Am 29.03.19 um 16:54 schrieb Tony Phillips:
> When my tunnel comes up, locations at the destination of the VPN are
> reachable as desired.
>
> However, in my use case, I want to prevent anything talking to the client on
> its real interface (bypassing the tunnel). Right now, even with the tunnel
> up, I can SSH into the client's real eth0 interface's IP address *and* the
> tunnel IP address.
>
> I've tried removing the original default route (and of course adding a
> host-specific route so the client knows how to get to the VPN server), but
> still doesn't stop traffic from "outside" the VPN from reaching the client.
>
> Here's my ipsec.conf file:
>
> config setup
> charondebug=1
>
> conn %default
> ikelifetime=20m
> reauth=yes
> rekey=yes
> keylife=10m
> rekeymargin=3m
> rekeyfuzz=0%
> keyingtries=1
> type=tunnel
>
> conn test
> keyexchange=ikev1
> ikelifetime=1440m
> keylife=60m
> aggressive=yes
> ike=aes-sha1-modp1024
> esp=aes-sha1
> xauth=client
> left=10.181.43.20
> leftid=(omitted)
> leftsourceip=%modeconfig
> leftauth=psk
> rightauth=psk
> leftauth2=xauth
> right=10.248.1.2
> rightsubnet=0.0.0.0/
> xauth_identity=test
> auto=add
>
> From my understanding of the documentation, what I'm asking for SHOULD be the
> default behavior. But I'm obviously missing something.
>
> The address I'm given by the VPN server is in the 10.248.60/19 range.
>
>
>
Set up a local firewall. Trigger it with the setup of the tunnel.
Mit freundlichen Grüßen,
--
[*] sys4 AG
https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG,80333 München
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief
Aufsichtsratsvorsitzender: Florian Kirstein
signature.asc
Description: OpenPGP digital signature
