hi

i configured openswan between two ubuntus and working fine, now my requirement is i need to route few of my public ip traffic via vpn tunnel, i mean lets say my servers are

ubuntu 1 >> VPN OPENSWAN >> ubuntu 2

now if i ping x.x.x.x (my public ip) from ubuntu 1 it shouldn't go via public interface, it shoud go lik

>>>>> ubuntu 1 >>> vpn tunnel >> ubuntu 2 >>>> x.x.x.x

please help me , i added route on ubutnu 1

route add -host x.x.x.x dev eth0(vpn interface)

but not pinging, i ran tcpdump on ubuntu 2 but traffic not reaching, i also enabled masquerade and ip_forwarding on ubutu 2

please help me out.

IPsec doesn't use tunnel interfaces, so you can't direct packets through an IPsec tunnel using entries in the routing table. The source and destination addresses must instead match an IPsec Phase 2 policy.

You have two options:

1. Alter the IPsec policy in OpenSwan (on both sides) to include the IP addresses in question
2. Set up interface-based tunneling by some other means (like GRE or IPIP) and simply encrypt the traffic between the endpoints with IPsec in Transport Mode.

The latter solution is probably by far the simplest, and it would mean that you could later change the traffic being tunneled/encrypted by simply manipulating the routing table; no changes to the IPsec setup would be required.