[LARTC] iproute2 src/FreeS/WAN

[Adrian Chung <adrian@enfusion-group.com>]

Hi!

I've got two FreeS/WAN gateways setup, with one subnet<->subnet tunnel
setup, which is working fine.

I've setup iproute2 to route anything for either subnet via the ipsec0
device using a src address of the local interface.  This is to force
locally generated traffic (ie, traffic generated on the server) to go
through the VPN, rather than out with a source IP of the external
interface.

So I've done:

    ip rule add table 1 prio 100
    ip route add table 1 <remoteLAN>/CIDR dev ipsec0 src <internalIP>
    ip route flush cache

Now, my confusion is with regards to the src <internalIP> bit.  I've
been assuming that the 'src ...' syntax actually changes the source IP
in the packets matching the route to the IP specified, much like SNAT
does.

But this doesn't seem to be the case.

With the above rule set in place, traffic from the local LAN gets
routed over the VPN to the other end, but appears to have come from
the IP of whatever LAN client sent the packet, not the internal IP of
the VPN gateway.

I expected that since I haven't specified that table 1 only pertains
to traffic from device 'lo' it should apply the rule to all traffic,
including traffic from the local LAN that's crossing the VPN, and
change the src IP in the packets to its own internal IP.

It's kernel 2.2.19, I believe (definitely a 2.2 series kernel).

What am I missing?

--
Adrian Chung (adrian at enfusion-group dot com)
http://www.enfusion-group.com/~adrian
GPG Fingerprint: C620 C8EA 86BA 79CC 384C E7BE A10C 353B 919D 1A17
[rogue.enfusion-group.com] 1:15am up 18 days, 6:35, 2 users

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/