<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Verdana,Geneva,sans-serif">
<p>Thanx Paul for the quick answer! VTI devices and marking looks like the right way to go; I really like how each connection can have its own interface. Sadly, tho, our central servers are stuck on RHEL6 with a 2.6-32 kernel due to the massive bureaucracy
of our IT department :-(</p>
<p><br>
</p>
<p>Thus I'll dig into the NAT idea (any references for it are welcome), and your container idea has me thinking of trying network namespaces ... if that works I'll post a writeup to this list.<br>
</p>
<p><br>
</p>
<p>Thanx again,</p>
<p>- Steve<br>
</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Paul Wouters <paul@nohats.ca><br>
<b>Sent:</b> Thursday, June 22, 2017 12:47:08 PM<br>
<b>To:</b> Roscio, Steve<br>
<b>Cc:</b> swan@lists.libreswan.org<br>
<b>Subject:</b> Re: [Swan] Duplicate RightSubnets by Varying LeftSubnets?</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On Thu, 22 Jun 2017, Roscio, Steve wrote:<br>
<br>
> Currently we require that the subnet exposed by each customer be unique. But this is met with<br>
> resistance, understandably, since many customers use the same internal RFC-1918 private address spaces<br>
> (10.0.0.0/8, 172.[16-31].0.0/16, 192.168.0.0/16).<br>
> <br>
> Is there a way to create host-to-subnet or subnet-to-subnet IPsec connections where the rightsubnets<br>
> (customer-side) are the same or overlap?<br>
<br>
Yes, when you use MARKing. You can also combine MARK with VTI<br>
interfaces. See:<br>
<br>
<a href="https://libreswan.org/wiki/Route-based_VPN_using_VTI">https://libreswan.org/wiki/Route-based_VPN_using_VTI</a><br>
<br>
While this will resolve your issue of where to send replies to,<br>
it still requires flows originating from your end to be told<br>
for which target 192.168.1.1 these are meant. You can do that<br>
by MARKing the packets (via iptables, custom kernel module, etc)<br>
<br>
Some people build a NAT'ed IP range for their customers, so to<br>
them all their customers appear as unique IPs, then de-NAT these<br>
into the customers real IP's before it hits the IPsec tunnel.<br>
<br>
A completely different solution is to use a container/cloud<br>
instance which only contains one customer per instance, so it<br>
will never conflict.<br>
<br>
Paul<br>
</div>
</span></font>
</body>
</html>