> firewall dual homed
> network facing static nic address = 5.5.5.4 (rfc1918/rfc6598)
> virgin media router facing static nic address = 3.3.3.2
> (rfc1918/rfc6598)
> virgin media router static address = 3.3.3.3 (rfc1918/rfc6598)
> virgin media dynamic wan address = 1.1.1.1 (internet-routable)
> firewall default route = 3.3.3.3
> network_a default route = 5.5.5.4
your local_gw address would be the router-facing rfc1918 address
and remote_gw would be the dynamic internet-routable address of the
other gateway.
> hi stuart
> thanks for your answer and advice,
> i am working on a modified ddns update script to signal a restart of
> isakmpd when the dynamic ip changes, will implement isakmpd else will
> follow your suggestion and use openvpn for my net to net link, i had
> already planned to use openvpn for my roadwarriors.
> shadrock
>
>
The problem is that when the address of one side changes, it's the *other*
side that yo uneed to restart. so you might want a regularly-run script to
do a lookup to work out when this needs doing, although in practice I don't
think VM change addresses all that often so it might be good enough to have
the update script email/text you to tell you to update the other side...
hi stuart
having reread your first post on the subject,
i now realize when the address of one side changes
it's the*other* side that needs to update remote_gw in ipsec.conf and
restart.
i was considering each end running a script which used ping to check
connectivity to the remote gateway like openvpn's method,
if ping timed out then a dns hostname lookup would be used to resolve
the ip,
ipsec.conf would then be updated and restarted and an email sent to the
manager of the network informing of the remote address change.
this would be all scripted so there would be no need for me to get involved.
shadrock
