Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am establishing site to site tunnel.

192.168.2.0/24===10.103.6.40<10.103.6.40>---10.103.6.1...10.103.6.29<10.103.6.29>===192.168.1.0/24;

Local ip: 10.103.6.40

Local lan: 192.168.2.0/24

Remote lan is behind 10.103.6.29 (router) has lan 10.1.1.0/24.

Remote ip: 10.1.1.44 (Behind 10.103.6.29, I have enabled VPN Passthrough)

Remote lan: 192.168.1.0/24

Now, Tunnel is established, but i can not ping remote lan's machine on 192.168.1.2.

Log of ipsec:

Mar  4 16:34:45 NG authpriv.warn pluto[9431]: listening for IKE messages
Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface br0/br0 192.168.2.1:500
Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface br0/br0 192.168.2.1:4500
Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface eth3/eth3 10.103.6.40:500
Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface eth3/eth3 10.103.6.40:4500
Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface lo/lo 127.0.0.1:500
Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface lo/lo 127.0.0.1:4500
Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface lo/lo ::1:500
Mar  4 16:34:45 NG authpriv.warn pluto[9431]: loading secrets from "/etc/ipsec.secrets"
Mar  4 16:34:46 NG authpriv.warn pluto[9431]: "NG" #1: initiating Main Mode
Mar  4 16:34:46 NG daemon.err ipsec__plutorun: 104 "NG" #1: STATE_MAIN_I1: initiate
Mar  4 16:34:46 NG authpriv.warn pluto[9431]: "NG" #1: received Vendor ID payload [Openswan (this version) 2.6.38 ]
Mar  4 16:34:46 NG authpriv.warn pluto[9431]: "NG" #1: received Vendor ID payload [Dead Peer Detection]
Mar  4 16:34:46 NG authpriv.warn pluto[9431]: "NG" #1: received Vendor ID payload [RFC 3947] method set to=115 
Mar  4 16:34:46 NG authpriv.warn pluto[9431]: "NG" #1: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)
Mar  4 16:34:47 NG authpriv.warn pluto[9431]: "NG" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Mar  4 16:34:47 NG authpriv.warn pluto[9431]: "NG" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Mar  4 16:34:47 NG authpriv.warn pluto[9431]: "NG" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): peer is NATed
Mar  4 16:34:47 NG authpriv.warn pluto[9431]: "NG" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Mar  4 16:34:47 NG authpriv.warn pluto[9431]: "NG" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Mar  4 16:34:47 NG authpriv.warn pluto[9431]: "NG" #1: received Vendor ID payload [CAN-IKEv2]
Mar  4 16:34:47 NG authpriv.warn pluto[9431]: "NG" #1: Main mode peer ID is ID_IPV4_ADDR: '10.103.6.29'
Mar  4 16:34:47 NG authpriv.warn pluto[9431]: "NG" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Mar  4 16:34:47 NG authpriv.warn pluto[9431]: "NG" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_md5 group=modp1024}
Mar  4 16:34:47 NG authpriv.warn pluto[9431]: "NG" #1: Dead Peer Detection (RFC 3706): enabled
Mar  4 16:34:47 NG authpriv.warn pluto[9431]: "NG" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:f5d74d20 proposal=AES(12)_128-MD5(1)_128, AES(12)_192-MD5(1)_128, AES(12)_256-MD5(1)_128, AES(12)_128-SHA1(2)_160, AES(12)_192-SHA1(2)_160, AES(12)_256-SHA1(2)_160, 3DES(3)_192-MD5(1)_128, 3DES(3)_192-SHA1(2)_160 pfsgroup=OAKLEY_GROUP_MODP1024}
Mar  4 16:34:49 NG authpriv.warn pluto[9431]: "NG" #2: Dead Peer Detection (RFC 3706): enabled
Mar  4 16:34:49 NG authpriv.warn pluto[9431]: "NG" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
Mar  4 16:34:49 NG authpriv.warn pluto[9431]: "NG" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x9143bd7d <0x1cb79f9a xfrm=AES_128-HMAC_MD5 NATOA=none NATD=10.103.6.29:4500 DPD=enabled}

Tunnel is established successfully.

local configuration (At 10.103.6.40 side):

config setup
    nat_traversal=yes
    oe=off
    protostack=netkey

conn NGpassthrough
    left=192.168.2.1
    right=0.0.0.0
    leftsubnet=192.168.2.0/24
    rightsubnet=192.168.2.0/24
    authby=never
    type=passthrough
    auto=route

conn NG
    right=10.103.6.29
    rightsubnet=192.168.1.0/24
    left=10.103.6.40
    leftsubnet=192.168.2.0/24
    leftnexthop=10.103.6.1
    auto=start
    leftid=10.103.6.40
    rightid=10.103.6.29
    #x_rightdynamic=yes
    authby=secret
    compress=no
    failureshunt=drop
    dpddelay=15
    dpdtimeout=60
    dpdaction=restart
    pfs=yes
    ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048
    esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1

Remote Configuartion (At 10.1.1.44 side):

config setup
    nat_traversal=yes
    oe=off
    protostack=netkey

conn NGpassthrough
    left=192.168.1.1
    right=0.0.0.0
    leftsubnet=192.168.1.0/24
    rightsubnet=192.168.1.0/24
    authby=never
    type=passthrough
    auto=route

conn NG
    right=10.103.6.40
    rightsubnet=192.168.2.0/24
    left=10.1.1.44
    leftsubnet=192.168.1.0/24
    leftnexthop=10.1.1.1
    auto=start
    leftid=10.103.6.29
    rightid=10.103.6.40
    #x_rightdynamic=yes
    authby=secret
    compress=no
    failureshunt=drop
    dpddelay=15
    dpdtimeout=60
    dpdaction=restart
    pfs=yes
    ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048
    esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1

Firewall rule on 10.103.6.29:

-A PREROUTING -p udp -m udp --dport 500 -j DNAT --to-destination 10.1.1.44:500 
-A PREROUTING -p udp -m udp --dport 4500 -j DNAT --to-destination 10.1.1.44:4500 

I have two pc's at both end. On local side PC has ip 192.168.2.2 and at remote side PC has ip 192.168.1.2.

I CAN PING REMOTE ROUTER (192.168.1.1) but, can't access/ping remote lan PC (192.168.1.2).

Help me please.

share|improve this question
    
Brijesh, please don't forget, that ICMP Echo functionality which ping uses is not somthing that is always available. It's quite common for various distribution to disable it for security reasons. –  Leonid Mar 4 '13 at 18:49
    
Thanks @Leonid for reply. But I have checked this with FTP, SSH, and other telnet service too. Nothing is working. I have checked my network there is no security policy applied. –  Brijesh Valera Mar 7 '13 at 9:33
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.