I should have been clearer.

I want subnet-to-subnet.

It doesn't work on a ping between machines in the subnets, so I am missing something!.

Thanks. John

Uli Wurst wrote:

-----Ursprüngliche Nachricht----- Von: John Lederer [mailto:john@jhml.org] Gesendet: Sonntag, 29. Juni 2003 19:52 An: suse-security@suse.com Betreff: [suse-security] IPSEC plus SuSEFfrewall2

Hello John,

...

I am struggling to get a vpn working between two Suse 8.2 boxes. [SNIP] conn jhlnet-to-drsnet left=24.196.143.44 leftsubnet=192.168.0.0/255.255.0.0 leftid=@golum.ipsec.con leftrsasigkey=[keyid AQOyimW2p] leftnexthop=%defaultroute rightupdown="/usr/lib/ipsec/_updown_custom" right=208.171.49.111 rightsubnet=10.1.0.0/255.255.0.0 # rightid=@stpeter.ipsec.con # rightrsasigkey=[sums to 7873...] rightnexthop=%defaultroute auto=start

IIRC this will only create a tunnel between the networks, NOT between your two IPSEC-Gateways. Try to ping between two machines within the right- and leftsubnet and it should work. If you want tunneled communication beween the two gateway-machines you will have to add a section

conn jhlnet-to-drsnet-from-this-gatway left=24.196.143.44 leftid=@golum.ipsec.con leftrsasigkey=[keyid AQOyimW2p] leftnexthop=%defaultroute rightupdown="/usr/lib/ipsec/_updown_custom" right=208.171.49.111 rightsubnet=10.1.0.0/255.255.0.0 # rightid=@stpeter.ipsec.con # rightrsasigkey=[sums to 7873...] rightnexthop=%defaultroute auto=start

on both ends of the tunnel (the "leftsubnet" on the left gateway's side has been left out, so this would be from golum's ipsec.conf). On stpeter's side you have to delete the rightsubnet line.

HTH,

Uli