Hi :) I'm trying to do exactly this setup, between two OpenBSD boxes - 4.4 (central office) and 4.9 (branch office). With the following setup I can bring the tunnel up, but the networks can't talk to each other:
Central ipsec.conf ------------------------- ike passive esp tunnel from 10.20.0.0/16 to any \ srcid matriz.domain.com.br \ psk testefilial ------------ Branch ipsec.conf ------------------------- matriz_net = "10.20.0.0/16" matriz_gw = "178.9.35.10" filial_net = "10.10.11.0/24" ike dynamic esp tunnel from $filial_net to $matriz_net peer $matriz_gw \ srcid filial.domain.com.br \ dstid matriz.domain.com.br \ psk testefilial ----------- # ipsecctl -sa FLOWS: flow esp in from 10.10.11.0/24 to 10.20.0.0/16 peer 185.53.27.23 srcid matriz.gruponp.com.br dstid filial.gruponp.com.br type use flow esp out from 10.20.0.0/16 to 10.10.11.0/24 peer 185.53.27.23 srcid matriz.gruponp.com.br dstid filial.gruponp.com.br type require SAD: esp tunnel from 178.9.35.10 to 185.53.27.23 spi 0x59f8b098 auth hmac-sha2-256 enc aes esp tunnel from 185.53.27.23 to 178.9.35.10 spi 0xda08a9c3 auth hmac-sha2-256 enc aes ----------- # route -n show -encap Routing tables Encap: Source Port Destination Port Proto SA(Address/Proto/Type/Direction) 10.10.11/24 0 10.20/16 0 0 185.53.27.23/esp/use/in 10.20/16 0 10.10.11/24 0 0 185.53.27.23/esp/require/out Fabio Almeida Em 13/11/2011, `s 12:06, Mik J escreveu: > Hello, > > I would like to know if such configuration is possible. > > LAN1 > (192.168.10.0/24) <--> OpenBSD .99 <--> .254 Router IPx <--> Internet <--> IPy > IPSec_GW (Vendor) <--> LAN2 (192.168.20.0/24) > > As you can see the OpenBSD 4.9 > server sits on the LAN1 and has one physical interface. > When it wants to > access to the internet, its address 192.168.10.99 is natted in IPx and that's > how the IPSec_GW(Vendor) sees the source packets. > > It's not really important > now if other machines on LAN1 should ping machines on LAN2. I would like for > now that the OpenBSD could ping machines on LAN2. > > I have search for examples > on the internet for this particular case because the OpenBSD is behind a nat > router. And I haven't found the proper way to do this. I don't even know if > it's possible. I know some kind of nat-t should be used though. > > Does anyone > have this configuration in place ? > > Thanks [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]