hi, i built an ipsec site to site vpn between zywall and vyatta both with 2 interfaces (wan and lan) and 1 public ip like this:

vyatta wan 172.20.1.252/29
vyatta lan 192.168.1.250/24

zywall wan 150.25.63.10/29
zywall lan 192.168.0.253/24

the tunnel is up, no nat traversal and from the zywall's lan i can reach all the vyatta's lan and the tunnel works perfectly, but i can not reach even the zywall's lan interface from vyatta, and i if try to do a traceroute from vyatta to 192.168.0.253 i see the packet passtrhough internet

hop 1 public adsl router ip
hop 2 public isp
hop 3 public isp............

the vpn ipsec local network and remote network is right in both configurations; i'm thinking i've to insert a default route in vyatta to 192.168.0.0/24 but what will be the gateway for vpn tuneel? should the route to 192.168.0.0/24 be implicit? whi the vyatta can not reach the remote lan when the zywall can perfectly reach the vyatta's lan?

Thanks

Things to check.

1) route on each machine. You want the packets for the other guy's LAN to go thru the tunnel, not over the internet.
2) is packet forwarding turned on? You want packets that come in from the tunnel to be forwarded to the LAN.
3) iptables rules. If you're running iptables, then make sure it isn't blocking your packets.

the problem should be in the routing configuration, because also the vyatta can not reach the zyxel's lan network or lan interface of the zyxel

/sbin/route -n

the result is:

Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 11.22.33.230 0.0.0.0 UG 0 0 0 eth0
11.22.33.228 0.0.0.0 255.255.255.248 U 0 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1

cat /proc/sys/net/ipv4/ip_forward
1

You're missing the tunnel entries. Here's my output while connected to the VPN.

Note that the remote LAN 10.202.0.x and 172.16.x.x are thru the tunnel.
I use openvpn which adds the extra routes automatically when you connect.
Check the state of the tunnel with:
also put "code" tags around your computer output to make it more readable in your posts.

Thanks for the reply but open vpn does not work with zywall (or i do not know how to do it, i can't find anything about it on google) i need to use the standard site to site vyatta configuration, do you know how can zywall can work with openvpn?

I solved the one way vpn problem excluding the remote network from the nat rules, and everything is working properly.
Now i have a big problem, because we use the vpn for to use a lan messenger across the vpn who needs to do a broadcast request on address 192.168.0.255 and 192.168.1.255 and i see only the local network users on both internal networks, i'm thinking vyatta is not forwarding udp broadcast packets (when we had the zywalls for vpn tunnel lan messenger was working well, in zywall i have the flaggable option allow netbios broadcast traffic across vpn, but still can't find this option in vyatta) i tryed to use bcrelay but i do not know hou to configure it.

Thanks