2

I have a couple problems that I'm trying to find solutions to. I have Openswan and ASA configure as a IPSec VPN tunnel and the connection is established and working, but with some little problems. The topology is looking like this:

MyPC (192.168.0.0/23)<-->ASA==IPSecVPNTunnel==Openswan(192.168.10.0/23)<->Server1,2,3,4,5

So ping from myPC to one of the servers is working. But ping from the servers or Openswan is not working. What I have done for now is using iptables (POSTROUTING,MASQUERADE,enabled forwarding etc.).

Looking at the routing table it appears that I'm missing the route that Openswan should've added.

Kernel IP routing table Destination     Gateway         Genmask        Flags Metric Ref    Use Iface
1.1.1.1    0.0.0.0         255.255.255.192 U     0      0        0 eth0
192.168.10.0      0.0.0.0         255.255.254.0   U     0      0        0 eth2
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1003   0        0 eth2
0.0.0.0         1.1.1.1    0.0.0.0         UG    0      0        0 eth0

And I don't know why it's not adding. When I try to add it manually, it still is not working. Any solutions about this or hints?

Also, this is all installed on CentOS with two physical interfaces eth0 (public) eth2 ( local ) and this is what I found in the log files:

Sep 11 05:36:09 localhost pluto[7516]: "infra" #6: route-client output: /usr/libexec/ipsec/_updown.netkey: doroute `ip route replace 192.168.0.0/23 via 192.168.10.1 dev eth0  src 192.168.10.1' failed (RTNETLINK answers: No such process)
2
  • do you have some NAT configured? The traffic that goes trough the VPN must be excluded from NAT. As for pinging from the openswan itself you must use the -I option to specify the inside IP address. – JFL May 10 '16 at 20:28
  • Could you please add the relevant configuration of the Cisco ASA? As the ping from your PC to the servers is actually working, I expect the routing to be in place correctly. Do you have ` sysopt connection permit-vpn` configured on the ASA? If not, have you added the required entries in the incoming ACL of the VPN terminating interface? //Just saw the question is one year old. I doubt that this is still relevant. – waza-ari May 10 '16 at 21:09

Browse other questions tagged or ask your own question.