IP forwarding

Hi,

 

I am trying to establish an IPSec tunnel to protect a subnet behind a
linux machine and a subnet behind some other gateway.

Lefsubnet - 172.17.0.0/16 (behind linux gateway)

Rightsubnet - 172.16.0.0/16

 

From a host on left subnet, I am trying to ping to a host on right

subnet-

ping 172.16.60.1 -I 172.17.70.87

 

tcpdump capture on linux machine connected to left subnet-

04:27:09.939598 IP 172.17.70.87 > 172.16.60.1: icmp 64: echo request seq
170

 

Tcpdump capture on linux machine connected on right subnet-

04:26:32.941624 IP 1.1.0.1 > 192.168.101.101:
ESP(spi=0x020000c3,seq=0x16d)                 //Outer IPs

04:26:32.943940 IP 192.168.101.101 > 1.1.0.1:
ESP(spi=0x10000102,seq=0x16d)

04:26:32.943940 IP 172.16.60.1 > 172.17.70.87: icmp 64: echo reply seq
133

 

So, it's clear that linux gateway is able to protect the data and send
to the connected gateway (ESP packets to outer IPs).

And the second gateway is responding with ESP packet which is decoded on
linux gateway and sent to the ip stack again by linux kernel (ICMP
reply).

But the reply doesn't reach the host on left subnet.

 

I enabled ip_forwarding through /proc/sys/net/ipv4/ip_forwarding.

 

Please let me know, if I am missing something.

 

Any help would be appreciated.

 

Regards,

Prashant