Hi Bob,
Do you have a tunnel from your roadwarrior to Libreswan for the subnet
192.168.0.0/24? I don't know the Windows client (or any ikev2 details
therefore my knowledge is entirely theoretical)so I don't know if you
can use left/rightsubnets in Libreswan or if you have to define two
different tunnels.
Similarly you will need a tunnel with subnets from 10.25.0.0/24 and
192.168.25.0/24. When negotiating these tunnels with the Sonicwall, do
you see both coming up? Again, if the Sonicwall can't cope you may also
need to define two separate tunnels from Libreswan.
From a different angle, what is your roadwarrior's local LAN subnet when
performing these tests? If is 192.168.0.0/24 then you have a big issue
as both the local and (very) remote subnets are the same.
Regards,
Nick
On 2015-06-07 01:23, Bob Miller wrote:
Hi,
I am not sure if I am being dense and not seeing what is there, or if
what I am looking for really isn't there.
I have a firewall running libreswan that has an ipsec/psk net2net
tunnel configured between it and a sonicwall device. This firewall
also has multiple road warriors connecting to the local network behind
it. Remote windows machines are configured with ikev2.
the gist:
192.168.0.0/24(sonicwall)<=>ETH0:libreswan:ETH1<=>192.168.25.0(LAN)
10.25.0.0/24(roadwarriors)<=^ ^=>Internet
each segment works fine;
remotelan<=>LAN, RW<=>LAN, Internet<=>LAN works great
RW<=>LAN, RW<=>Internet works great.
remotelan<=>internet doesn't work, which is great.
Now I want the roadwarriors to access the remote lan, but I can't seem
to figure it out.
It happens I have another identical situation, with the singular
difference that the road warriors are connecting via l2tp. I have
tried to get the same thing working on that one in the hopes that
something about l2tp would magically work and grant me understanding.
I have been at it for a while now, it would be tough to list all I
have done, but generally I started at iptables, thinking it would be a
simple forwarding thing. I made sure I wasn't nat'ing my traffic,
forward rules are in place, etc. maybe there is a problem there, but
I don't see it if there is.
Next I played with left/rightsubnets (as opposed to singular subnet)
as per what I found in the ipsec.conf man page. I think I tried every
combination at least twice, but nothing changed there.
I looked through more of the docs. I found passthrough conns, which
seem like what I might want, but the only examples I can find are for
extruded subnets, where one side is a smaller subset of a larger
subnet on the other side. regardless, tried a bunch of ways to make
that work but no success. I also looked through the multi-net
examples, but those seem related to klips, and I think I need to find
and study the context of those examples to get value from them...
On google, I found a limited number of posts that discuss the topic.
In the posts that seemed relevant, I could follow the discussion, but
in no cases could I translate the examples to a working config on this
firewall.
I am not afraid to read and try and figure it out on my own, but I
don't think I am reading the right stuff. or if I am I haven't
recognized it yet. could someone kindly point me at the definitive
thing I need to read and understand to achieve my goal?
_______________________________________________
Swan mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan
