I've the need to configure IPsec tunnel mode between a gateway with static NAT (let's say its public IP is 172.31.0.105) and a number of clients that are behind dynamic NAT.Reading through some resources (as this, this, and this) I've found that the roadwarrior configuration should work for my case.I've properly managed to setup and start racoon in both my gateway and in a test client, and when I try to setup the vpn from the client (racoonctl vc -u user 172.31.0.105) I obtain the banner specified in the server.But somehow something it's wrong, and they cannot communicate.Here is the racoon.conf on the gateway:path certificate /etc/racoon/certs;listen {        adminsock disabled;        isakmp 172.31.0.105[500];        isakmp_natt 172.31.0.105[4500];}timer{        natt_keepalive 600 sec;}# Phase 1 configurationremote anonymous {    exchange_mode aggressive;    my_identifier asn1dn;    certificate_type x509 cert.pem key.pem;    proposal_check claim;    generate_policy on;    verify_cert off;    nat_traversal on;    dpd_delay 20;       ike_frag on;         proposal {        authentication_method hybrid_rsa_server;        encryption_algorithm 3des;        hash_algorithm md5;        dh_group 2;    }}# Local network informationmode_cfg {    network4 172.31.0.200;        netmask4 255.255.255.0;       dns4 8.8.8.8;                 #wins4 10.0.12.1;              pool_size 10;                  auth_source system;            banner /etc/racoon/motd;     pfs_group 2;}          # Phase 2 proposalsainfo anonymous {    pfs_group 2;    lifetime time 1 hour;    encryption_algorithm 3des;    authentication_algorithm hmac_md5;    compression_algorithm deflate;}Here is the racoon.conf on the test client:path certificate /etc/racoon;path pre_shared_key /etc/racoon/psk.txt;listen {    adminsock /var/racoon/racoon.sock root operator 0660;}# Here is the address of the VPN gatewayremote 172.31.0.105 {  exchange_mode aggressive;  ca_type x509 cacert.pem;  proposal_check obey;  nat_traversal on;  ike_frag on;  mode_cfg on;  passive off;  verify_cert off;  script /etc/racoon/phase1-up.sh phase1_up;  script /etc/racoon/phase1-down.sh phase1_down;  proposal {    encryption_algorithm 3des;    hash_algorithm md5;    authentication_method hybrid_rsa_client;    dh_group 2;  }}sainfo anonymous {        pfs_group 2;        lifetime time 1 hour;        encryption_algorithm 3des;        authentication_algorithm hmac_md5;        compression_algorithm deflate ;}Here are the dump of the SPD entries, while the set of SAD entries is empty:root@test-client:/etc/racoon# setkey -PD(per-socket policy)     Policy:[Invalid direciton]    created: Jan  1 02:28:49 1970  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=267 seq=1 pid=2489    refcnt=1(per-socket policy)     Policy:[Invalid direciton]    created: Jan  1 02:28:49 1970  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=276 seq=2 pid=2489    refcnt=1(per-socket policy)     Policy:[Invalid direciton]    created: Jan  1 02:28:49 1970  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=283 seq=3 pid=2489    refcnt=1(per-socket policy)     Policy:[Invalid direciton]    created: Jan  1 02:28:49 1970  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=292 seq=4 pid=2489    refcnt=1(per-socket policy)     Policy:[Invalid direciton]    created: Jan  1 02:28:50 1970  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=299 seq=5 pid=2489    refcnt=1(per-socket policy)     Policy:[Invalid direciton]    created: Jan  1 02:28:50 1970  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=308 seq=6 pid=2489    refcnt=1(per-socket policy)     Policy:[Invalid direciton]    created: Jan  1 02:28:50 1970  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=315 seq=7 pid=2489    refcnt=1(per-socket policy)     Policy:[Invalid direciton]    created: Jan  1 02:28:50 1970  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=324 seq=8 pid=2489    refcnt=1172.31.0.200[any] 0.0.0.0/0[any] any    out prio def ipsec    esp/tunnel/192.168.66.105-172.31.0.105/require    created: May 23 13:30:05 2014  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=345 seq=9 pid=2489    refcnt=10.0.0.0/0[any] 172.31.0.200[any] any    in prio def ipsec    esp/tunnel/172.31.0.105-192.168.66.105/require    created: May 23 13:30:05 2014  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=352 seq=10 pid=2489    refcnt=1(per-socket policy)     Policy:[Invalid direciton]    created: May 23 13:38:00 2014  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=371 seq=11 pid=2489    refcnt=1(per-socket policy)     Policy:[Invalid direciton]    created: May 23 13:38:00 2014  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=380 seq=12 pid=2489    refcnt=1(per-socket policy)     Policy:[Invalid direciton]    created: May 23 13:38:01 2014  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=387 seq=13 pid=2489    refcnt=1(per-socket policy)     Policy:[Invalid direciton]    created: May 23 13:38:01 2014  lastused:                         lifetime: 0(s) validtime: 0(s)    spid=396 seq=0 pid=2489    refcnt=1The client succesfully setup a new network interface:eth0:1    Link encap:Ethernet  HWaddr xx:xx:xx:xx:xx:xx            inet addr:172.31.0.200  Bcast:172.31.255.255  Mask:255.255.0.0          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1but when from the gateway I try to ping the client (or also to establish a netcat session) using this virtual IP (172.31.0.200) I get anDestination Host Unreachable
IPsec Tunnel mode - RoadWarriors configuration
vpn;tunneling;ipsec