David,
Is this still broken? I'd like to trade some debugging attention for a primer
on setting up IPSec, which i've never gotten around to.
On 11Aug2017 14:12, David A. De Graaf <dad@xxxxxxxx> wrote:
I use an ipsec tunnel to connect my LAN (192.168.2.h) in North
Carolina to my son's LAN (192.168.1.h) in Maryland. We each have a
primary machine that manages the ipsec tunnel and several secondary
machines. Static routing tables direct traffic for the remote LAN to
the local primary machine and thence through the tunnel.
Cross-referenced DNS tables effectively join the two LANs as one.
We expect all the usual network tools (autofs/nfs, ssh, rsync, etc.)
to work thru the tunnel.
Recently we've noticed that autofs/nfs and ssh don't work between
a secondary machine and any remote machine.
Autofs/nfs and ssh work perfectly between the primaries.
That sounds like routing, since ssh just does a TCP connection as far as the
networking side goes.
Ping works perfectly between all machines, primary or secondary.
[...]
For autofs the key subfunction seems to be rpcinfo.
Probably the easiest thing to test.
[...]
But from a secondary to the remote primary it fails:
# rpcinfo -p octopus
octopus: RPC: Port mapper failure - Unable to receive: errno 113 (No
route to host)
Similarly, for ssh the basic test seems to be telnet <name> 22.
From primary to primary it works correctly:
# telnet octopus 22
Trying 192.168.1.2...
Connected to octopus.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.4
But from a secondary to the remote primary, it fails:
# telnet octopus 22
Trying 192.168.1.2...
telnet: connect to address 192.168.1.2: No route to host
Both of these look like routing.
In both failures the complaint is "No route to host", but clearly
there is a route to the host, because ping works:
# ping octopus
PING octopus.dino.lan (192.168.1.2) 56(84) bytes of data.
64 bytes from 192.168.1.2 (192.168.1.2): icmp_seq=1 ttl=63 time=107 ms
From router.datix.lan (192.168.2.1): icmp_seq=2 Redirect Host(New
nexthop: datium.datix.lan (192.168.2.2))
The redirect message bothers me.
Each LAN has a router that connects to the internet.
All LAN machines use the router's IP for the default gateway.
In the router is a static route that sends packets destined for the
remote LAN back to the primary machine that handles the ipsec tunnel.
What's the problem here? Why is ping more clever in finding the
route?
What does the routing table on the primary look like? And on a secondary?
"netstat -rn" is what I'm after.
Cheers,
Cameron Simpson <cs@xxxxxxxxxx> (formerly cs@xxxxxxxxxx)
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
