This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Net2Net : I can't apply the HowTo

I try to create an IPSec Net-To-Net connection.

First, here's the general config :

Code:

LAN1  (eth0=Internal1) Firewall1 (eth1=Wan1)  (RLan1) Router1 (External1)  (External2) Router2 (RLan2)  (eth1=Wan2) Firewall2 (eth0=Internal2)  LAN2

In my case this is :
Internal1 = 192.168.1.2/24
Wan1 = 192.168.10.2/24
RLan1 = 192.168.10.1/24
External1 = 82.235.14.210/32
External2 = 193.252.219.173/32
RLan2 = 192.168.20.1/24
Wan2 = 192.168.20.254/24
Internal2 = 192.168.4.1/24

Second, what i want is : someone in LAN1 can contact someone in LAN2 simply using his internal IP. A Net2Net is what i need, isn't it ? Once my tunnels active, 192.168.1.5 will contact 192.168.4.150 with no problems ?

Third, i tried to apply the how-to, but there's something i don't get. In the how-to the "External interface of the remote firewall" is Internal1 O_o. And the "Internal network of the remote site" is External2, and even worse, it's supposed to be a network, whereas it's a public IP so i'll always have a /32 network ???

Shortly, here's my config :
Firewall1 (version 5.206)
[ QUOTE ]
- RemoteKey PSK with PreShared "myKey" (for example)
- IPSEC Connection Standard / AES_PFS
-- Endpoint : Wan1 => Internal2
-- Subnet : Internal1 => External2

[/ QUOTE ]
Firewall2 (version 6.001)
[ QUOTE ]
- RemoteKey PSK with PreShared "myKey" (for example)
- IPSEC Connection Standard / AES_PFS
-- Endpoint : Wan2 => Internal1
-- Subnet : Internal2 => External1

[/ QUOTE ]

But my route never appears...

What's wrong here ?

Here's the message displayed by "VPN Status" in Firewall1
[ QUOTE ]
000
000 "S_IGLOO__VPN_0": 192.168.1.0/24===192.168.10.2...192.168.4.1===193.252.219.173/32
000 "S_IGLOO__VPN_0":   CAs: '%any'...'%any'
000 "S_IGLOO__VPN_0":   ike_life: 7800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "S_IGLOO__VPN_0":   policy: PSK+ENCRYPT+TUNNEL+PFS; interface: eth1; unrouted
000 "S_IGLOO__VPN_0":   newest ISAKMP SA: #0; newest IPsec SA: #0; eroute owner: #0
000 "S_IGLOO__VPN_0":   IKE algorithms wanted: 5_000-1-5, flags=-strict
000 "S_IGLOO__VPN_0":   IKE algorithms found:  5_192-1_128-5,
000 "S_IGLOO__VPN_0":   ESP algorithms wanted: 12_128-1, ; pfsgroup=5; flags=-strict
000 "S_IGLOO__VPN_0":   ESP algorithms loaded: 12_128-1_128,
000
000 #2: "S_IGLOO__VPN_0" 192.168.4.1 STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 10s
000

[/ QUOTE ]
And the message in Firewall2 [ QUOTE ]
000
000 "S_IGLOO__VPN_0": 192.168.4.0/24===192.168.20.254...192.168.1.2===82.235.14.210/32; unrouted; eroute owner: #0
000 "S_IGLOO__VPN_0":     srcip=unset; dstip=unset
000 "S_IGLOO__VPN_0":   ike_life: 7800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0
000 "S_IGLOO__VPN_0":   policy: PSK+ENCRYPT+TUNNEL+PFS+UP; prio: 24,32; interface: eth0;
000 "S_IGLOO__VPN_0":   dpd: (null); delay:30; timeout:120;
000 "S_IGLOO__VPN_0":   newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "S_IGLOO__VPN_0":   IKE algorithms wanted: 7_256-1-5, flags=-strict
000 "S_IGLOO__VPN_0":   IKE algorithms found:  7_256-1_128-5,
000 "S_IGLOO__VPN_0":   ESP algorithms wanted: 12_128-1, ; pfsgroup=5; flags=-strict
000 "S_IGLOO__VPN_0":   ESP algorithms loaded: 12_128-1, ; pfsgroup=5; flags=-strict
000
000 #8: "S_IGLOO__VPN_0":500 STATE_MAIN_I1 (sent MI1, expecting MR1); EVENT_RETRANSMIT in 14s; nodpd
000 #8: pending Phase 2 for "S_IGLOO__VPN_0" replacing #0
000

[/ QUOTE ]

All this is very dark to me [:(]

This thread was automatically locked due to age.

0 KKnecht over 20 years ago

[ QUOTE ]
Shortly, here's my config :
Firewall1 (version 5.206)

Quote:
--------------------------------------------------------------------------------

- RemoteKey PSK with PreShared "myKey" (for example)
- IPSEC Connection Standard / AES_PFS
-- Endpoint : Wan1 => Internal2
-- Subnet : Internal1 => External2

--------------------------------------------------------------------------------

Firewall2 (version 6.001)

Quote:
--------------------------------------------------------------------------------

- RemoteKey PSK with PreShared "myKey" (for example)
- IPSEC Connection Standard / AES_PFS
-- Endpoint : Wan2 => Internal1
-- Subnet : Internal2 => External1

[/ QUOTE ]

Try like this:
Firewall1 (version 5.206)
--------------------------------------------------------------------------------
- RemoteKey PSK with PreShared "myKey" (for example)
- IPSEC Connection Standard / AES_PFS
-- Endpoint : Wan1 => External2
-- Subnet : Internal1 => Internal2
-------------------------------------------------------------------------------

Firewall2 (version 6.001)
--------------------------------------------------------------------------------

- RemoteKey PSK with PreShared "myKey" (for example)
- IPSEC Connection Standard / AES_PFS
-- Endpoint : Wan2 => External1
-- Subnet : Internal2 => Internal1
Cancel
Vote Up 0 Vote Down

Cancel
0 nchambrier over 20 years ago in reply to KKnecht

Thanks a lot for this answer, and it seems to be working in the firewalls : i now get routes displayed.

But i can't ping something in LAN2 from LAN1 (neither the opposite) [:(]

Here's the exact information :
Firewall 1 interfaces
External 193.262.218.62 / ???.???.???.??? - Gateway: 193.263.170.3
Internal 192.168.1.50 / 255.255.255.0 - Gateway: none

Firewall 2 interfaces
External 80.24.194.132 / ???.???.???.??? - Gateway: 80.24.194.1
Internal 192.9.200.140 / 255.255.255.0 - Gateway: none

Firewall 1 VPN Connection
Endpoint External -> (Host) 80.24.194.132
Subnet Internal (Network) -> (Network) 192.9.200.0/24

Firewall 2 VPN Connection
Endpoint External -> (Host) 193.262.218.62
Subnet Internal (Network) -> (Network) 192.168.1.0/24

VPN Routes displayed :
Firewall 1 192.168.1.0/24:0 -> 192.9.200.0/24:0 => tun0x1008@80.24.194.132:0
Firewall 2 192.9.200.0/24:0 -> 192.168.1.0/24:0 => tun0x1006@193.262.218.62:0
Cancel
Vote Up 0 Vote Down

Cancel
0 KKnecht over 20 years ago in reply to nchambrier

Now you got VPN up and running, you need to apply packet filter rules.

For testing something like:

Firewall1
-----------
From: Internal Network (192.168.1.0)
To: Firewall2_Internal Network (192.9.200.0)
Service: Any
Allow

Firewall2
-----------
From: Internal Network (192.9.200.0)
To: Firewall1_Internal Network (192.168.1.0)
Service: Any
Allow

If this works, refine the packet filter rules to your needs.
For example create a service_group called "vpn_services" and add all the services you want to allow between the networks.
Then replace service "Any" with "vpn_services"

Good luck !!
Cancel
Vote Up 0 Vote Down

Cancel
0 nchambrier over 20 years ago in reply to KKnecht

I'm ashamed i didn't think about packet filter rules, i didn't realize i had to treat this new network like any other network [;)]
Thanks a lot, everything works, and even better i know why !

Just a last question, in this case i have transparent modems, but in the case one or both firewalls are behind a router, what should i forward to the firewall :
- NAT only the PPTP port ?
- NAT every service i want to allow ?

As i see the thing, like a SSH-Tunnel, only the PPTP port should be enough. Am I right ?
Cancel
Vote Up 0 Vote Down

Cancel
0 Pedro_01 over 20 years ago in reply to nchambrier

Hi nchambrier...

IPSEC has nothing to do with PPtP and PPtP not only uses a single port. Both need a complex range of ports and protocols. Most routers have "buttons" for "PPtP passthrough" and "IPSEC passthrough" preconfigured. If you are able to switch passthrough on in your router setup and the tunnel does come up, you can possibly look in a router log: An IPSEC connection starts with port 500 UDP.
Cancel
Vote Up 0 Vote Down

Cancel