Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 1 subscriber
  • Views 1999 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Default drop on site-to-site VPN

rizzah
Hello Board,

I have just installed astaro yesterday, it works fine and today i setup an IPSEC vpn to my office. All good. From my astaro i can ping to an internal IP from my office, but the other way around doesnt seem to work.

network info :
internal home lan = 192.168.50.x
internal home fw ip = 192.168.50.200
internal office lan = 172.16.58.x

When i do a traceroute from my office (internal ip) to an internal ip of my home network i see the following in the packet filter log :

11:25:59 Default DROP UDP 172.16.58.58 : 137 
 → 192.168.50.200 : 137 
 len=78 ttl=126 tos=0x00 srcmac=00:00:00:00:00:00 dstmac=00:0c:29:c5:48[:D]1 
 
I made a packet filter rule that says specificly  ->  - protocol ANY -> allow

Tho he doesnt seem to use this rule ... am i missing something ?

Thanks in advance for any help.

grtz
r


This thread was automatically locked due to age.
  • 0
    For Ping and Traceroute make sure you have ICMP settings (Network Security ==> Packet Filter ==> ICMP) set correct.

    On a packet filter rule for VPN you have to use the internal IP addresses, not the external ones.