Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have following network configuration:

Office1 <-- openvpn --> office2 <-- ipsec tunnel --> branch office

Office1 and office2 are on Debian, Branch office: juniper srx100

Office1 network: 172.17.20.0/24
Office2 network: 192.168.31.0/24
Branch network: 192.168.16.0/24

What works: office1 <-> office2, branch_office <-> office2, branch office --> office1

but traffic from office1 can't reach branch office from office1. Traffic comes to office2 and disappears. Nothing logged by "-j LOG" iptables rules

Why it doesn't work? How it can be fixed?

upd:

->> Can you show the routing tables from all 3 devices? – Tom O'Connor♦ 3 hours ago 1

Office1:

192.168.31.0/24 via 192.168.31.254 dev tun6
192.168.16.0/24 via 192.168.31.254 dev tun6 
172.17.20.0/24 dev vlan20  proto kernel  scope link  src 172.17.20.1 
default via 85.21.118.145 dev vlan7

office2:

172.17.20.1 dev tun0  proto kernel  scope link  src 192.168.31.254 
192.168.70.0/24 dev eth0  proto kernel  scope link  src 192.168.70.254 
192.168.31.0/24 dev eth0  proto kernel  scope link  src 192.168.31.254 
172.17.20.0/24 via 172.17.20.1 dev tun0 
default via 62.176.6.1 dev eth1

branch office:

show route 

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0          *[Static/5] 1w0d 04:16:31
                    > to 109.195.11.254 via fe-0/0/0.0
109.195.10.0/23    *[Direct/0] 1w0d 04:16:31
                    > via fe-0/0/0.0
109.195.10.17/32   *[Local/0] 1w0d 04:16:31
                      Local via fe-0/0/0.0
172.17.20.0/24     *[Static/5] 00:37:33
                    > via st0.0
192.168.16.0/24    *[Direct/0] 6d 04:54:35
                    > via vlan.0
192.168.16.1/32    *[Local/0] 1w0d 04:32:01
                      Local via vlan.0
192.168.31.0/24    *[Static/5] 00:37:33
                    > via st0.0
192.168.70.0/24    *[Static/5] 00:37:33
                    > via st0.0

-> How do the IPsec policies look like between office2 and branch office? (try ip xfrm policy on office2)

src 0.0.0.0/0 dst 0.0.0.0/0 
        dir 4 priority 0 ptype main 
src 0.0.0.0/0 dst 0.0.0.0/0 
        dir 3 priority 0 ptype main 
src 0.0.0.0/0 dst 0.0.0.0/0 
        dir 4 priority 0 ptype main 
src 0.0.0.0/0 dst 0.0.0.0/0 
        dir 3 priority 0 ptype main 
src 192.168.16.0/24 dst 0.0.0.0/0 
        dir fwd priority 2147483648 ptype main 
        tmpl src branch_ip dst office2_ip
                proto esp reqid 0 mode tunnel
src 192.168.16.0/24 dst 0.0.0.0/0 
        dir in priority 2147483648 ptype main 
        tmpl src branch_ip dst office2_ip
                proto esp reqid 0 mode tunnel
src 0.0.0.0/0 dst 192.168.16.0/24 
        dir out priority 2147483648 ptype main 
        tmpl src office2_ip dst branch_ip
                proto esp reqid 0 mode tunnel
share|improve this question
1  
Can you show the routing tables from all 3 devices? –  Tom O'Connor May 29 '13 at 8:38
1  
How do the IPsec policies look like between office2 and branch office? (try ip xfrm policy on office2) –  ecdsa May 29 '13 at 9:43
    
Initial post updated, thank you for your reply's. –  Hikaru May 29 '13 at 11:57
add comment

1 Answer 1

You might not have enabled IP forwarding on office2. Try either:

cat /proc/sys/net/ipv4/ip_forward

or Debian specifically:

sysctl net.ipv4.ip_forward

The parameter should be "1". On Debian, edit /etc/sysctl.conf and somewhere (around lines 27 and 28 on Squeeze) you should find -

# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1

Uncomment the line, reboot, and you should find it's now persistently set to forward packets.

share|improve this answer
    
Thank you for your reply, but it has been done long ago (even before branch office has been created). –  Hikaru May 30 '13 at 4:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.