Routing and VPN troubles...

From: Mitch (bitblock) (
Date: 05/01/04

  • Next message: Artyom V. Viklenko: "Re: Routing and VPN troubles..."
    Date: Fri, 30 Apr 2004 15:30:42 -0700

    There are about a 1000 different lists - hope this is the right two - if
    not, any suggestions welcome!

    The crux of my problem, is that I need to configure a VPN network in a
    star - one central node, many outside nodes... easy right?

    The problem is that I need the individual "rays" or "spokes" to be able to
    communicate with each other SELECTIVELY.

    I've tried to get this config working with BSD boxes - I have about 50
    spokes to deal with right now and that number will hopefully grow....

    I've been looking at the two problems separately, but I'll describe the
    whole mess, and then hope you are more inspired than I am.

    PC1 (<--\
    PC2 (<-->( 1(<-->ADSL<------\
    PC3 (<--\ |
    PC4 (<-->( 2(<-->ADSL<----\ |
                                                                    | |
    PC5 (<--\ | |
    PC6 (<-->( 3(<-->ADSL<--\ | |
                                                                  | | |
                                                               <--/ / /
             INTERNET <---> (SOME PUBLIC IP) FBSD 4 ( <---/ /

    In actual fact, the 10.1.1.X addresses are all public addresses on a subnet.
    PC1 and PC2 need full access to PC3 - 6.
    PC3 needs access to certain ports on PC 5.

    That is the essence of the firewalling / port filtering of the VPN - like
    can I trest the virtual VPN interfaces as normal interfaces for purposes of
    writing firewall rules?

    Second problem. To do this, and need to communciate with to set up these vpn's. The problem is that we have ADSL over ATM.
    ATM manages data flow by configured path. Consider FBSD 4 to be on dedicated
    vlans with each of FBSD 1 - 3.
    All remote nodes have a "path" to the router, not each other... so FBSD 4
    needs to be able to establish VPN's with FBSD 1 - 3 and route between the

    If I can use FBSD 4 for this, and if I can treat the virtual interfaces as
    normal ones in ipfw, then I can do what I want - right?

    I can probably alter my layout and use of IP addresses and so on somewhat,
    but the key is that routing has to be performed on a single interface in
    order to redirect traffic from the hosts that can't see each other.

    Does that make the problem clear?

    For starters, there are really FBSD 1 - 50 (not just 1 - 3) ;-)

    At present, I've got a variety of hardware and software (Linksys SX41 /
    Netgear / etc.) deployed in place of FBSD 1 - 3 and FreeBSD in place of FBSD
    4... I have a couple of test machines to work with though and figure if I
    can get 3 working I can get the rest working too.

    I've heard something about /32 subnetting, not sure how that works, or what
    has to be done to enable it...

    I've been looking for any information on that I can find on that subject -
    might solve the problem another way if I can make my endpoint routers (1 -
    3) communicate through regular IP by forcing them to bounce through the
    router - but I've been told the router has to support this function as a
    router woudl normally ignore traffic bound for the same subnet as it comes
    from - right?

    If you know it's impossible, that's ok... I tried ;-) Any alternatives?
    PPPOE instead of VPN between the gateway's?

    Thanks in advance.

    Hope I'm not asking to much, or that the challenge is worthy ;-)


    _______________________________________________ mailing list
    To unsubscribe, send any mail to ""

  • Next message: Artyom V. Viklenko: "Re: Routing and VPN troubles..."