eth0:0 207.15.208.16 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0 192.168.0.8 0.0.0.0 255.255.255.255 UH 0 0 2 ppp2 10.0.1.0 0.0.0.0 255.255.255.0 U 0 0 182 eth0 10.10.10.0 192.168.0.8 255.255.255.0 UG 0 0 4 ppp2 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 62 lo 0.0.0.0 207.15.208.16 0.0.0.0 UG 0 0 824 ppp0 [slave9@finale slave9]$ ipfwadm -F -l IP firewall forward rules, default policy: deny type prot source destination ports acc/m all 10.0.1.0/24 anywhere n/a --------------------------------------------------------------------------- Atlanta home (10.10.10.0 net, 10.10.10.1 gateway) --------------------------------------------------------------------------- [jgarzik@bs-gw jgarzik]$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.0.9 0.0.0.0 255.255.255.255 UH 0 0 2 ppp0 10.10.10.0 0.0.0.0 255.255.255.0 U 0 0 134 eth1 10.0.1.0 192.168.0.9 255.255.255.0 UG 0 0 3 ppp0 216.77.228.0 0.0.0.0 255.255.252.0 U 0 0 779 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 2 lo [jgarzik@bs-gw jgarzik]$ ipfwadm -F -l IP firewall forward rules, default policy: deny type prot source destination ports acc/m all 10.10.10.0/24 anywhere n/a _______________________________________________ Masq maillist - [EMAIL PROTECTED] http://tiffany.indyramp.com/mailman/listinfo/masq Admin requests can be handled by web (above) or [EMAIL PROTECTED]
