IPSec Tunnel to Amazon EC2 - Netkey, NAT, and routing problem
- by Ernest Mueller
Hey all, I'm working on getting an IPSec VPN working between Amazon EC2 and my on-premise. The goal is to be able to safely administer stuff, up/download data, etc. over that tunnel.
I have gotten the tunnel up in openswan between a Fedora 12 instance with an elastic IP and a Cisco router that's also NATted. I think the ipsec part is OK, but I'm having trouble figuring out how to route traffic that way; there's no "ipsec0" virutal interface because on Amazon you have to use netkey and not KLIPS for the vpn. I hear iptables may be required and I'm an iptables noob.
On the left (Amazon), I have a 10. network.
Box 1 is privately 10.254.110.A, publically IP 184.73.168.B.
Netkey tunnel is up.
Box 2 is publically 130.164.26.C, privately 130.164.0.D
And my .conf is:
conn ni
type= tunnel
authby= secret
left= 10.254.110.A
leftid= 184.73.168.B
leftnexthop= %defaultroute
leftsubnet= 10.254.0.0/32
right= 130.164.26.C
rightid= 130.164.0.D
rightnexthop= %defaultroute
rightsubnet= 130.164.0.0/18
keyexchange= ike
pfs= no
auto= start
keyingtries= 3
disablearrivalcheck=no
ikelifetime= 240m
auth= esp
compress= no
keylife= 60m
forceencaps= yes
esp= 3des-md5
I added a route to box 1 (130.164.0.0/18 via 10.254.110.A dev eth0) but that doesn't do it for predictable reasons, when I traceroute the traffic's still going "around" and not through the vpn.
Routing table:
10.254.110.0/23 dev eth0 proto kernel scope link src 10.254.110.A
130.164.0.0/18 via 10.254.110.178 dev eth0 src 10.254.110.A
169.254.0.0/16 dev eth0 scope link metric 1002
Anyone know how to do the routing with a netkey ipsec tunnel where both sides are NATted?
Thanks...
