lkml.org 
[lkml]   [2004]   [Feb]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: 2.6.2 issues (IPSec+NAT, RFC2684 bridge)
Samofatov, Nickolay told me that:
> Here is a list of minor issues I encountered when migrated my AMD64
> machine to 2.6.2 kernel (64-bit).
>
> 1) Attempts to combine IPSec and NAT result in various kinds of
> failures. The easiest to reproduce is reliable hard system lock-up when
> IKE session needs to be initiated because of request from masqueraded
> machine.
> (workaround is to run cron job keeping IPSec connection active)

You probably hit the same bug as I did. When a SPD policy expires the
notification to userspace fails. Please try the patch from here and let
me know if it helps:
http://marc.theaimsgroup.com/?l=linux-netdev&m=107761652405761&w=2

> 2) I had to add following line to my routing rules to get IPSec working
> locally:
> --
> route add -m 172.20.0.0 netmask 255.255.0.0 gw 172.21.113.1
> --
> 172.20.0.0 here is VPN subnet I'm interested in. 172.21.113.1 is the
> address assigned to eth0 interface which is also IP address of this
> machine in VPN.
> Before I added this rule TCP connections from localhost failed with no
> route to host. The result works for most applications, but not all. For
> example, SSH fails.
> (my workaround is to use SOCKS5 proxy running locally for local SSH
> connections over IPSec tunnels)

Try to specify source address as well:
ip route add 172.20.0.0/16 via 172.21.113.1 src 172.21.x.x

> If there is interest, I may provide as much information as required to
> resolve the problems.

If the IPsec issues still remain, send me more information so that I
could reproduce it here.

Michal Ludvig
--
SUSE Labs mludvig@suse.cz | Cray is the only computer
(+420) 296.545.373 http://www.suse.cz | that runs an endless loop
Personal homepage http://www.logix.cz/michal | in just four hours.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:01    [W:0.039 / U:0.460 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site