From owner-freebsd-questions@FreeBSD.ORG  Thu Jul  8 14:51:38 2010
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 941A3106564A
	for <freebsd-questions@freebsd.org>;
	Thu,  8 Jul 2010 14:51:38 +0000 (UTC)
	(envelope-from steve@ipv6canada.com)
Received: from smtp.ibctech.ca (v6.ibctech.ca [IPv6:2607:f118::b6])
	by mx1.freebsd.org (Postfix) with SMTP id 29DA88FC1A
	for <freebsd-questions@freebsd.org>;
	Thu,  8 Jul 2010 14:51:38 +0000 (UTC)
Received: (qmail 32682 invoked by uid 89); 8 Jul 2010 14:53:20 -0000
Received: from unknown (HELO ?IPv6:2607:f118::5?)
	(steve@ibctech.ca@2607:f118::5)
	by 2607:f118::b6 with ESMTPA; 8 Jul 2010 14:53:20 -0000
Message-ID: <4C35E607.2090902@ipv6canada.com>
Date: Thu, 08 Jul 2010 10:51:51 -0400
From: Steve Bertrand <steve@ipv6canada.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.9.1.7) Gecko/20100111 Lightning/1.0b1 Thunderbird/3.0.1
MIME-Version: 1.0
To: =?ISO-8859-1?Q?Matheus_Weber_da_Concei=E7=E3o?=
 <matheuswcon@gmail.com>
References: <AANLkTikffXjLu2QTENeRiQ7PhFLrC3Viiar_1BZOQAeP@mail.gmail.com>	<4C35D11D.4000304@ipv6canada.com>
	<AANLkTil1YgXzpTBaQ0_X38oGhPfQWMpLMyKfRCOeY3x_@mail.gmail.com>
In-Reply-To: <AANLkTil1YgXzpTBaQ0_X38oGhPfQWMpLMyKfRCOeY3x_@mail.gmail.com>
X-Enigmail-Version: 1.0.1
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Cc: freebsd-questions@freebsd.org
Subject: Re: VPN IPsec Help
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Jul 2010 14:51:38 -0000

On 2010.07.08 10:00, Matheus Weber da Conceição wrote:
>> It has been a long time since I've done IPSec on FBSD, but I'm willing
>> to bet that this has to do with routing, possibly amongst other things.
>> On peer 'B' (FBSD box), what internal IP range are you trying to access
>> the A network from...the same ones (ie. are you trying to bridge the
>> networks)?
>>
> The -peer A- doesn't need to access any -peer B- networks.
> 
>> Do you have access to the Cisco gear?
> No.
> 
>> If so, on FreeBSD, post the output of:
>>
>> % netstat -rn
> 
> Notes:
> tun0 is my ppp pseudo-device
> tun5 is my openvpn tunel (192.168.5.0/24)
> ============
> # netstat -rn
> Routing tables

[ big snip ]

IIRC, you don't need a gre tunnel through IPSec, as you are simply
routing between two dissimilar networks. Don't quote me on this though,
as I said earlier, it has been a very long time.

On the FreeBSD box, assuming that you *only* want to access the three
specific IPs you stated, do this:

% route add 192.168.10.24/32 200.x.x.x
% route add 192.168.201.196/32 200.x.x.x
% route add 10.115.90.236/32 200.x.x.x

On the Cisco side:

% ip route 192.168.5.0 255.255.255.0 187.x.x.x.x

If that works, on the FBSD side of things, add the following to
/etc/rc.conf to make them persistent across reboots:

static_routes="host1 host2 host3"
route_host1="192.168.10.24/32 200.x.x.x"
route_host2="192.168.201.196/32 200.x.x.x"
route_host3="10.115.90.236/32 200.x.x.x"

Steve