Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: Toby Burress (kurindelete.org)
Date: Wed Aug 13 2008 - 15:41:20 CDT
I have an IPSec connection set up to an external site, over which
I have no control and whose topololgy I know nothign about (i.e. I
don't know what subnets they use, etc.) Using ipsecctl, I have one
flow set up, from my external IP A.B.C.D to an internal IP on their
I can ping 172.25.0.1 from the OpenBSD box, so IPSec is working fine.
What I want to do is allow any machine from my internal networks
to reach 172.25.0.1.
What I would like to do is set up NAT, so that packets headed to
the OpenBSD box from anywhere on my network get translated to
A.B.C.D, which is then sent over the VPN connection. Unfortunately
it looks like PF only applies NAT transforms when packets leave
interfaces, not when they enter them, so packets come into the
OpenBSD box with their private IPs, get routed out the interface
associated with the default route, and only then get rewritten.
Is there a better way to do this? I would like to be able to change
which hosts on my side can go over the IPSec connection without
having to coordinate with the other company, and without having to
expose internal IP information.
If you reply to the list please cc me as I am not subscribed.