# VPN networking question



## qsecofr (Dec 14, 2009)

Hi,

Over the last month or so, VPN to work has been behaving poorly.  DNS errors make most of the corporate lan inaccessible, and authentication errors to mail server fail.  Some resources do work though, like voip soft-phone, and telnet to other servers on the intranet.  

home network for the last several years looks like (edited for more clarity following SirDice response):

```
___dsl__>[modem: NAT, DHCP, wireless off]
             |  x.y.255.102 static ip.
             |
             |  x.y.255.97 static ip interface bge0
         [FBSD 7.2 ipfw+nat, dhcpd]
             |  192.168.1.1  interface bge1
             |
         [hub]
             |
        _____|_____________________
       |             |             |
  [192.168.1.20] [192.168.1.253]  [192.168.1.254]
```

FBSD box has 2 nics.  the public-facing ip has a static routable ip.  the internal-facing ip has 192.168.1 non-routable ip.  On the BSD box ive got the following rc.conf settings

```
defaultrouter="x.y.255.102"
static_routes=""
gateway_enable="YES"
```

Tech at work suggested the VPN would have trouble going through 2 routers.  But he didn't say exactly why.  He recommended as a test plugging the x.x.1.20 computer directly into the dsl modem, and have the dsl modem use dhcp to assign a routable IP.  The VPN worked great in that configuration.  I don't know what changes have been made to the corporate network, but suspect something has.

But it's not practical as the modem has a single ethernet jack.  

Is there some setting or kernel options in FBSD that I should enable?  

Is there a way to make the x.x.1.20 computer think it's directly connected to the dsl modem, while still plugged into the hub as diagrammed above?  If I had my FBSD dhcpd hand out a routable IP to the computer, would I have to bypass ipfw+nat entirely or just have ipfw forward traffic?  I have bought a block of static IPs from my provider and have another routable IP I could use.

Any ideas much appreciated.


----------



## SirDice (Dec 15, 2009)

There really is no need for the NAT on the fbsd box. Just make sure you have 2 subnets, one between the modem and the fbsd box, the other on your lan. If routing is setup properly everything should work.

You will need to add a static route to 192.168.1.0/24 on the modem pointing to the fbsd box.


----------

