0

Recently I changed from a home-run OpenVPN to a home-run Cisco (XAuth) IPSec VPN for more compatibility. However, I haven't found documentation on "pushing" routes from the IPSec server to clients. In OpenVPN, it is pretty simple, just add push "route 10.10.10.0 255.255.255.0" to the config to route the clients to the subnet 10.10.10.0/24 via the server. However, Cisco IPSec VPN's configs are vastly different and I can't figure out how to do it. To clarify, here's what a client on the VPN can see now:

+--------------+              +--------+                +--------------+
| Client #1    |--------------| Server |----------------| Client #2    |
| 198.51.100.2 |              +--------+                | 198.51.100.3 |
+--------------+                                        +--------------+

But, I want it to look more like this:

                                       +---------------+
      +-------------+                  | Device on     |
      | Device on   |             +----|  LAN #2       |
      |   LAN #1    |             |    | 192.168.0.100 |
      | 192.168.0.3 |-------------+    +---------------+
      +-------------+             |    
+--------------+              +--------+                +--------------+
| Client #1    |--------------| Server |----------------| Client #2    |
| 198.51.100.2 |              +--------+                | 198.51.100.3 |
+--------------+                                        +--------------+

That way, if for instance Device on LAN #2 was running a web server, a client connected to the VPN can type http://192.168.0.100/ into a web browser and it will connect. If Client #1 is also running a web server, a Device on LAN could connect to it as well thru http://198.51.100.2/. Also, clients of the VPN can ping each other and Devices on LAN. Thank you!

NOTE: I am NOT using L2TP/IPSec, I am using Cisco IPSec/Xauth: VPN Settings Mac OS X[![][1]

EDIT: I tested manually adding a route on the client, and it works, so it is just a matter of the server telling the client to add such a route.

E.G. To route subnet 192.168.0.0/24 thru gateway 198.51.100.1 run this command on Mac OS X:

sudo route -n add -net 192.168.0.0/24 198.51.100.1

and this command:

sudo route add -net 192.168.0.0/24 gw 198.51.100.1

on Linux.

  • What is the "client" software? Are you just establishing an IPSec connection or are you using something like Cisco Anyconnect? I am assuming you were using the OpenVPN client previously? I'm pretty sure, without routing protocols, there is no way to push routes over an L2TP / IPSec connection. This is an ability that doesn't exist but can be implemented by a specific client or routing protocol if they are added. – Appleoddity Aug 17 '17 at 2:06
  • Oh, I'm not using L2TP, I'm using "Cisco IPSec" as shown in the edited post. The client I'm using is the built in VPN connection from the Network settings in Mac OS X. I switched from OpenVPN to Cisco IPSec to avoid the need for extra software. – BoomBoomPowe Aug 17 '17 at 15:57
  • I can appreciate not wanting to use third party software. I'm fairly positive the IPSec protocol makes no provision for pushing routes. That is implemented in a proprietary way between server and client like with OpenVPN. Apart from using static routes on each system, you might be able to try using DHCP: ercpe.de/blog/… – Appleoddity Aug 17 '17 at 17:13
  • Look at the answer here about the match clause: networkengineering.stackexchange.com/questions/16428/… – Appleoddity Aug 17 '17 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.