I'm trying to configure, through OpenSwan on a
Linux Ubuntu 14.04 the following scenario.
It's an interesting configuration and it would be great to understand why I'm failing configuring correctly, even because it can help many people resolving this issue (Internet is plenty of questions about it and "half" answers).
[L-App Server]<=>[L-VPN GW]<====>[R-VPN GW]<=>[NAT]<=>[R-App Server]
[L-VPN GW]is my VPN Gateway with Public-IP
10.1.1.1and is into the Left-Subnet
10.0.0.0/8, even with the
[R-VPN GW]is VPN Gateway of other side with Public-IP
22.214.171.124. I have to reach a
[R-App Server]with address
10.0.0.0/8, connected to a
126.96.36.199/32(not publicly reachable, but only reachable after tunnel instauration).
As you can see, both
Left Subnet and
Right Subnet are the same. So, when I try to (for example)
ping 10.2.2.2 from my
L-VPN GW, requests are not forwarded through the VPN tunnel, but through the LAN.
Also, I cannot see an
ipsec0 interface, in such a way I could
route the traffic to
10.2.2.2 through that interface (even if I don't thing it would be a solution, because of the NAT).
- How can I manage a scenario like this with overlapping subnets?
- How can I set a
ipsec0interface? (I've tried with
interfaces="ipsec=eth0"but it fails)
- In the full scenario, I have more
[R-App Servers]connected to different
NATsreachable from the same
right=188.8.131.52 rightid=184.108.40.206 rightsubnet=220.127.116.11/32 rightnexthop=18.104.22.168 # Even without rightnexthop tried rightsourceip=10.2.2.2
0.0.0.0 10.0.0.254 0.0.0.0 UG 0 0 0 eth0 10.1.1.1 0.0.0.0 255.255.255.192 U 0 0 0 eth0 22.214.171.124 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
So, as I understand, it would be nice if I had
10.1.1.1 instead of
126.96.36.199 in the routes. I've tried to add it as my
ipsec fails to bring up the tunnel.
If you need some data please comment the question. In the meaning time, thank you very much for your help :)