Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
  • I'm able to connect successfully from a laptop to my server using Openvpn.
  • I have ipv4 forwarding and NAT enabled on the server.
  • I can access the web, etc.

But the server also has a S2S VPN with Racoon enabled. When I SSH to my server and then 'telnet 80' to the racoon-connected-server it works perfect.

But when I connect from the laptop (which comes over Openvpn) to one of the IPs in the Racoon S2S VPN subnet, it fails.

Any ideas how to setup Racoon together with Openvpn?

share|improve this question
add comment

2 Answers 2

You have to configure openvpn to push the IPSEC routes to openvpn clients. in your "server.conf" file add on line like this for each network you want to make accessible:

push "route w.x.y.z 255.255.255.0"

disclaimer: the w.x.y.z and the network mask must be adapted to your configuration.

Also note that this way the packets from your laptop will go to the servers on the IPSEC subnets. Now you need to have the packets back to your laptop. The easiest, dirty way is to do a NAT on your racoon server.

edit: how to do the nat The masquerade rule you suggest might work, but I would recommand something more precise like:

iptable -t nat -A POSTROUTING --src <the openvpn client network> --dst <the ipsec networks not aware of the ovpn client network> -j SNAT --to-source <ip address of the openvpn server on network known to the ipsec network>
share|improve this answer
    
Thanks. But how do i do the dirty NAT? something like this: sudo iptables -t nat -A POSTROUTING -s w.x.y.z/24 -o eth0 -j MASQUERADE –  Jonas Schnelli Apr 3 '12 at 7:03
    
MASQUERADE is deprecated for static IPs. You should use the method suggested by @olivier-s at the end of his answer. –  Magellan Apr 3 '12 at 19:15
add comment

I suspect that the site on the other side of the S2S vpn doesn't have routing information for your OpenVPN subnet.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.