On 09/29/2017 10:14 AM, Jason Timmins wrote: > Hi Tom, > > Yes, they would. The standard FreeSWAN-based IP service on Linux. >
Okay -- this is actually fairly simple. /etc/shorewall/zones: #ZONE TYPE OPTIONS brvpn ipsec mode=tunnel,proto=esp /etc/shorewall/options #ZONE HOSTS OPTIONS brvpn $WAN_IF:0.0.0.0/0 routeback Note 1: using the routeback option allows the branches to communicate between themselves. Note 2: Here, WAN_IF holds the address of the 'net' interface. Note 3: if you have other ipsec zones using $WAN_IF, then you will want to list the branch subnets rather than simply entering 0.0.0.0/0 Now, just configure the rules and policies and you should be all set. Remember to configure masquerade/SNAT if the branches use RFC1918 addresses. -Tom -- Tom Eastep \ Q: What do you get when you cross a mobster with Shoreline, \ an international standard? Washington, USA \ A: Someone who makes you an offer you can't http://shorewall.org \ understand \_______________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
