<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hi all,</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I'm trying to setup a (temporary) over-the-internet database replication process. I am using libreswan in two distinct ways:</div><div class=""><br class=""></div><div class=""> "Mesh": The first method uses opportunistic IPSec to create a mesh of tunnels between hosts within an AWS VPC. I have this working well and each host can talk to each over over tunnels currently.</div><div class=""><br class=""></div><div class=""> "S2S": The second method uses a subnet-to-subnet tunnel to connect a host in a data center to a host in the AWS VPC. The data center host is on a private subnet and talks through a firewall out to the internet. The AWS host has two interfaces, one public and one private. The private NIC is connected to the mesh network. The tunnel comes up and I can route traffic via my "VPN" gateways from other hosts in the subnets.</div><div class=""><br class=""></div><div class="">Problem: The issue I have is that I want the traffic coming out of the S2S tunnel to be forward through the mesh tunnel(s) to the remote endpoint(s); likewise I want traffic coming from members in the mesh subnet to use the mesh tunnels when trying to connect hosts on the other side of the S2S tunnel. This does not seem to happen either automatically or via best feeble attempts at forcing it via routing rules.</div><div class=""><br class=""></div><div class="">Questions:</div><div class=""> * Is this actually a feasible/reasonable solution?</div><div class=""> * Am I missing something critical in my configurations to make this happen?</div><div class=""> * Any hints on magic routing settings or some term I can google for?</div><div class=""><br class=""></div><div class="">Thanks for looking.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">======== ASCII Art of the Setup ========</div><div class=""><br class=""></div><div class=""><font face="Menlo" class="">|---------|</font></div><div class=""><font face="Menlo" class="">|10.1.1.10| DB host(s) A, B, C, etc</font></div><div class=""><font face="Menlo" class="">|---------|</font></div><div class=""><font face="Menlo" class=""> |</font></div><div class=""><font face="Menlo" class=""> |</font></div><div class=""><font face="Menlo" class=""> |</font></div><div class=""><font face="Menlo" class="">|---------|</font></div><div class=""><font face="Menlo" class="">|10.1.0.20| "VPN" host X</font></div><div class=""><font face="Menlo" class="">|---------|</font></div><div class=""><font face="Menlo" class=""> [|]</font></div><div class=""><font face="Menlo" class=""><router/firewall/public ip 1></font></div><div class=""><font face="Menlo" class=""> [|]</font></div><div class=""><font face="Menlo" class=""> [|] Internet</font></div><div class=""><font face="Menlo" class=""> [|] Encrypted via site-to-site (S2S) connection</font></div><div class=""><font face="Menlo" class=""> [|]</font></div><div class=""><font face="Menlo" class=""><public ip 2></font></div><div class=""><font face="Menlo" class="">|---------| "VPN" host Y</font></div><div class=""><font face="Menlo" class="">|10.2.0.30| <-- eth0</font></div><div class=""><font face="Menlo" class="">| |</font></div><div class=""><font face="Menlo" class="">|10.2.1.30| <-- eth1</font></div><div class=""><font face="Menlo" class="">|---------|</font></div><div class=""><font face="Menlo" class=""> [|]</font></div><div class=""><font face="Menlo" class=""> [|] AWS VPC</font></div><div class=""><font face="Menlo" class=""> [|] Encrypted via opportunistic "mesh" connection</font></div><div class=""><font face="Menlo" class=""> [|]</font></div><div class=""><font face="Menlo" class="">|---------|</font></div><div class=""><font face="Menlo" class="">|10.2.1.40| DB host(s) D, E, F, etc</font></div><div class=""><font face="Menlo" class="">|---------|</font></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">======== S2S Configuration on data center side ========</div><div class="">conn vpn</div><div class=""> left=10.1.0.20</div><div class=""> leftid=<public ip 1></div><div class=""> leftsubnet=10.1.0.0/16</div><div class=""> leftrsasigkey=<a key></div><div class=""> right=<public ip 2></div><div class=""> rightsubnet=10.2.0.0/16</div><div class=""> rightrsasigkey=<another key></div><div class=""> auto=start</div><div class=""><br class=""></div><div class="">======== S2S Configuration on AWS side ========</div><div class="">conn vpn</div><div class=""> left=<public ip 1></div><div class=""> leftsubnet=10.1.0.0/16</div><div class=""> leftrsasigkey=<a key></div><div class=""> right=10.2.0.30</div><div class=""> rightid=<public ip 2></div><div class=""> rightsubnet=10.2.0.0/16</div><div class=""> rightrsasigkey=<another key></div><div class=""> auto=start</div><div class=""><br class=""></div><div class="">======== Mesh Configuration ========</div><div class="">conn private</div><div class=""> leftauth=rsasig</div><div class=""> left=10.2.1.30</div><div class=""> leftid=%fromcert</div><div class=""> leftcert=<certificate name></div><div class=""> rightauth=rsasig</div><div class=""> right=%opportunisticgroup</div><div class=""> rightid=%fromcert</div><div class=""> rightca=%same</div><div class=""> rightrsasigkey=%cert</div><div class=""> ikelifetime=30m</div><div class=""> salifetime=1h</div><div class=""> sha2-truncbug=no</div><div class=""> aggrmode=no</div><div class=""> type=tunnel</div><div class=""> ikev2=insist</div><div class=""> negotiationshunt=hold</div><div class=""> failureshunt=drop</div><div class=""> keyingtries=0</div><div class=""> retransmit-timeout=3s</div><div class=""> auto=ondemand</div><div class=""> priority=65535</div><div class=""><br class=""></div><div class="">conn clear</div><div class=""> type=passthrough</div><div class=""> left=%defaultroute</div><div class=""> right=%group</div><div class=""> auto=ondemand</div><div class=""> priority=100</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>