Eu já tinha esse túnel funcionando, mas agora eu precisava adicionar mais dois ips 10.50.240.48/28 e 10.50.96.0/20. Eu configurei minha esquerda e direita e esquerda sub-redes e rightsubnets corretamente na configuração do openswan. Ele já está funcionando, mas eu adicionei mais dois segmentos:
leftsubnets= {10.122.91.0/24 10.153.136.0/24 10.50.240.48/28 10.50.96.0/20 10.37.200.0/24 10.53.221.0/24}
Então, como meu firewall de parede de terra já estava configurado para aceitar tráfego desse túnel, eu só precisava adicionar as duas transmissões para os dois endereços IP adicionados em / etc / shorewall / interfaces:
#ZONE INTERFACE BROADCAST OPTIONS
...
vpn2 tun2 10.122.91.255,10.153.139.255,10.50.240.63,10.50.111.255,10.37.200.255,10.53.221.255
Veja algumas saídas do ipsec auto --status:
000 #993: "wyless/1x0" [email protected] esp.c50b26e3@myip [email protected] tun.0@myip ref=0 refhim=4294901761
000 #977: "wyless/1x0":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 1618s; newest ISAKMP; lastdpd=59s(seq in:0 out:0); idle; import:admin initiate
000 #994: "wyless/2x0":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27432s; newest IPSEC; eroute owner; isakmp#977; idle; import:admin initiate
000 #994: "wyless/2x0" [email protected] esp.30d47987@myip [email protected] tun.0@myip ref=0 refhim=4294901761
000 #995: "wyless/3x0":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 26959s; newest IPSEC; eroute owner; isakmp#977; idle; import:admin initiate
000 #995: "wyless/3x0" [email protected] esp.1b465e60@myip [email protected] tun.0@myip ref=0 refhim=4294901761
000 #551: "wyless/4x0":500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 5719s; newest IPSEC; eroute owner; isakmp#542; idle; import:not set
000 #551: "wyless/4x0" [email protected] esp.5b253e7a@myip [email protected] tun.0@myip ref=0 refhim=4294901761
000 #996: "wyless/5x0":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27444s; newest IPSEC; eroute owner; isakmp#977; idle; import:admin initiate
000 #996: "wyless/5x0" [email protected] esp.ceb8c9d5@myip [email protected] tun.0@myip ref=0 refhim=4294901761
000 #559: "wyless/6x0":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 5076s; newest IPSEC; eroute owner; isakmp#542; idle; import:admin initiate
000 #559: "wyless/6x0" [email protected] esp.3b11db56@myip [email protected] tun.0@myip ref=0 refhim=4294901761
000
Alguma ideia de como posso resolver isso ainda mais?
Tags openswan