Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec íàñòðîéêà ìàðøðóòèçàöèè

    Russian
    3
    14
    6.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kadulin
      last edited by

      Ïîìîãèòå íàñòðîèòü ìàðøðóòèçàöèþ ìåæäó îôèñàìè.
      Ê ïðèìåðó åñòü òðè îôèñà
      1. Îôèñ1 ipnet 192.168.100.0/24
      2. Îôèñ2 ipnet 192.168.101.0/24
      2. Îôèñ3 ipnet 192.168.103.0/24
      Íàñòðîåí IPSec Îôèñ1<=>Îôèñ2 è Îôèñ1<=>Îôèñ3

      Êàê íàñòðîèòü ìàðøðóòèçàöèþ ìåæäó Îôèñ2 è Îôèñ3 áåç ïîäíÿòèÿ ìåæäó íèìè òîíåëÿ?

      1 Reply Last reply Reply Quote 0
      • M
        Mr. Boroda
        last edited by

        íà øëþçå â îôèñ3 ïðîïèñàòü ñòàòè÷åñêèé ìàðøðóò â îôèñ2 ÷åðåç îôèñ1
        íà øëþçå â îôèñ2 ïðîïèñàòü ñòàòè÷åñêèé ìàðøðóò â îôèñ3 ÷åðåç îôèñ1

        íà øëþçå â îôèñ1 ïðîïèñàòü ñòàòè÷åñêèå ìàðøðóòû â ñåòè îôèñ2 è îôèñ3 ÷åðåç ñîîòâåòñòâóþùèå àäðåñà

        íó è â ôàéðâîëå åñòåñòâåííî ðàçðåøèòü íà èíòåðôåéñàõ LAN  è IPSEC ñîîòâåòñòâóþùèå ñåòè, â êàæäîì èç îôèñîâ

        âîò êàê òî òàê :)

        1 Reply Last reply Reply Quote 0
        • K
          kadulin
          last edited by

          Íå ðàáîòàåò.
          ×òî ïîëó÷àåòñÿ:

          • c îôèñà2 ïèíãóþòñÿ âñå êîìïáþòåðû ñåòè Îôèñ1
          • ïðîïèñàë ìàðøðóò c îôèñà íà Îôèñ3 (192.168.103.0/24) ÷åðåç ôîèñ1(192.168.100.6)

          Ïðè àíàëèçå ïàêåòîâ, ïîëó÷àåòñÿ, ÷òî ïèíãè ïðîñòî èäóò íà âíåøíèé IP îôèñ2, ò.å. â èíòåðíåò!!!  ÷åì òðàáë?

          1 Reply Last reply Reply Quote 0
          • M
            Mr. Boroda
            last edited by

            â îôèñ1 åñòü ñòàòè÷åñêèå ìàðøðóòû?
            êóäà îíè óêàçûâàþò?
            ñ îôèñ2 è îôèñ3 øëþçîì äîëæåí áûòü LAN èï îôèñ1
            ñîîòâåòñòâåííî ñåòè â îôèñ2 è îôèñ3 äîëæíû áûòü äîñòóïíû ÷åðåç ñâîé LAN èï

            1 Reply Last reply Reply Quote 0
            • K
              kadulin
              last edited by

              Òîëüêî ïî÷åìó òî â îôîèñ2 nestat -r  íå ïîêàçûâàåò ïðîïèñàííôé ìíîþ ìàðøðóò??

              Internet:
              Destination        Gateway            Flags    Refs      Use  Netif Expire
              default            195.5.5.203        UGS        0  459251    ng0
              209-80-113-92.pool lo0                UHS        0        0    lo0
              localhost          localhost          UH          0        0    lo0
              192.168.102.0      link#1            UC          0        0    rl0
              195.5.5.203        209-80-113-92.pool UH          1    2940    ng0

              À êîãäà ÿ èçìåíèë ìàðøðóò äëÿ ïîäñåòè 192.168.106.0.24 íà IP 192.168.102.7, òî ìàðøðóò ïðîïèñàëñÿ.
              Âûõîäèò, ÷òî îí íå çíàåò êóäà ïðâÿçàòü ìàðøðóòèçàöèþ äëÿ IP Îôèñ1 192.168.100.6

              Õîòÿ ïèíãè ñ ïîäñåòè îôèñ2 èäóò íà ïîäñåòü îôèñ1.

              rout_office1.png
              rout_office1.png_thumb
              rout_office2.png
              rout_office2.png_thumb

              1 Reply Last reply Reply Quote 0
              • M
                Mr. Boroda
                last edited by

                íàïèøèòå àäðåñà âîò ïî ýòîé ñõåìå
                Îôèñ1, LAN IP, LAN NET/MASK, IPSEC Remote subnet, IPSEC Remote gateway

                1 Reply Last reply Reply Quote 0
                • K
                  kadulin
                  last edited by

                  Îôèñ1 - IP: 192.168.100.5, Net: 192.168.100.0/24, IPSec Remote Subnet 192.168.102.0/24 IPSec Remote GateWay xxx.xxx.xxx.xxx (âíåøíèé IP îôèñà2)
                  Îôèñ2 - IP: 192.168.102.5, Net: 192.168.102.0/24, IPSec Remote Subnet 192.168.100.0/24 IPSec Remote GateWay yyy.yyy.yyy.yyy (âíåøíèé IP îôèñà1)

                  1 Reply Last reply Reply Quote 0
                  • M
                    Mr. Boroda
                    last edited by

                    íàñòðîêè Îôèñ1
                    System: Static Routes
                      Destination network: 192.168.102.0/24
                      Gateway: 192.168.100.5

                    íàñòðîêè Îôèñ2
                    System: Static Routes
                      Destination network: 192.168.100.0/24
                      Gateway: 192.168.102.5

                    ÿ òàê ïîíèìàþ â ôàéðâîëå âñå îòêðûòî?

                    1 Reply Last reply Reply Quote 0
                    • K
                      kadulin
                      last edited by

                      Äîáàâëþ

                      íàñòðîêè Îôèñ1
                      Lan IP: 192.168.100.6
                      IPsec:
                        Remote Subnet: 192.168.102.0/24  Remote GateWay: xxx.xxx.xxx.xxx
                        Remote Subnet: 192.168.104.0/24  Remote GateWay: zzz.zzz.zzz.zzz
                      System: Static Routes
                        Destination network: 192.168.102.0/24  Gateway: 192.168.102.5
                        Destination network: 192.168.104.0/24  Gateway: 192.168.104.5

                      íàñòðîêè Îôèñ2
                        Lan IP: 192.168.102.5
                      IPsec:
                        Remote Subnet: 192.168.100.0/24  Remote GateWay: yyy.yyy.yyy.yyy
                      System: Static Routes
                        Destination network: 192.168.104.0/24  Gateway: 192.168.100.6

                      íàñòðîêè Îôèñ4
                        Lan IP: 192.168.104.5
                      IPsec:
                        Remote Subnet: 192.168.100.0/24  Remote GateWay: yyy.yyy.yyy.yyy
                      System: Static Routes
                        Destination network: 192.168.102.0/24  Gateway: 192.168.100.6

                      Ñâÿçü ìåæäó Îôèñ1<=>Îôèñ2 è Îôèñ1<=>Îôèñ4 åñòü.
                      À âîò íàñòðîèòü ìàðøðóòèçàöèþ ìåæäó Îôèñ2 è Îôèñ4 íå ïîëó÷åñòñÿ.
                      Åñëè ïèíãîâàòü ñ Îôèñ2 íà Îôèñ4, òî â trafshow âèäíû ïèíãè èäóùèå ñ âíåøíåãî IP íà 192.168.104.5.
                      netstat -r - â Îôèñ2 íå ïîêàçûâàåò ïðîïèñàííûé ìíîé ìàðøðóò Destination network: 192.168.104.0/24  Gateway: 192.168.100.6, õîòÿ â web îí ïðèïèñàí.

                      1 Reply Last reply Reply Quote 0
                      • M
                        Mr. Boroda
                        last edited by

                        À âû ðàçâå íå âèäèòå ðàçíèöû
                        ÿ âåäü ñïåöèàëüíî íàïèñàë ÷òî äîëæíî áûòü â ñòàòè÷åñêèõ ìàðøðóòàõ âíèìàòåëüíî ñìîòðèòå íà øëþç

                        1 Reply Last reply Reply Quote 0
                        • K
                          kadulin
                          last edited by

                          Ïîìåíÿë íàñòðîéêè. Òåïåðü îíè âûãëÿäÿò âîò òàê:
                          íàñòðîéêè Îôèñ1
                          Lan IP: 192.168.100.6
                          IPsec:
                           Remote Subnet: 192.168.102.0/24  Remote GateWay: xxx.xxx.xxx.xxx
                           Remote Subnet: 192.168.104.0/24  Remote GateWay: zzz.zzz.zzz.zzz
                          System: Static Routes
                           Destination network: 192.168.102.0/24  Gateway: 192.168.102.5
                           Destination network: 192.168.104.0/24  Gateway: 192.168.104.5

                          íàñòðîéêè Îôèñ2
                           Lan IP: 192.168.102.5
                          IPsec:
                           Remote Subnet: 192.168.100.0/24  Remote GateWay: yyy.yyy.yyy.yyy
                          System: Static Routes
                           Destination network: 192.168.100.0/24  Gateway: 192.168.102.5
                           Destination network: 192.168.104.0/24  Gateway: 192.168.100.6

                          íàñòðîéêè Îôèñ4
                           Lan IP: 192.168.104.5
                          IPsec:
                           Remote Subnet: 192.168.100.0/24  Remote GateWay: yyy.yyy.yyy.yyy
                          System: Static Routes
                           Destination network: 192.168.100.0/24  Gateway: 192.168.104.5
                           Destination network: 192.168.102.0/24  Gateway: 192.168.100.6

                          Ïèíãè c Îôèñ2 íà 192.168.168.104.5 íå èäóò. Îøèáêà - Çàäàííûé óçåë íå äîñòóïåí
                          è îøèáêè â ëîãàõ
                          Dec 22 14:21:12 kernel: arpresolve: can't allocate route for 192.168.100.6
                          Dec 22 14:21:12 kernel: arplookup 192.168.100.6 failed: host is not on local network

                          1 Reply Last reply Reply Quote 0
                          • M
                            Mr. Boroda
                            last edited by

                            traceroute èç îôèñ2 íà 192.168.100.6, 192.168.104.5

                            è â îôèñ2, îôèñ4
                            System: Static Routes
                              Destination network: 192.168.0.0/16  Gateway: LAN IP

                            1 Reply Last reply Reply Quote 0
                            • K
                              kadulin
                              last edited by

                              Òðàññèðîâêà ñ PF

                              traceroute 192.168.100.4

                              traceroute to 192.168.100.4 (192.168.100.4), 64 hops max, 40 byte packets
                              1  dprouter (192.168.102.5)  0.679 ms  0.584 ms  0.498 ms
                              2  * * *
                              3  192.168.100.4 (192.168.100.4)  76.914 ms  57.086 ms  58.720 ms

                              traceroute 192.168.100.6

                              traceroute to 192.168.100.6 (192.168.100.6), 64 hops max, 40 byte packets
                              1  dprouter (192.168.102.5)  0.655 ms  0.607 ms  0.450 ms
                              2  * * *
                              3  * * *
                              4  * * *
                              5  * * *
                              6  *^C

                              traceroute 192.168.104.5

                              traceroute to 192.168.104.5 (192.168.104.5), 64 hops max, 40 byte packets
                              traceroute: sendto: Invalid argument
                              1 traceroute: wrote 192.168.104.5 40 chars, ret=-1
                              *traceroute: sendto: Invalid argument

                              Òðàññèðîâêà ñ ñåòè Îôèñ2
                              C:>tracert 192.168.100.6
                              Òðàññèðîâêà ìàðøðóòà ê 192.168.100.6 ñ ìàêñèìàëüíûì ÷èñëîì ïðûæêîâ 30
                                1    1 ms    1 ms    1 ms  192.168.102.5
                                2    56 ms    55 ms    55 ms  192.168.100.6
                              Òðàññèðîâêà çàâåðøåíà.
                              C:>tracert 192.168.104.5
                              Òðàññèðîâêà ìàðøðóòà ê 192.168.104.5 ñ ìàêñèìàëüíûì ÷èñëîì ïðûæêîâ 30
                                1    1 ms    1 ms    1 ms  192.168.102.5
                                2  192.168.102.5  ñîîáùàåò: Çàäàííûé óçåë íåäîñòóïåí.
                              Òðàññèðîâêà çàâåðøåíà.
                              C:>ping 192.168.104.5 /n 500
                              Îáìåí ïàêåòàìè ñ 192.168.104.5 ïî ñ 32 áàéò äàííûõ:
                              Îòâåò îò 192.168.102.5: Çàäàííûé óçåë íåäîñòóïåí.

                              1 Reply Last reply Reply Quote 0
                              • E
                                Eugene
                                last edited by

                                Никак.

                                http://ru.doc.pfsense.org

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.