5

The problem: after establishing an IPsec VPN tunnel all traffic is routed to the remote endpoint, while I only need to route the packets destined to that internal network and still be able to access the internet on my local machine. Currently, when I enable the according VPN connection - all connectivity drops, meaning it's not possible to reach this machine over my LAN or access the internet through it (there is a restriction on the remote end for further WAN forwarding). So, only the VPN works in this case.

The topology: https://i.sstatic.net/6cTDr.png

I'm using OpenSwan on a Debian-based distro and also behind NAT (traversal enabled).

Here are the details of ipsec.conf:

version 2.0

config setup
plutodebug="none"
plutoopts="--perpeerlog"
plutoopts="--interface=wlan2"
dumpdir=/var/run/pluto/
nat_traversal=yes
virtual_private=%v4:10.196.0.0/17,%v4:!192.168.1.0/24
oe=off
protostack=netkey

conn z
authby=secret
keylife=1h
pfs=yes
auto=add
phase2alg=aes128-sha1;modp1024
keyingtries=3
ikelifetime=8h
type=tunnel
left=192.168.1.76
leftsubnet=0.0.0.0/0
leftprotoport=0/0
right=y.y.y.y
rightsubnet=0.0.0.0/0
rightprotoport=0/0

Here are partial details of ifconfig:

wlan0 Link encap:Ethernet HWaddr 00:13:02:46:42:8d
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

wlan2 Link encap:Ethernet HWaddr 94:0c:6d:8d:28:0f
inet addr:192.168.1.76 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::960c:6dff:fe8d:280f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:125221 errors:0 dropped:0 overruns:0 frame:0
TX packets:89332 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:151498702 (151.4 MB) TX bytes:18233148 (18.2 MB)

Here are the details of route -n:

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 wlan2
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 wlan2
192.168.1.0 0.0.0.0 255.255.255.0 U 2 0 0 wlan2

As you can see - the machine is connected over WiFi on wlan2 and this is the interface that is taking part in the VPN setup. So, what would you suggest doing, in order to solve the problem of losing internet access after enabling the tunnel? Thank you.

Improve this question
1
  • Urm, AFIK, this is the correct behaviour for a VPN. When setting up a VPN connection, you are making a hole into a remote local network and you need to have all traffic routed through that network for security. If you allow some traffic to bypass the VPN, it is a significant security risk.
    – Julian Knight
    Commented Jun 28, 2012 at 9:54

1 Answer 1

Reset to default
4

This is the problem:

rightsubnet=0.0.0.0/0

with this line you tell openswan that the endpoint of the tunnel is "everything", so all packets are routed through the vpn.

Replace 0.0.0.0/0 with the network(s) you want to reach behind the gateway. The config on the client and server has to match, so edit both.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .