legege at legege
Nov 29, 2009, 6:52 PM
Post #16 of 18
(4808 views)
Permalink
|
Freek,
I tried on Linux, and the vpnc-nortel r414 no longer work with my VPN gateway. It definitely used to work, I'll investigate.
--
Georges-Etienne Legendre, Eng.
On 2009-11-28, at 5:52 PM, Freek Dijkstra wrote:
> Hi Georges,
>
> Some random thoughts I had while reading your routing tables.
>
> Georges-Etienne Legendre wrote:
>
>> ======= Situation #1: on Windows, this obviously work =======
>>
>> Network Destination Netmask Gateway Interface Metric
>> 0.0.0.0 0.0.0.0 10.10.0.213 10.10.0.213 1
>> 0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.91 11
>
> I very much dislike two "default" routes, but with the metric, at least
> I know the first one if preferred. So am I right that with windows *all*
> your traffic is going over the VPN link?
>
>> 10.10.0.0 255.255.240.0 10.10.0.213 10.10.0.213 30
> [...]
>> 10.10.255.255 255.255.255.255 10.10.0.213 10.10.0.213 30
>
> Curious (but harmless) entry; why would Window make a separate entry for
> the broadcast address (the one for 10.10.0.0 would cover this already).
>
>
>> ====== Situation #2: On Mac OS X, with the vpnc-script r414; not working ======
>>
>> To mee, it looks really similar to the one I get on Windows. But it doesn't work.
>>
>> Destination Gateway Flags Refs Use Netif Expire
>> default 10.10.0.213 UGSc 0 0 tun0
>> default tun0 UCSI 4 0 tun0
>
> Again, I very much dislike two default gatways. You may want to manually
> remove one of them. In this case, I also don't understand what the
> second one means.
>
> If you want *all* traffic to use your VPN network (including traffic
> with destination outside of your VPN network):
>
>> default 10.10.0.213 UGSc 0 0 tun0
>
> If you want traffic destined to outside of your VPN network to continue
> using the regular Internet as-is:
>
>> default 192.168.1.1 UGSc 0 0 en0
>
>
>
>
>> 127 127.0.0.1 UCS 0 0 lo0
>> 127.0.0.1 127.0.0.1 UH 0 0 lo0
>> 10.10.0.213 10.10.0.213 UH 1 0 tun0
>> 10.10.0.213/32 tun0 UCS 0 0 tun0
>> 169.254 link#4 UCS 0 0 en0
>> 192.168.1 link#4 UCS 2 0 en0
>> 192.168.1.91 127.0.0.1 UHS 0 0 lo0
>> 10.200.200.20 192.168.1.1 UGHS 2 1 en0
>
> This routing table will clearly not work. There is no entry for your VPN
> network, 10.10.0.0/20.
>
>> tun0: flags=8951<UP,POINTOPOINT,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1412
>> inet 10.10.0.213 --> 10.10.0.213 netmask 0xfffff000
>> open (pid 482)
>
> Seems OK, even though the two IP address are the same (apparently the
> one on the left is the IP assigned to your tun0 interface; the IP on the
> right is the IP assigned to the VPN gateway inside the VPN network. For
> my PPTP tunnel I set up with Mac OS X, it is a different IP. For my
> vpnc-nortel tunnel it is the same IP.
>
>
>> ====== Situation #3: On Mac OS X, with the vpnc-script-mac; not working ======
>>
>> Destination Gateway Flags Refs Use Netif Expire
>> default 192.168.1.1 UGSc 2 0 en0
>> 127 127.0.0.1 UCS 0 0 lo0
>> 127.0.0.1 127.0.0.1 UH 0 0 lo0
>> 10.10.0/20 link#4 UC 2 0 en0
>> 10.10.0.213 0:1x:fx:dx:9x:1x UHLWI 0 1 lo0
>> 10.10.15.255 ff:ff:ff:ff:ff:ff UHLWbI 0 3 en0
>> 169.254 link#4 UCS 0 0 en0
>> 192.168.1 link#4 UCS 4 0 en0
>> 192.168.1.91 127.0.0.1 UHS 0 0 lo0
>> 192.168.1.255 ff:ff:ff:ff:ff:ff UHLWbI 0 1 en0
>> 10.200.200.20 192.168.1.1 UGHS 2 1 en0
>>
>> ** ifconfig for en0 and tun0 **
>>
>> en0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
>> inet 10.10.0.213 netmask 0xfffff000 broadcast 10.10.15.255
>> inet 192.168.1.91 netmask 0xffffff00 broadcast 192.168.1.255
>> ether 00:1x:fx:dx:9x:1x
>> media: autoselect (100baseTX <full-duplex,flow-control>) status: active
>> supported media: autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full
>> tun0: flags=8850<POINTOPOINT,RUNNING,SIMPLEX,MULTICAST> mtu 1500
>> open (pid 606)
>
> Here your IP is assigned to en0 instead of to tun0. This will not work.
>
> I recommend you to try with the regular (non Mac) vpnc script and add or
> modify the routing table manually.
>
>
> Given how my routing table looks, I would expect your to look like this:
>
>> Destination Gateway Flags Refs Use Netif Expire
>> default 192.168.1.1 UGSc 2 0 en0
>> 127 127.0.0.1 UCS 0 0 lo0
>> 127.0.0.1 127.0.0.1 UH 0 0 lo0
>> 192.168.1 link#4 UCS 2 0 en0
>> 192.168.1.91 127.0.0.1 UHS 0 0 lo0
>> 192.168.1 link#4 UCS 4 0 en0
>> 192.168.1.255 ff:ff:ff:ff:ff:ff UHLWbI 0 1 en0
>> 10.10.0.213 10.10.0.213 UH 1 0 tun0
>> 10.10.0/20 10.10.0.213 UGSc 2 0 tun0
>> 10.200.200.20 192.168.1.1 UGHS 2 1 en0
>> 169.254 link#4 UCS 0 0 en0
>
> I would expect your ifconfig to look exactly like it does for your
> scenario #2:
>
>> en0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
>> inet 192.168.1.91 netmask 0xffffff00 broadcast 192.168.1.255
>> ether 00:1x:fx:dx:9x:1x
>> media: autoselect (100baseTX <full-duplex,flow-control>) status: active
>> supported media: autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full
>> tun0: flags=8951<UP,POINTOPOINT,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1412
>> inet 10.10.0.213 --> 10.10.0.213 netmask 0xfffff000
>> open (pid 482)
>
>
> However, before you start modifying your routing table, you first must
> answer:
>
> * Should only traffic destined to your VPN network use the tunnel, or
> * Should *all* traffic use the tunnel, even if it's destination is
> outside of the VPN network?
>
> The above table is only for the first scenario.
>
> If you need help with the correct "route" commands to manually create
> the above routing table, let me know!
>
> Regards,
> Freek
>
_______________________________________________
vpnc-devel mailing list
vpnc-devel [at] unix-ag
https://lists.unix-ag.uni-kl.de/mailman/listinfo/vpnc-devel
http://www.unix-ag.uni-kl.de/~massar/vpnc/
|
patch-20091104.diff
