Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here's my question:

I have set up a VPN IPsec LAN2LAN (or site2site) with the following parameters:

local subnet: 10.178.51.64/27
remote subnet : 10.174.0.0/16

The vpn tunnel comes up correctly but the problem is that I can't ping or send any data to the remote subnet machines.

That's because my 'real' subnet is 192.168.1.0/24 but my partner want that I connect with the subnet specified up. I can't change my subnet , can I achieve this connection with my router which is a NETGEAR ProSafe VPN Firewall FVS338 ?

Thanks in advance

share|improve this question

3 Answers 3

up vote 1 down vote accepted

In order for a site2site VPN tunnel to work correctly you typically have two choices to setup the tunnel.

First, is route based. You create the tunnel between two WAN interfaces and then setup routes in the firewall that says "to get to this LAN subnet go out the tunnel". Typically you still need to specify a policy on each end as well, but just an ALLOW policy between the two subnets.

Second is policy based. You create the tunnel between two WAN interfaces, but instead of setting up new routes, you setup policies and tell the policy to TUNNEL across that new VPN tunnel you created when sending traffic for those two subnets.

All that said, in your case if you are specifying local and remote subnets then those local and remote subnets will have to be the actual subnets that are to be routed/used (in your case the 192.168.1.0/24), otherwise you'll have to do some translation on your side with NAT change whatever subnet is yours in the question (the 10.x) to become 192.x internally, basically double-NATing, which gets tricky.

My advice is to get with your partner and explain this and find out why they don't want you to use 192.168.1.0/24 as your subnet. Maybe they have another local subnet on that range, etc.

In best practice you really shouldn't be using that subnet though. Use a different private LAN subnet...that one will just give you headaches with people's home networks when it comes to split tunneling, etc.

share|improve this answer
    
thx for reply TheCleaner, I think that double-Nating is what I have to do, because I have set up the vpn through polices and I think that the subnet that they assigned to me is the only available for them. Do you know how to do that type of double-NATing with my router model?Im not sure I can accomplish that, I can link you the admin interface demo of my model, interface.netgear-forum.com/FVS338 I really appreciate your help. thx –  0wn3r Dec 21 '12 at 16:02
    
I'm sorry, but what you are talking about would take quite a bit of time and effort, more along the line of consulting hours. If your partner cannot provide that type of assistance, my suggestion is to really document out (including drawings) of what you are looking to do, and then call Netgear support and see if they can walk you through it. –  TheCleaner Dec 21 '12 at 16:07
    
Ok man I tried ;) thx for reply and happy holidays –  0wn3r Dec 21 '12 at 16:11
    
Same to you...hope it works out for you. I would help if I had free time but today is crazy busy. Again, documenting what you want and then getting with Netgear support should get you there. If not, try posting a new question when you get "stuck" on the configs in the Netgear forums –  TheCleaner Dec 21 '12 at 16:14

Your answer really depends on what type of networking device is on each side and what the remote subnet really is.

Your tunnel "logic" should go as follows (regardless of networking vendor):

  1. Tunnel is setup between two router WAN IPs
  2. Tunnel is configured on both sides to know what the local LAN subnets and remote LAN subnets are to be routed between the tunnel. Typically this is NOT the WAN IP subnet, but are LAN subnets inside the router/firewall. This can be done through various methods such as routing or policy-based-routing or simple tunnel policies. It all depends on your attack method and does actually depend here on what networking hardware you use.

Troubleshooting can consist of pinging from both sides along with running debug commands on the actual routers/firewalls themselves to see where the traffic is stopping, along with making sure the tunnel itself comes up (again commands depend on hardware used and IKE choices).

If you are completely lost, I would suggest posting a network diagram along with hardware used on both sides. That would help someone here answer the question. However, if you have support with your network vendor and need this operational asap I would suggest contacting them and having them connect up with you and walk through the settings.

share|improve this answer

Thanks TheCleaner for your answer, that's pretty good but I want to post my own answer because I solved this and I want to share the solution.

Preamble: The vpn is set by policies.

My firewall is not a Cisco but is a netgear(it sucks :) by the way setting a vpn lan2lan IPSEC with this kind of semi-professional router could be very thought.
As I said my partner told me: You have to come up in the tunnel with the subnet 10.178.51.64/27 and this is mandatory, I can't help you in any way.
Well, the only solution with the NETGEAR ProSafe VPN Firewall FVS338 is set your LAN subnet as the same of the local subnet of the vpn policies.
So I just set up my LAN as 10.178.51.64 with mask 255.255.255.0 and it worked like a charm.

If I had a professional router like a Cisco I could set some rules to translate some subnet's IP as my partner told me. example: 192.168.1.2 -> 10.178.51.65
Unfortunately this isn't possible with my router/firewall, so the only chance to solve this was to change my LAN subnet.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.