|
||||||||
Hi, I added the tunnel and it worked like a charm. Many, many thanks to both Philippe and Raphael. I owe you a virtual beer (or physical, if you happen to come to paris, france) That beeing said, I am surpised that one HAVE to add a tunnel and cannot route thought the exising IPsec tunnel. Thank you very much, --fred Philippe Lang wrote: > Hi, > > I'm not sure it will help, but have you tried configuring a VPN with local network LANA and remote network LANC in both M0n0walls, with proper static routes to LANC in mb and gbc? > > -----Message d'origine----- > De : Frederic Stark [mailto:f5428 at almonde dot com] > Envoyé : vendredi, 26. août 2005 14:36 > À : m0n0wall at lists dot m0n0 dot ch > Objet : [m0n0wall] Getting nuts with an ipsec routing problem > > Hi everybody, > > As a picture is better than thousand words, here is the network I am talking about (some ip renamed). See it with a non-proportional font: > > +----+ > | ha | > +--+-+ > | 192.168.0.1 > ---+-----------------+------------------------ LANA = 192.168.0/24 > | 192.168.0.253 > +-+--+ > m0n0wall | ma |---IPsec--+ > +----+ | > | | > WAN | > | > WAN | > | | > +----+ | > m0n0wall | mb |---IPsec--+ > +-+--+ > | 10.80.48.253 > ----+----------------+--------------+----------- LANB = 10.80.48.0/20 > | 10.80.48.1 | 10.80.48.99 > +-+--+ +--+--+ > | hb | | gbc | > +-+--+ +--+--+ > | > ------+--------------+----------- LANC = 192.168.60.0/24 > | 192.168.60.1 > +-+--+ > | hc | > +----+ > > ha = hosta = 192.168.0.1 > hb = hostb = 10.80.48.1 > hc = hostc = 192.168.60.1 > ma = m0n0a = 192.168.0.253 > mb = m0n0b = 10.80.48.253 > gbc = gatewaybc = 10.80.48.99 > > What works: > ping: ha <-> hb > ping: hb <-> hc > (after I added a static route on m0n0b: LAN,192.168.60/24,10.80.48.99) > > What DONT work: > ping: ha -> hc > > > I am totally unable to ping from hosta to hostc, no matter what I try (and I easily spent 8 hours on that). As far as I can tell, the m0n0a seems to send the packet to the WAN instead of the IPSec link. > > I don't understand how the stuff is supposed to work: > 1/ ha have a packet for 192.168.60.1 > 2/ this is not a local address, so it sends it to default gw (m0n0a) 3/ m0n0a have NO idea about what to do with the packet, so it send it to the WAN. > > I seems obvious to me that m0n0a needs some sort of route to understand how to handle packet for LANC. But I can't get it to have one that work > (/kernel: arplookup 10.80.50.99 failed: host is not on local network). > And due to the nature of IPsec (mainly the fact that there is no associated interface), I don't know understand how/if it is supposed to work. > > Any help appreciated, > > Thanks, in advance, > > --fred > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch > For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch > For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch > > |