I am establishing site to site tunnel.192.168.2.0/24===10.103.6.40<10.103.6.40>---10.103.6.1...10.103.6.29<10.103.6.29>===192.168.1.0/24;Local ip: 10.103.6.40Local lan: 192.168.2.0/24Remote lan is behind 10.103.6.29 (router) has lan 10.1.1.0/24.Remote ip: 10.1.1.44 (Behind 10.103.6.29, I have enabled VPN Passthrough)Remote lan: 192.168.1.0/24Now, Tunnel is established, but i can not ping remote lan's machine on 192.168.1.2.Log of ipsec:Mar  4 16:34:45 NG authpriv.warn pluto[9431]: listening for IKE messagesMar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface br0/br0 192.168.2.1:500Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface br0/br0 192.168.2.1:4500Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface eth3/eth3 10.103.6.40:500Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface eth3/eth3 10.103.6.40:4500Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface lo/lo 127.0.0.1:500Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface lo/lo 127.0.0.1:4500Mar  4 16:34:45 NG authpriv.warn pluto[9431]: adding interface lo/lo ::1:500Mar  4 16:34:45 NG authpriv.warn pluto[9431]: loading secrets from /etc/ipsec.secretsMar  4 16:34:46 NG authpriv.warn pluto[9431]: NG #1: initiating Main ModeMar  4 16:34:46 NG daemon.err ipsec__plutorun: 104 NG #1: STATE_MAIN_I1: initiateMar  4 16:34:46 NG authpriv.warn pluto[9431]: NG #1: received Vendor ID payload [Openswan (this version) 2.6.38 ]Mar  4 16:34:46 NG authpriv.warn pluto[9431]: NG #1: received Vendor ID payload [Dead Peer Detection]Mar  4 16:34:46 NG authpriv.warn pluto[9431]: NG #1: received Vendor ID payload [RFC 3947] method set to=115 Mar  4 16:34:46 NG authpriv.warn pluto[9431]: NG #1: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)Mar  4 16:34:47 NG authpriv.warn pluto[9431]: NG #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2Mar  4 16:34:47 NG authpriv.warn pluto[9431]: NG #1: STATE_MAIN_I2: sent MI2, expecting MR2Mar  4 16:34:47 NG authpriv.warn pluto[9431]: NG #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): peer is NATedMar  4 16:34:47 NG authpriv.warn pluto[9431]: NG #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3Mar  4 16:34:47 NG authpriv.warn pluto[9431]: NG #1: STATE_MAIN_I3: sent MI3, expecting MR3Mar  4 16:34:47 NG authpriv.warn pluto[9431]: NG #1: received Vendor ID payload [CAN-IKEv2]Mar  4 16:34:47 NG authpriv.warn pluto[9431]: NG #1: Main mode peer ID is ID_IPV4_ADDR: '10.103.6.29'Mar  4 16:34:47 NG authpriv.warn pluto[9431]: NG #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4Mar  4 16:34:47 NG authpriv.warn pluto[9431]: NG #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_md5 group=modp1024}Mar  4 16:34:47 NG authpriv.warn pluto[9431]: NG #1: Dead Peer Detection (RFC 3706): enabledMar  4 16:34:47 NG authpriv.warn pluto[9431]: NG #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:f5d74d20 proposal=AES(12)_128-MD5(1)_128, AES(12)_192-MD5(1)_128, AES(12)_256-MD5(1)_128, AES(12)_128-SHA1(2)_160, AES(12)_192-SHA1(2)_160, AES(12)_256-SHA1(2)_160, 3DES(3)_192-MD5(1)_128, 3DES(3)_192-SHA1(2)_160 pfsgroup=OAKLEY_GROUP_MODP1024}Mar  4 16:34:49 NG authpriv.warn pluto[9431]: NG #2: Dead Peer Detection (RFC 3706): enabledMar  4 16:34:49 NG authpriv.warn pluto[9431]: NG #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2Mar  4 16:34:49 NG authpriv.warn pluto[9431]: NG #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x9143bd7d <0x1cb79f9a xfrm=AES_128-HMAC_MD5 NATOA=none NATD=10.103.6.29:4500 DPD=enabled}Tunnel is established successfully.local configuration (At 10.103.6.40 side):config setup    nat_traversal=yes    oe=off    protostack=netkeyconn NGpassthrough    left=192.168.2.1    right=0.0.0.0    leftsubnet=192.168.2.0/24    rightsubnet=192.168.2.0/24    authby=never    type=passthrough    auto=routeconn NG    right=10.103.6.29    rightsubnet=192.168.1.0/24    left=10.103.6.40    leftsubnet=192.168.2.0/24    leftnexthop=10.103.6.1    auto=start    leftid=10.103.6.40    rightid=10.103.6.29    #x_rightdynamic=yes    authby=secret    compress=no    failureshunt=drop    dpddelay=15    dpdtimeout=60    dpdaction=restart    pfs=yes    ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048    esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1Remote Configuartion (At 10.1.1.44 side):config setup    nat_traversal=yes    oe=off    protostack=netkeyconn NGpassthrough    left=192.168.1.1    right=0.0.0.0    leftsubnet=192.168.1.0/24    rightsubnet=192.168.1.0/24    authby=never    type=passthrough    auto=routeconn NG    right=10.103.6.40    rightsubnet=192.168.2.0/24    left=10.1.1.44    leftsubnet=192.168.1.0/24    leftnexthop=10.1.1.1    auto=start    leftid=10.103.6.29    rightid=10.103.6.40    #x_rightdynamic=yes    authby=secret    compress=no    failureshunt=drop    dpddelay=15    dpdtimeout=60    dpdaction=restart    pfs=yes    ike=aes128-md5-modp1024,aes192-md5-modp1024,aes256-md5-modp1024,aes128-sha1-modp1024,aes192-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024,3des-sha1-modp1024,aes128-md5-modp1536,aes192-md5-modp1536,aes256-md5-modp1536,aes128-sha1-modp1536,aes192-sha1-modp1536,aes256-sha1-modp1536,3des-md5-modp1536,3des-sha1-modp1536,aes128-md5-modp2048,aes192-md5-modp2048,aes256-md5-modp2048,aes128-sha1-modp2048,aes192-sha1-modp2048,aes256-sha1-modp2048,3des-md5-modp2048,3des-sha1-modp2048    esp=aes128-md5,aes192-md5,aes256-md5,aes128-sha1,aes192-sha1,aes256-sha1,3des-md5,3des-sha1Firewall rule on 10.103.6.29:-A PREROUTING -p udp -m udp --dport 500 -j DNAT --to-destination 10.1.1.44:500 -A PREROUTING -p udp -m udp --dport 4500 -j DNAT --to-destination 10.1.1.44:4500 I have two pc's at both end. On local side PC has ip 192.168.2.2 and at remote side PC has ip 192.168.1.2.I CAN PING REMOTE ROUTER (192.168.1.1) but, can't access/ping remote lan PC (192.168.1.2).Help me please.
Openswan established NATed tunnel but, I can't ping remote end's lan PC
networking;vpn;ipsec