[lkml]   [2003]   [Aug]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: NAT + IPsec in 2.6.0-test2
On Tue, 2003-08-12 at 00:56, Jim Carter wrote:
> Could it be that the *name* of the ipsec device has changed? Messing with
> vtun, I did that to myself recently and suffered a similar loss of
> connectivity through the tunnel. My solution was an iptables rule saying
> that packets going to any interface except the house network get NATted.

Because the new IPsec code is built in there is no "ipsec" device to
speak of. My initial analysis is that FreeS/WAN basically fed a packet
through the system twice, once via the real interface and once via the
tunnel. This allowed for easy separation of rules.

This simply doesn't seem to be the case anymore, packets leaving an
interface are either encrypted or not based on kernel policies set via
setkey. It looks like it's been encrypted before it reaches the
POSTROUTING rule thus precluding it from being NAT'd.

My rule doesn't use an interface anyway, it's this:

iptables -t nat -A POSTROUTING -s ! -d -j
SNAT --to-source

Which basically says if a packet is going to and it's source
is not to SNAT it to that address.


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:47    [W:0.033 / U:0.812 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site