I'm trying to get a working environment connecting to a Cisco VPN using IPsec on a Mac running Mac OS X v10.5 (Leopard).
When I'm connected to the VPN, I can connect just fine to other machines in the network, and other machines can connect back to my Mac using the VPN-assigned IP address (for example, over SSH). However, the Mac itself cannot connect to that IP address. This is important for this environment because for certain development work I do I need a common IP address that can be reached from both my Mac and other machines in the network.
Using the Cisco-written VPN client, a successful connection is made, and all traffic is routed through the VPN (as required by the VPN itself). I've tried looking at routing tables, but the Cisco VPN client doesn't seem to actually change the routing tables. Also, ifconfig
does not show the new IP address in any interface - but I can find it in the VPN client application. I'm not quite sure how it manages to route traffic without changing the routing tables, but perhaps that's besides the point.
I've also tried the Shrew VPN Client. I managed to build the source for 10.5 and get it running. It also connects fine, but it exhibits the same symptoms. This VPN client does change the routing tables and ifconfig
shows the IP address under the tap0
interface. However, I'm still not able to get the routing tables set up correctly to be able to connect to the VPN-assigned local IP address.
Here's an example of the routing tables (with some unimportant stuff stripped out):
Not connected to VPN:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.1.1 UGSc 12 27 en0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 50 69556 lo0
192.168.1 link#4 UCS 8 0 en0
192.168.1.1 0:1f:90:5c:b2:e5 UHLW 10 744 en0 1188
192.168.1.111 127.0.0.1 UHS 1 768 lo0
Connected to the VPN (with IP address 172.25.187.40):
Destination Gateway Flags Refs Use Netif Expire
default 172.25.187.40 UGSc 14 46 tap0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 49 68374 lo0
172.25.187/24 link#12 UC 2 0 tap0
172.25.187.40 82:1e:79:f7:7:6a UHLW 6 0 lo0
172.25.187.255 ff:ff:ff:ff:ff:ff UHLWb 3 23 tap0
192.168.1 link#4 UCS 8 0 en0
192.168.1.111 127.0.0.1 UHS 0 750 lo0
And important bits of ifconfig
:
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet6 fe80::225:4bff:fe9c:df3a%en0 prefixlen 64 scopeid 0x4
inet 192.168.1.111 netmask 0xffffff00 broadcast 192.168.1.255
ether 00:25:4b:9c:df:3a
media: autoselect (100baseTX <full-duplex,flow-control>) status: active
supported media: none autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,flow-control> 10baseT/UTP <full-duplex,hw-loopback> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,flow-control> 100baseTX <full-duplex,hw-loopback> 1000baseT <full-duplex> 1000baseT <full-duplex,flow-control> 1000baseT <full-duplex,hw-loopback>
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
lladdr 00:25:4b:ff:fe:9c:df:3a
media: autoselect <full-duplex> status: inactive
supported media: autoselect <full-duplex>
tap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1380
inet 172.25.187.40 netmask 0xffffff00 broadcast 172.25.187.255
ether 82:1e:79:f7:07:6a
open (pid 7916)
I tried various things with the routes, but nothing I've tried has gotten it to let me connect to 172.25.187.40 from my Mac.
I've also tried messing with ipfw to forward all IP traffic sent to 172.25.187.40
to
127.0.0.1
, but I am not experienced with it so maybe I did that wrong.
How do I fix this problem?