Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.misc > #5413

Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor

Show all headers | View raw

On Thursday, May 24th, 2012, at 15:40:33h +0100, Chris Davies wrote:

> pcA  ----->  router1  =====/=====  router2[endpoint]
>
> What I'm finding most strange is that the private IP address for pcA on
> my own LAN is being propagated into the network behind router2.

You may think it strange but that is exactly what would should expect.
Remember IPSEC is like a tunnel and it starts from your PC, so the
IP address associated with that will be your local private LAN address.

> I would have expected pcA to be leased an address from the address
> space owned/managed by router2.

No, because in order to setup the IPSEC tunnel you have to start
with two IP end point addresses (as far as I am aware, corrections
invited).

This is true whether you use certificates

     <http://www.strongswan.ORG/uml/testresults/ikev2/rw-cert/>

or pre-shared keys

     <http://www.strongswan.ORG/uml/testresults/ikev2/rw-psk-ipv4/>

because your traffic is still passing through your your network device
eth0.

With openvpn it is rather different becauase traffic then goes via a
virtual device tun which does have a network address on each end different
to the local network.

If you want to start doing complicated things with using different
addresses to the local network, you can set up a GRE tunnel on top
of the IPsec tunnel  ;)  If you want to do multicasting, you actually
do need one of those plus a multicast router daemon on each end.

> I think there are options to provide a static IP address but not a
> dynamic one from a pool.

That is my [limited] understanding also, but please prove me wrong
if another configuration can make it possible ...

Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

PPTP and NAT, IPSec and vpnc to Draytek Vigor Chris Davies <chris-usenet@roaima.co.uk> - 2012-05-18 01:09 +0100
  Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor Stan Bischof <stan@worldbadminton.com> - 2012-05-18 13:30 +0000
    Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor Chris Davies <chris-usenet@roaima.co.uk> - 2012-05-19 01:07 +0100
      Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor The Natural Philosopher <tnp@invalid.invalid> - 2012-05-19 01:16 +0100
  Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor J G Miller <miller@yoyo.ORG> - 2012-05-19 10:58 +0000
    Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor Chris Davies <chris-usenet@roaima.co.uk> - 2012-05-23 19:57 +0100
      Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor J G Miller <miller@yoyo.ORG> - 2012-05-24 13:15 +0000
        Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor Chris Davies <chris-usenet@roaima.co.uk> - 2012-05-24 15:40 +0100
          Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor J G Miller <miller@yoyo.ORG> - 2012-05-24 15:49 +0000
            Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor Chris Davies <chris-usenet@roaima.co.uk> - 2012-05-24 23:54 +0100
              Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor J G Miller <miller@yoyo.ORG> - 2012-05-25 00:10 +0000
                Re: PPTP and NAT, IPSec and vpnc to Draytek Vigor Chris Davies <chris-usenet@roaima.co.uk> - 2012-05-25 08:51 +0100

csiph-web