1

I'm trying to get a working environment connecting to a Cisco VPN using IPsec on a Mac running Mac OS X v10.5 (Leopard).

When I'm connected to the VPN, I can connect just fine to other machines in the network, and other machines can connect back to my Mac using the VPN-assigned IP address (for example, over SSH). However, the Mac itself cannot connect to that IP address. This is important for this environment because for certain development work I do I need a common IP address that can be reached from both my Mac and other machines in the network.

Using the Cisco-written VPN client, a successful connection is made, and all traffic is routed through the VPN (as required by the VPN itself). I've tried looking at routing tables, but the Cisco VPN client doesn't seem to actually change the routing tables. Also, ifconfig does not show the new IP address in any interface - but I can find it in the VPN client application. I'm not quite sure how it manages to route traffic without changing the routing tables, but perhaps that's besides the point.

I've also tried the Shrew VPN Client. I managed to build the source for 10.5 and get it running. It also connects fine, but it exhibits the same symptoms. This VPN client does change the routing tables and ifconfig shows the IP address under the tap0 interface. However, I'm still not able to get the routing tables set up correctly to be able to connect to the VPN-assigned local IP address.

Here's an example of the routing tables (with some unimportant stuff stripped out):

Not connected to VPN:

Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.1.1        UGSc       12       27    en0
127                127.0.0.1          UCS         0        0    lo0
127.0.0.1          127.0.0.1          UH         50    69556    lo0
192.168.1          link#4             UCS         8        0    en0
192.168.1.1        0:1f:90:5c:b2:e5   UHLW       10      744    en0   1188
192.168.1.111      127.0.0.1          UHS         1      768    lo0

Connected to the VPN (with IP address 172.25.187.40):

    Destination        Gateway            Flags    Refs      Use  Netif Expire
default            172.25.187.40      UGSc       14       46   tap0
127                127.0.0.1          UCS         0        0    lo0
127.0.0.1          127.0.0.1          UH         49    68374    lo0
172.25.187/24      link#12            UC          2        0   tap0
172.25.187.40      82:1e:79:f7:7:6a   UHLW        6        0    lo0
172.25.187.255     ff:ff:ff:ff:ff:ff  UHLWb       3       23   tap0
192.168.1          link#4             UCS         8        0    en0
192.168.1.111      127.0.0.1          UHS         0      750    lo0

And important bits of ifconfig:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
        inet 127.0.0.1 netmask 0xff000000 
        inet6 ::1 prefixlen 128 
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        inet6 fe80::225:4bff:fe9c:df3a%en0 prefixlen 64 scopeid 0x4 
        inet 192.168.1.111 netmask 0xffffff00 broadcast 192.168.1.255
        ether 00:25:4b:9c:df:3a 
        media: autoselect (100baseTX <full-duplex,flow-control>) status: active
        supported media: none autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,flow-control> 10baseT/UTP <full-duplex,hw-loopback> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,flow-control> 100baseTX <full-duplex,hw-loopback> 1000baseT <full-duplex> 1000baseT <full-duplex,flow-control> 1000baseT <full-duplex,hw-loopback>
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
        lladdr 00:25:4b:ff:fe:9c:df:3a 
        media: autoselect <full-duplex> status: inactive
        supported media: autoselect <full-duplex>
tap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1380
        inet 172.25.187.40 netmask 0xffffff00 broadcast 172.25.187.255
        ether 82:1e:79:f7:07:6a 
        open (pid 7916)

I tried various things with the routes, but nothing I've tried has gotten it to let me connect to 172.25.187.40 from my Mac.

I've also tried messing with ipfw to forward all IP traffic sent to 172.25.187.40 to 127.0.0.1, but I am not experienced with it so maybe I did that wrong.

How do I fix this problem?

1 Answer 1

0

I think you want a host route for 172.25.187.40 gateway 127.0.0.1 on lo0. You should be able to do something like this...

sudo route add -host 172.25.187.40  127.0.0.1

...but be sure to look at the route(8) man page, especially the parts about -interface and -ifscope.

I'm a little afraid, though, that messing with the route for 172.25.187.40 will break your VPN connectivity, at least with the client that messes with your routing tables.

By the way, the Cisco VPN client loads an NKE (Network Kernel Extension -- a networking-specific Kernel EXTension or kext) or two that handle the VPN magic right in your kernel without messing with the route table. Unfortunately this means that Cisco has code running in your kernel, so if it's buggy, it can panic your entire system.

1
  • Thanks, especially for the info about Cisco using NKE's. I tried adding the route you suggested, and it appears as expected in the routing table, but my connection to the local vpn-assigned address still fails. I also tried sudo route add -host 172.25.187.40 -interface tap0 and -interface lo0, neither of which worked either. The ifscope option seems to be new in snow leopard, and not available in leopard. Jul 13, 2011 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .