I'm trying to configure, through OpenSwan on a Linux Ubuntu 14.04 the following scenario.
It's an interesting configuration and it would be great to understand why I'm failing configuring correctly, even because it can help many people resolving this issue (Internet is plenty of questions about it and "half" answers).


[L-App Server]<=>[L-VPN GW]<====>[R-VPN GW]<=>[NAT]<=>[R-App Server] 
  • [L-VPN GW] is my VPN Gateway with Public-IP and Private-IP and is into the Left-Subnet, even with the [L-App Server]
  • [R-VPN GW] is VPN Gateway of other side with Public-IP I have to reach a [R-App Server] with address and Right-Subnet, connected to a NAT with address (not publicly reachable, but only reachable after tunnel instauration).

As you can see, both Left Subnet and Right Subnet are the same. So, when I try to (for example) ping from my L-VPN GW, requests are not forwarded through the VPN tunnel, but through the LAN.
Also, I cannot see an ipsec0 interface, in such a way I could route the traffic to through that interface (even if I don't thing it would be a solution, because of the NAT).


  • How can I manage a scenario like this with overlapping subnets?
  • How can I set a ipsec0 interface? (I've tried with interfaces="ipsec=eth0" but it fails)
  • In the full scenario, I have more [R-App Servers] connected to different NATs reachable from the same [R-VPN GW]


# Even without rightnexthop tried

route -n         UG    0      0        0 eth0 U     0      0        0 eth0 UH    0      0        0 eth0

So, as I understand, it would be nice if I had instead of in the routes. I've tried to add it as my rightsubnet, but ipsec fails to bring up the tunnel.

If you need some data please comment the question. In the meaning time, thank you very much for your help :)

  • 1
    You need to re-number one side. – EEAA Jan 3 '17 at 15:12
  • @EEAA thanks for your answer. Even if I re-number one side (let's say, so my new [R-App Server] will be, how I could manage the fact that the must be routed through the VPN? I see announced only the NAT subnet, so only that route is pushed ... You could save my life with your answer :D. Thank you ! – Echoes_86 Jan 3 '17 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.