From owner-freebsd-questions@FreeBSD.ORG Thu Jul 8 14:54:01 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B529E106564A for ; Thu, 8 Jul 2010 14:54:01 +0000 (UTC) (envelope-from steve@ipv6canada.com) Received: from smtp.ibctech.ca (v6.ibctech.ca [IPv6:2607:f118::b6]) by mx1.freebsd.org (Postfix) with SMTP id EEA948FC1A for ; Thu, 8 Jul 2010 14:54:00 +0000 (UTC) Received: (qmail 32799 invoked by uid 89); 8 Jul 2010 14:55:45 -0000 Received: from unknown (HELO ?IPv6:2607:f118::5?) (steve@ibctech.ca@2607:f118::5) by 2607:f118::b6 with ESMTPA; 8 Jul 2010 14:55:45 -0000 Message-ID: <4C35E697.7050006@ipv6canada.com> Date: Thu, 08 Jul 2010 10:54:15 -0400 From: Steve Bertrand User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.7) Gecko/20100111 Lightning/1.0b1 Thunderbird/3.0.1 MIME-Version: 1.0 To: =?ISO-8859-1?Q?Matheus_Weber_da_Concei=E7=E3o?= References: <4C35D11D.4000304@ipv6canada.com> <4C35E607.2090902@ipv6canada.com> In-Reply-To: <4C35E607.2090902@ipv6canada.com> X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Cc: freebsd-questions@freebsd.org Subject: Re: VPN IPsec Help X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Jul 2010 14:54:01 -0000 On 2010.07.08 10:51, Steve Bertrand wrote: > On 2010.07.08 10:00, Matheus Weber da Conceição wrote: >>> It has been a long time since I've done IPSec on FBSD, but I'm willing >>> to bet that this has to do with routing, possibly amongst other things. >>> On peer 'B' (FBSD box), what internal IP range are you trying to access >>> the A network from...the same ones (ie. are you trying to bridge the >>> networks)? >>> >> The -peer A- doesn't need to access any -peer B- networks. >> >>> Do you have access to the Cisco gear? >> No. >> >>> If so, on FreeBSD, post the output of: >>> >>> % netstat -rn >> >> Notes: >> tun0 is my ppp pseudo-device >> tun5 is my openvpn tunel (192.168.5.0/24) >> ============ >> # netstat -rn >> Routing tables > > [ big snip ] > > IIRC, you don't need a gre tunnel through IPSec, as you are simply > routing between two dissimilar networks. Don't quote me on this though, > as I said earlier, it has been a very long time. > > On the FreeBSD box, assuming that you *only* want to access the three > specific IPs you stated, do this: > > % route add 192.168.10.24/32 200.x.x.x > % route add 192.168.201.196/32 200.x.x.x > % route add 10.115.90.236/32 200.x.x.x > > On the Cisco side: D'oh! I wasn't paying enough attention! > % ip route 192.168.5.0 255.255.255.0 187.x.x.x.x This.........^^^^^^^^^^^ should read 192.168.1.0 (by the looks of things). Steve