Ryfujk

I have to connect my server to a VPN tunnel thought Internet to see a local server that is on IP 192.168.20.100

Here are IPSec AND IKE settings from server (not mine , I do not own the VPN server)

Settings

Here is tunnel data:

• Public IP: 213.0.XXX.YYY


• The local server I want to see: 192.168.20.100


• Network: 192.168.20.0/24


• Pre-Shared Key: XXXXXXXXXX

I've installed openswan on my CentOS 7 server (which is the client here)

Here is IPSec config from my client

# /etc/ipsec.conf

version 2.0     # conforms to second version of ipsec.conf specification



config setup

    nat_traversal=yes

    virtual_private=%v4:192.168.20.0/24

    protostack=netkey

    interfaces=ens160

    oe=off

    klipsdebug=all

    plutodebug="all"



conn l2tp-psk

    authby=secret

    pfs=no

    auto=add

    rekey=yes



    ikev2=insist

    ike=aes256-sha2_256

    #esp=aes256-sha2_256

    phase2alg=aes256-sha2_256

    compress=no



    type=tunnel

    left=149.56.XXX.YYY

    leftnexthop=%defaultroute

    leftprotoport=17/1701



    right=213.0.XXX.YYY

    rightsourceip=192.168.20.100

    rightsubnet=192.168.20.0/24

    rightnexthop=%defaultroute

    rightprotoport=17/1701

My ipsec.secret:

# /etc/ipsec.secrets

%any 213.0.XXX.YYY : PSK "XXXXXXXXXXXXXXXXX"

When I execute "ipsec auto --up l2tp-psk" the tunnel is established correctly:

002 "l2tp-psk": terminating SAs using this connection

002 "l2tp-psk" #506: deleting state #506 (STATE_PARENT_I3)

005 "l2tp-psk" #506: ESP traffic information: in=0B out=0B

002 "l2tp-psk" #505: deleting state #505 (STATE_PARENT_I3)

002 "l2tp-psk": deleting connection

002 added connection description "l2tp-psk"

002 "l2tp-psk" #507: initiating v2 parent SA

133 "l2tp-psk" #507: STATE_PARENT_I1: initiate

133 "l2tp-psk" #507: STATE_PARENT_I1: sent v2I1, expected v2R1

133 "l2tp-psk" #507: STATE_PARENT_I1: sent v2I1, expected v2R1

134 "l2tp-psk" #508: STATE_PARENT_I2: sent v2I2, expected v2R2 {auth=IKEv2 cipher=aes_256 integ=sha256_128 prf=OAKLEY_SHA2_256 group=MODP1536}

002 "l2tp-psk" #508: IKEv2 mode peer ID is ID_IPV4_ADDR: '213.0.XXX.YYY'

002 "l2tp-psk" #508: negotiated tunnel [149.56.XXX.YYY,149.56.XXX.YYY:1701-1701 17] -> [192.168.20.0,192.168.20.255:1701-1701 17]

004 "l2tp-psk" #508: STATE_PARENT_I3: PARENT SA established tunnel mode {ESP=>0x6856ad5c <0x15452663 xfrm=AES_256-HMAC_SHA2_256 NATOA=none NATD=none DPD=passive}

But when I ping 192.168.20.100 there is no response (ping on that server is allowed).

I don't own the VPN server network or local server on 192.168.20.100 but I can ask questions to the owners.

What should I try? I'm suposed to be able to see an Oracle service running on 192.168.20.100:1521

Thanks in advance.

You should check the routing table. Do an ip route list and see exactly what routes are shown there. Be sure that a route from your computer to rightsubnet exists and it's through the ipsec tunnel