собственно хочу объединить две сети фелиалов через через нет , из руководства по strongswan выбрал метод
In a site-to-site setup a system administrator logged into the local gateway often would like to access the peer gateway or a server in the subnet behind the peer gateway over a secure IPsec tunnel.Since IP packets leaving a gateway via the outer network interface carry the IP address of this NIC, four IPsec Security Associations (SAs) must be set up to achieve full connectivity. The example below shows how this can be done without much additional typing work , using the "also" macro which includes connection definitions defined farther down in the ipsec.conf file.10.1.0.0/16 -- | 192.168.0.1 | === | 192.168.0.2 | -- 10.2.0.0/16
moon-net moon sun sun-netConfiguration on gateway moon:
/etc/ipsec.d/cacerts/strongswanCert.pem
/etc/ipsec.d/certs/moonCert.pem
/etc/ipsec.secrets:
: RSA moonKey.pem "<optional passphrase>"
/etc/ipsec.conf:
conn net-net
leftsubnet=10.1.0.0/16
rightsubnet=10.2.0.0/16
also host-hostconn net-host
leftsubnet=10.1.0.0/16
also host-hostconn host-net
rightsubnet=10.2.0.0/16
also host-hostconn host-host
left=defaultroute
leftcert=moonCert.pem
right=192.168.0.2
rightid="C=CH, O=Linux strongSwan, CN=sun.strongswan.org"
auto=startConfiguration on gateway sun:
/etc/ipsec.d/cacerts/strongswanCert.pem
/etc/ipsec.d/certs/sunCert.pem
/etc/ipsec.secrets:
: RSA sunKey.pem "<optional passphrase>"
/etc/ipsec.conf:
conn net-net
leftsubnet=10.2.0.0/16
rightsubnet=10.1.0.0/16
also=host-hostconn net-host
leftsubnet=10.2.0.0/16
also=host-hostconn host-net
rightsubnet=10.1.0.0/16
also=host-hostconn host-host
left=defaultroute
leftcert=sunCert.pem
right=192.168.0.1
rightid="C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
auto=startВозник следующий вопрос белый ip (moon) уменя только на одном из концов на другом (sun) динамика , как быть в этом случае ?
>[оверквотинг удален]
> rightsubnet=10.1.0.0/16
> also=host-host
> conn host-host
> left=defaultroute
> leftcert=sunCert.pem
> right=192.168.0.1
> rightid="C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
> auto=start
> Возник следующий вопрос белый ip (moon) уменя только на одном из концов
> на другом (sun) динамика , как быть в этом случае ?почитал маны я так понял правим в sun right=192.168.0.1 на right=%any и всё ?