lkml.org 
[lkml]   [2003]   [Aug]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: NAT + IPsec in 2.6.0-test2
From
Date
On Tue, 2003-08-12 at 00:56, Jim Carter wrote:
> Could it be that the *name* of the ipsec device has changed? Messing with
> vtun, I did that to myself recently and suffered a similar loss of
> connectivity through the tunnel. My solution was an iptables rule saying
> that packets going to any interface except the house network get NATted.

Because the new IPsec code is built in there is no "ipsec" device to
speak of. My initial analysis is that FreeS/WAN basically fed a packet
through the system twice, once via the real interface and once via the
tunnel. This allowed for easy separation of rules.

This simply doesn't seem to be the case anymore, packets leaving an
interface are either encrypted or not based on kernel policies set via
setkey. It looks like it's been encrypted before it reaches the
POSTROUTING rule thus precluding it from being NAT'd.

My rule doesn't use an interface anyway, it's this:

iptables -t nat -A POSTROUTING -s ! 10.250.1.129/32 -d 10.0.0.0/8 -j
SNAT --to-source 10.250.1.129

Which basically says if a packet is going to 10.0.0.0/8 and it's source
is not 10.250.1.129 to SNAT it to that address.

Later,
Tom


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:47    [W:0.033 / U:0.812 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site