{"id":83,"date":"2011-12-29T10:11:35","date_gmt":"2011-12-29T17:11:35","guid":{"rendered":"http:\/\/blog.gptnet.net\/?p=83"},"modified":"2011-12-29T10:13:04","modified_gmt":"2011-12-29T17:13:04","slug":"connecting-2-lans-with-the-same-subnet-via-vyatta-ipsec-tunnel","status":"publish","type":"post","link":"http:\/\/blog.gptnet.net\/?p=83","title":{"rendered":"Connecting 2 LANs with the same subnet via Vyatta IPSec tunnel"},"content":{"rendered":"

One of our clients required to connect all of its client via VPN tunnel. Obviously, to have the highest comparability with customer’s end devices I chose IPSec. To improve security as well as have the\u00a0 lowest impact to the clients in case we had to make some changes we had the following requirement. All traffic originating from us inside IPSec tunnel had to be NATed as well as clients had to NAT all of their traffic. We used Vyatta as our VPN concentrator. I had little experience with Vyatta and found there is a luck of documentation. This document assumes you have basic knowledge of NAT and IPSec configuration of Vyatta.<\/p>\n

<\/p>\n

Basic diagram to help you visualize:<\/p>\n

\"\"<\/a><\/p>\n

First, Lets create outbound rule so your LAN can communicate with Internet (if required):<\/p>\n

rule 100 {
\noutbound-interface eth0
\nsource {
\naddress 192.168.7.0\/24
\n}
\ntype masquerade
\n}
\n}<\/p>\n

Secondly we need to NAT server to 172.30.255.100<\/p>\n

rule 49 {
\ndescription “Nated Server”
\ndestination {
\naddress 172.30.255.100
\n}
\ninbound-interface eth0
\ninside-address {
\naddress 192.168.7.5
\n}
\nprotocol all
\ntype destination<\/p>\n

Next we apply outbound NAT to all traffic designated for IPSec tunnel:<\/p>\n

rule 91 {
\ndestination {
\naddress 172.30.255.100\/32
\n}
\noutbound-interface eth0
\noutside-address {
\naddress 172.30.255.100
\n}
\nsource {
\naddress 192.168.7.5
\n}
\ntype source
\n}<\/p>\n

And finally IPSec tunnel itself:<\/p>\n

vpn {
\nipsec {
\nesp-group POS_ESP {
\ncompression disable
\nlifetime 28800
\nmode tunnel
\npfs enable
\nproposal 1 {
\nencryption 3des
\nhash sha1
\n}
\n}
\nike-group POS_IKE {
\nlifetime 86400
\nproposal 1 {
\ndh-group 5
\nencryption 3des
\nhash sha1
\n}
\n}
\nipsec-interfaces {
\ninterface eth0
\n}
\nsite-to-site {
\npeer 6.7.8.9 {
\nauthentication {
\nmode pre-shared-secret
\npre-shared-secret ****************
\n}
\ndescription “Client01”
\nike-group POS_IKE
\nlocal-ip 72.72.1.4
\ntunnel 1 {
\nesp-group POS_ESP
\nlocal-subnet 172.30.255.100\/32
\nremote-subnet 172.30.255.101\/32
\n}
\n}
\n}<\/p>\n

That’s all. You should have NATed flow of traffic inside IPSec tunnel.<\/p>\n","protected":false},"excerpt":{"rendered":"

One of our clients required to connect all of its client via VPN tunnel. Obviously, to have the highest comparability with customer’s end devices I chose IPSec. To improve security as well as have the\u00a0 lowest impact to the clients … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[28,30,32,31,29],"class_list":["post-83","post","type-post","status-publish","format-standard","hentry","category-random-stuff","tag-ipsec","tag-nat","tag-outbound-nat","tag-same-subnet","tag-vyatta"],"_links":{"self":[{"href":"http:\/\/blog.gptnet.net\/index.php?rest_route=\/wp\/v2\/posts\/83","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blog.gptnet.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.gptnet.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.gptnet.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.gptnet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=83"}],"version-history":[{"count":10,"href":"http:\/\/blog.gptnet.net\/index.php?rest_route=\/wp\/v2\/posts\/83\/revisions"}],"predecessor-version":[{"id":95,"href":"http:\/\/blog.gptnet.net\/index.php?rest_route=\/wp\/v2\/posts\/83\/revisions\/95"}],"wp:attachment":[{"href":"http:\/\/blog.gptnet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=83"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.gptnet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=83"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.gptnet.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=83"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}