- This topic has 2 replies, 1 voice, and was last updated 22 years, 5 months ago by
.
-
Posts
-
Hi,
I have just managed to setup a roaming client on a PB4/OSX10.3.4 connnecting using VaporSec 1.0 to an OpenBSD 3.4 firewall/security gateway with a shared secret. However, I have noticed a minor annoynace with the routing.
Assume the following situation: there is a WORK network protected by an OpenBSD 3.4 firewall which (in absense of a VPN) passes _only_ SSH to a particular machine on the WORK network. I can connect from ANYWHERE to the WORK ssh server at any time (apart from _after_ using VaporSec).
When on the road I connect from the Internet using some kind of an Internet provider and _either_ use the limited facility of the WORK ssh server _or_ I can setup a VPN to the OpenBSD firewall and access ALL machines of the WORK network.
I have used VaporSec to setup a host-to-network VPN and seemed to be working as expected. I can create tunnels and kill them.
As long as the tunnels are up I can connect from the PB4 to any machine on the network BEHIND the OpenBSD firewall. However, once I kill the tunnels (and the racoon daemon), I can NOT connect to the WORK ssh server.
After a few days on the road (using VPN) I put the PB4 to sleep and returned home.
From home I have a network-to-network VPN to WORK. After connecting the PB4 to the HOME network I am unable to ping/connect to ANY of the machines on the WORK network but I could ping/connect to any of the HOME machines!!
After rebooting the PB4 everything seems to have gone back to normal (i.e. I can connect to the WORK machines from PB4 connected to the HOME net). The only explanation that I have is that despite flushing the IPsec routes in VaporSec there is still “something” that is not cleared up properly..
Looking at “netstat -rn” I could not see any specific routes to the WORK network (but I am not sure that this is the correct methid for checking VPN routing on OSX)…
Any suggestions??
Thanks,–Nino
Thanks for your response.
No, I did *not* setup a local IP for VaporSec – I have only entered the
Remote IPsec device = a.b.c.d
Remote Network = e.f.g.1/24
Local Netmask (32), and
Shared Secretentries in the VaporSec setup. However, I would like to see the routing before and after VaporSec runs… Is there a way to do that?
The only reason I mentioned netstat is that I am used to using IPsec on OpenBSD and there I can see the encapsulated routes by using “netstat -rnf encap” command.
–Nino
Hi,
I think I figured out where the problem is… It seems to be a ‘feature’ of VaporSec that I do not quite understand.
Description:
On my PB4 I have two VPNs defined – one to the WORK network and one to the HOME network. The HOME one is not enabled by default but VPN to WORK one is. At present I am connected to the HOME network (behind the HOME firewall) which already has a VPN to WORK (by way of OpenBSD to OpenBSD connection).
In this state, I just need to start up VaporSec (enter the password for sudo access) and then immediately after that close it (without ever pressing the Vaporise button), and the SPD entries for the _enabled_ VPN get created?! I can see them using the “setkey -PD” command!!
In this case I can no longer ping/connect the WORK network.
I need to manually flush the SPD database (after VaporSec has been closed) by means of a “setkey -FP” command and then the normal routing is restored.
Is this expected behaviour?
Many thanks in advance.–Nino
- You must be logged in to reply to this topic.