Hi! I've got two FreeS/WAN gateways setup, with one subnet<->subnet tunnel setup, which is working fine. I've setup iproute2 to route anything for either subnet via the ipsec0 device using a src address of the local interface. This is to force locally generated traffic (ie, traffic generated on the server) to go through the VPN, rather than out with a source IP of the external interface. So I've done: ip rule add table 1 prio 100 ip route add table 1 <remoteLAN>/CIDR dev ipsec0 src <internalIP> ip route flush cache Now, my confusion is with regards to the src <internalIP> bit. I've been assuming that the 'src ...' syntax actually changes the source IP in the packets matching the route to the IP specified, much like SNAT does. But this doesn't seem to be the case. With the above rule set in place, traffic from the local LAN gets routed over the VPN to the other end, but appears to have come from the IP of whatever LAN client sent the packet, not the internal IP of the VPN gateway. I expected that since I haven't specified that table 1 only pertains to traffic from device 'lo' it should apply the rule to all traffic, including traffic from the local LAN that's crossing the VPN, and change the src IP in the packets to its own internal IP. It's kernel 2.2.19, I believe (definitely a 2.2 series kernel). What am I missing? -- Adrian Chung (adrian at enfusion-group dot com) http://www.enfusion-group.com/~adrian GPG Fingerprint: C620 C8EA 86BA 79CC 384C E7BE A10C 353B 919D 1A17 [rogue.enfusion-group.com] 1:15am up 18 days, 6:35, 2 users