Are you by any chance referring to the phenomenon where everyone in the world uses 192.168.1.0/24 as their internal subnet? Wherein even if you can get the two private subnets linked together routing fails to happen? If so, I don't think there's a solution. Or not a good one at any rate. If you could guarantee unique addresses at each end, you might be able to pull something off with a bridge. Or, perhaps you could use some NAT-magic to add 100 to the foreign IP's while in transit. (By that I mean make .1 equal to .101 on the other network.) Still though, this is a bad idea. One out-of-scope IP would kill a setup of this type. And, since changing one subnet or the other is probably the first idea people get when faced with this, I'd guess you can't control the scopes. Or, maybe I misunderstood. Bob -----Original Message----- From: netfilter-admin@xxxxxxxxxxxxxxxxxxx [mailto:netfilter-admin@xxxxxxxxxxxxxxxxxxx]On Behalf Of Sven Burgener Sent: Friday, January 23, 2004 4:24 AM To: netfilter@xxxxxxxxxxxxxxxxxxx Subject: Re: iptables abilities Antony Stone wrote: > The only reason you can't route private addresses across the Internet is that > all ISP routers drop packets sent to these address ranges. Right. > You would set up your VPN system to forward these packets, just the same as > you can set up your own firewalls and routers to forward them if you want to. > > A VPN with two RFC1918 ranges at each end is a very common setup. Yes, indeed. My question, though, is how can a connection be established between two parties where one of them has a private address (A) and where you want to connect _to_ the server having the private address (A, see below). The problem is, you can't establish a connection to the private address (A), so there has to be a means of 'hijacking' the established session (from X, see diagram below). (Internet) (Internet) A <------------> X <------------> B A: 192.168.X.X B: 192.168.X.X X: public IP address The end result is to get from B to A, securely. Cheers Sven
