Configuring IPsec

# ping -I 193.111.228.1 192.0.2.13

PING sunrise-13.testbed.xelerance.net (192.0.2.13) from 193.111.228.1 : 56(84) bytes of data. 64 bytes from sunrise-13.testbed.xelerance.net (192.0.2.13): icmp_seq=1 ttl=64 time=136.9 ms

This time we have created a packet on West with source address 193.111.228.1 and destination address 192.0.2.13. This packet now falls under the definition of our Sunset-Sunrise IPsec tunnel, so the packets sent and received will properly travel back and forth through the IPsec tunnel.

Encrypting the Host and the Network Behind It

Usually, when you connect two LANs, you also want the two gateways to talk to each other. Since the gateways have an IP address in the LAN, you would also expect that defining a single subnet-to- subnet IPsec tunnel would be enough. As we have seen though, since the gateways use their external IP address to communicate to the outside, these gateways cannot easily initiate connections across the VPN. Responding usually is not a problem, as in that case the gateway's internal IP address is specifically targeted, and thus part of the IPsec tunnel. There are two ways to address this issue.

Employing Advanced Routing

The first approach is to trick the Linux kernel to always use the internal IP address, even when talking to the other end's remote IP address (unless it is an IPsec packet). This can be accomplished with advanced routing on West:

# ip route add 205.150.200.209 via 193.110.157.82 src 193.111.228.1

This tells West's kernel that if a packet for 205.150.200.209 is created on West, do not use the closest IP address, but use 193.111.228.1 instead. Of course, you will need a similar rule on East for 193.110.157.131. The above ip route command is automatically executed for you if you use the leftsourceip= or rightsourceip= option, as in this example:

conn sunset-sunrise left=193.110.157.131 leftsubnet=193.111.228.0/24 leftsourceip=193.111.228.1 right=205.150.200.209 rightsubnet=192.0.2.0/24 rightsourceip=192.0.2.1 leftrsasigkey=0sAQ43A1....

rightrsasigkey=0sAQfP63....

auto=start

Creating More Tunnels

The second approach might be easier: just create another two IPsec tunnels. One goes from West to Sunrise, and the other from East to Sunset. It might not seem very elegant to have a total of four IPsec tunnels to encrypt all traffic between two subnets and their gateways, but it is the easiest to configure. For instance, the West-Sunrise IPsec tunnel would look like this:

conn west-sunrise left=193.110.157.131

# leftsubnet=193.111.228.0/24 is not used now right=205.150.200.209 rightsubnet=192.0.2.0/24 leftrsasigkey=0sAQ43A1....

rightrsasigkey=0sAQfP63....

auto=start

88