Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to use Openswan (version 2.6.37) to connect an IPsec VPN from my local network to a remote site. Everything works fine when I just want to connect to a single subnet on the remote site. However, the remote site also has an extra subnet that I want to access.

This is my configuration:

conn myConn
        type=tunnel
        left=192.168.139.14
        leftsubnet=192.168.139.0/24
        leftxauthclient=yes
        right=X.X.X.X
        rightsubnet=172.16.1.0/24
        keyexchange=ike
        auth=esp
        authby=secret
        phase2alg=3des-sha1
        pfs=yes

When I replace rightsubnet with rightsubnets, like so:

rightsubnets={172.16.1.0/24 192.168.3.0/24}

...then the connection is created successfully but only the last subnet in the list is available. Any attempts to ping anything on the 172.16.1.0 subnet fails. If I swap the order of the subnets around then I can ping 172.16.1.X but can't ping anything on the other subnet. It's as if Openswan is only using the last subnet in the list to create a connection.

Am I doing something wrong here?

A little bit of extra information that I neglected to mention (although I'm not sure it's relevant): My Openswan client is behind a router using NAT and I have nat_traversal=yes in my ipsec.conf file.

share|improve this question
    
Do you use VLANs? I had almost exactly the same problem and the issue was a VLAN error –  user30549 Jan 19 '13 at 2:32
    
Have you tried making two security associations, one for each subnet? –  gimmesudo Jan 19 '13 at 11:10
    
@Tyke, no I'm not using VLANs. My OpenSwan client is behind a router using NAT though - I've updated the question to reflect that. –  Lorax Jan 23 '13 at 10:32
    
@gimmesudo: I tried duplicating my configuration above for a new connection (connection myConn2), with everything identical except for the rightsubnet. When I use ipsec auto --up myConn I can ping 172.168.1.X. When I try to bring up the second connection (ipsec auto --up myConn2), I can ping 192.168.3.X but the first connection dies completely. –  Lorax Jan 23 '13 at 11:16
    
For conneting as a client on many IPSec routers (like Cisco), You'll simplier to use vpnc ! –  F. Hauri Mar 2 '13 at 17:13
add comment

2 Answers 2

Looks like the usual separator for the multiple subnets is a comma, but at least openswan-2.6.32 works with spaces too.

Interesting information should be logged to /var/log/secure which could contain clues why it isn't working. Also post the output of ip x s sh and ip x p sh.

share|improve this answer
add comment

Make conn section configuration for each subnets on BOTH endpoints of the tunnel. Only one of them (the first started) will start a SA negotiation, the second (or more) will only make a new SPD of the further subnets.

share|improve this answer
    
Unfortunately I can't do this as the remote endpoint is a third-party FortiGate router (not running OpenSwan). I'm starting to wonder if the problem may be related to the router not being able to cope with multiple tunnels between the same endpoints. –  Lorax Feb 4 '13 at 14:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.