屑俺日記

☆ がらくた混じりのVPN

--------------                                      --------------
    LAN 1     |                                    |    LAN 2
 --------    ----         -------     -------     ----     -------
|       |   |    |       |       |   |       |   |    |   |       |
| HOST1 | = | R1 | -Net- | WiMAX | ~ |  PC   | = | R2 | = | Host2 |
|       |   |    |       |  USB  |   | brige |   |    |   |       |
 --------    ----         -------     -------     ----     -------
              |                                    |       
--------------                                      --------------

=: Ethernet
~: USB
WiMAXはGlobal IP。IPSECパススルーはやっても やらなくても変わらなかった。
動作確認のため、PC bridge(Debian Wheezy)とR2(LAN2側)に Ethernetもう一本。
R2は設定のため、HOST1よりシリアルコンソール接続。
以下、R2の設定内容。

console character ascii
ip route default gateway $WIMAX
ip route $LAN1/MASK gateway tunnel 1
ip lan1 address $LOCAL_GW
ip lan2 address $WIMAX_LAN_IP
ip lan2 nat descriptor 1
tunnel select 1
 ipsec tunnel 1
  ipsec sa policy 1 1 esp 3des-cbc sha-hmac
  ipsec ike keepalive log 1 off
  ipsec ike keepalive use 1 on heartbeat 10 6
  ipsec ike local address 1 $LOCAL_GW
  ipsec ike local name 1 $R2_NAME key-id
  ipsec ike nat-traversal 1 on
  ipsec ike pre-shared-key 1 text $KEY
  ipsec ike remote address 1 $R1
 ip tunnel tcp mss limit auto
 tunnel enable 1
nat descriptor type 1 masquerade
nat descriptor address outer 1 $WIMAX_LAN_IP
nat descriptor masquerade static 1 1 $LOCAL_GW udp 500
nat descriptor masquerade static 1 2 $LOCAL_GW esp
ipsec auto refresh on
dhcp service server
dhcp server rfc2131 compliant except remain-silent
dhcp scope 1 $LOCAL_IP_BEGIN-$LOCAL_IP_END/$MASK
dns server $WIMAX

Host1とHost2でpingなどやり、ファイル共有が見えたあたりで おしまい。