[LARTC] iproute2 src/FreeS/WAN

[LARTC] iproute2 src/FreeS/WAN

[Adrian Chung]

Hi!

I've got two FreeS/WAN gateways setup, with one subnet<->subnet tunnel
setup, which is working fine.

I've setup iproute2 to route anything for either subnet via the ipsec0
device using a src address of the local interface.  This is to force
locally generated traffic (ie, traffic generated on the server) to go
through the VPN, rather than out with a source IP of the external
interface.

So I've done:

    ip rule add table 1 prio 100
    ip route add table 1 <remoteLAN>/CIDR dev ipsec0 src <internalIP>
    ip route flush cache

Now, my confusion is with regards to the src <internalIP> bit.  I've
been assuming that the 'src ...' syntax actually changes the source IP
in the packets matching the route to the IP specified, much like SNAT
does.

But this doesn't seem to be the case.

With the above rule set in place, traffic from the local LAN gets
routed over the VPN to the other end, but appears to have come from
the IP of whatever LAN client sent the packet, not the internal IP of
the VPN gateway.

I expected that since I haven't specified that table 1 only pertains
to traffic from device 'lo' it should apply the rule to all traffic,
including traffic from the local LAN that's crossing the VPN, and
change the src IP in the packets to its own internal IP.

It's kernel 2.2.19, I believe (definitely a 2.2 series kernel).

What am I missing?

--
Adrian Chung (adrian at enfusion-group dot com)
http://www.enfusion-group.com/~adrian
GPG Fingerprint: C620 C8EA 86BA 79CC 384C E7BE A10C 353B 919D 1A17
[rogue.enfusion-group.com] 1:15am up 18 days, 6:35, 2 users

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] iproute2 src/FreeS/WAN

[bert hubert]

On Thu, Feb 14, 2002 at 01:22:18AM -0500, Adrian Chung wrote:

> I've setup iproute2 to route anything for either subnet via the ipsec0
> device using a src address of the local interface.  This is to force
> locally generated traffic (ie, traffic generated on the server) to go
> through the VPN, rather than out with a source IP of the external
> interface.
> 
> So I've done:
> 
>     ip rule add table 1 prio 100
>     ip route add table 1 <remoteLAN>/CIDR dev ipsec0 src <internalIP>
>     ip route flush cache
> 
> Now, my confusion is with regards to the src <internalIP> bit.  I've
> been assuming that the 'src ...' syntax actually changes the source IP
> in the packets matching the route to the IP specified, much like SNAT
> does.

As far as I know, and that's not very far, 'src' mainly changes the source
address chosen for locally generated traffic ('on the box') going out that
interface.

The 'ip' tool actually has some pretty nice documentation in the form of a
rather big TeX file, which is mentioned in the HOWTO. ip-cref.tex it's
called I think.

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
Netherlabs BV / Rent-a-Nerd.nl           - Nerd Available -
Linux Advanced Routing & Traffic Control: http://ds9a.nl/lartc
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/