Не могу настроить сабж чтобы сети видели друг друга.
Тунель поднимается, можно пинговать шлюз на другой строне тунеля(если добавить маршруты на серверах) но сети друг друга не видят
Краткая вводная
на серверах две сетевые Lan1 eth0 - a.a.a.a (RealIP) eth1 - 10.35.99.254
Lan2 eth0 - b.b.b.b eth1 - 10.35.100.254
На обоих установлен OpensWan растройки обоих серверов одинаковые

# /etc/ipsec.conf - Openswan IPsec configuration file

version 2.0     # conforms to second version of ipsec.conf specification

# basic configuration
config setup
        forwardcontrol=yes
        klipsdebug=none
        nat_traversal=yes
        virtual_private=%v4:10.0.0.0/8
        oe=off
        protostack=netkey

# Add connections here
conn net-vpn
        left=a.a.a.a
        leftid=@first
        leftsubnet=10.35.99.0/24
        leftrsasigkey=AdsWE.....
        leftnexthop=чfaultroute
        right=b.b.b.b
        rightid=@second
        rightsubnet=10.35.100.0/24
        rightrsasigkey=FdsdE.....
        rightnexthop=чfaultroute
        auto=add

Lan1:

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

iptables-save
# Generated by iptables-save v1.4.4 on Tue Jun 28 23:49:52 2011
*filter
:INPUT ACCEPT [95251:130830654]
:FORWARD ACCEPT [2246:268632]
:OUTPUT ACCEPT [58809:2518145]
COMMIT
# Completed on Tue Jun 28 23:49:52 2011
# Generated by iptables-save v1.4.4 on Tue Jun 28 23:49:52 2011
*nat
:PREROUTING ACCEPT [716:49978]
:POSTROUTING ACCEPT [302:23225]
:OUTPUT ACCEPT [374:33847]
-A PREROUTING -d a.a.a.b/32 -p tcp -m tcp --dport 1121 -j DNAT --to-destination 10.35.99.100:1121
-A POSTROUTING -s 10.35.99.0/24 ! -d 10.35.100.0/24 -j SNAT --to-source a.a.a.a
-A POSTROUTING -s a.a.a.a/32 -d 10.35.100.0/24 -j SNAT --to-source 10.35.99.254
-A POSTROUTING -d 10.35.99.100/32 -p tcp -m tcp --dport 1121 -j SNAT --to-source a.a.a.b
COMMIT
# Completed on Tue Jun 28 23:49:52 2011

route
Таблица маршутизации ядра протокола IP
Destination Gateway Genmask Flags Metric Ref Use Iface
10.35.100.0     10.35.99.254    255.255.255.0   UG    0      0        0 eth1
10.35.99.0      *               255.255.255.0   U     0      0        0 eth1
localnet        *               255.255.255.0   U     0      0        0 eth0
default         ProviderGW   0.0.0.0         UG    100    0        0 eth0

Lan2

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-ssh  tcp  --  anywhere             anywhere            multiport dports ssh

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

iptables-save
# Generated by iptables-save v1.4.4 on Tue Jun 28 23:57:36 2011
*mangle
:PREROUTING ACCEPT [41292:19901395]
:INPUT ACCEPT [5871:862659]
:FORWARD ACCEPT [35421:19038736]
:OUTPUT ACCEPT [5875:655270]
:POSTROUTING ACCEPT [41296:19694006]
COMMIT
# Completed on Tue Jun 28 23:57:36 2011
# Generated by iptables-save v1.4.4 on Tue Jun 28 23:57:36 2011
*filter
:INPUT ACCEPT [5871:862659]
:FORWARD ACCEPT [35421:19038736]
:OUTPUT ACCEPT [5875:655270]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A fail2ban-ssh -j RETURN
COMMIT
# Completed on Tue Jun 28 23:57:36 2011
# Generated by iptables-save v1.4.4 on Tue Jun 28 23:57:36 2011
*nat
:PREROUTING ACCEPT [3552:240123]
:POSTROUTING ACCEPT [1809:138289]
:OUTPUT ACCEPT [1805:138025]
-A PREROUTING -d b.b.b.c/32 -p tcp -m tcp --dport 1121 -j DNAT --to-destination 10.35.100.100:1121
-A POSTROUTING -s 10.35.100.0/24 ! -d 10.35.99.0/24 -j SNAT --to-source b.b.b.b
-A POSTROUTING -s b.b.b.b/32 -d 10.35.99.0/24 -j SNAT --to-source 10.35.100.254
-A POSTROUTING -d 10.35.100.100/32 -p tcp -m tcp --dport 1121 -j SNAT --to-source b.b.b.c
COMMIT
# Completed on Tue Jun 28 23:57:36 2011

route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
localnet        *               255.255.255.240 U     0      0        0 eth0
10.35.100.0     *               255.255.255.0   U     0      0        0 eth1
10.35.99.0      10.35.100.254   255.255.255.0   UG    0      0        0 eth1
default         ProviderGW 0.0.0.0         UG    100    0        0 eth0
anzul@sg:~$

Как заставить машины из разных сетей видеть друг друга

Forwarding включен, пингую не со шлюза

Спасибо за помощь