1
  • I'm able to connect successfully from a laptop to my server using Openvpn.
  • I have ipv4 forwarding and NAT enabled on the server.
  • I can access the web, etc.

But the server also has a S2S VPN with Racoon enabled. When I SSH to my server and then 'telnet 80' to the racoon-connected-server it works perfect.

But when I connect from the laptop (which comes over Openvpn) to one of the IPs in the Racoon S2S VPN subnet, it fails.

Any ideas how to setup Racoon together with Openvpn?

1

You have to configure openvpn to push the IPSEC routes to openvpn clients. in your "server.conf" file add on line like this for each network you want to make accessible:

push "route w.x.y.z 255.255.255.0"

disclaimer: the w.x.y.z and the network mask must be adapted to your configuration.

Also note that this way the packets from your laptop will go to the servers on the IPSEC subnets. Now you need to have the packets back to your laptop. The easiest, dirty way is to do a NAT on your racoon server.

edit: how to do the nat The masquerade rule you suggest might work, but I would recommand something more precise like:

iptable -t nat -A POSTROUTING --src <the openvpn client network> --dst <the ipsec networks not aware of the ovpn client network> -j SNAT --to-source <ip address of the openvpn server on network known to the ipsec network>
2
  • Thanks. But how do i do the dirty NAT? something like this: sudo iptables -t nat -A POSTROUTING -s w.x.y.z/24 -o eth0 -j MASQUERADE – Jonas Schnelli Apr 3 '12 at 7:03
  • MASQUERADE is deprecated for static IPs. You should use the method suggested by @olivier-s at the end of his answer. – Magellan Apr 3 '12 at 19:15
0

I suspect that the site on the other side of the S2S vpn doesn't have routing information for your OpenVPN subnet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.