>>>>>>the client always obtain 5.5.0.6 ip address but ipp.txt set this client to 5.5.0.4. It is normal to have different ip than ipp.txt?
this is normal for an 'ipp.txt' file when 'topology net30' is used, which is the default. Each client is allocated a mini /30 network containing 4 addresses:
- - 5.5.0.4: the network address ; this is record in ipp.txt
- 5.5.0.5: the virtual remote endpoint ; it must be present but it is not reachable
- 5.5.0.6: the client VPN IP address
- 5.5.0.7: the mini network broadcast address
>>>>>>>How to turn off for testing?
it's pretty much disabled , no need to turn it off any further
on the client I see in securepoint ssl vpn log
push "route 10.10.0.0 255.255.0.0 5.5.0.5"
it seems to push the route but the gateway seems to be wrong 5.5.0.5
ifconfig on server tun0 have 5.5.0.1 ip address not 5.5.0.5
the 5.5.0.5 address is the virtual endpoint address - this is normal and must NOT be altered
>>>>>the route 5.5.0.0 have the gateway 5.5.0.2????
again, this is normal behaviour in 'topology net30' mode
>>>>>>>>route print on client route 5.5.0.0 have gateway 5.5.0.5?????
again, this is normal behaviour (see above).
There are two things to check:
- is IP forwarding enabled on the server:
cat /proc/sys/net/ipv4/ip_forward
If not, enable it
echo 1 > /proc/sys/net/ipv4/ip_forward
- do the hosts on the 10.10.0.0 network know that packets with a source IP address of 5.5.0.0 need to go back to the VPN server? Is there a default route on the 10.10.0.0 gateway? A quick&dirty hack is to use iptables masquerading:
iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
HTH,
JJK
