[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: pf does not pass esp?
On Thu, Mar 21, 2002 at 08:27:58PM +0100, Rickard Borgmäster wrote:
> On Thu, 21 Mar 2002 10:41:49 -0800
> Jason Ish <firstname.lastname@example.org> hit the keyboard and punched:
> > All IPsec traffic passes over enc0. If you up enc0 then you can dump on
> > it and see your encrypted traffic.
> Ok, had no clue. How can I bring enc0 up on boot? Maybe just:
> # touch /etc/hostname.enc0
You don't need to bring it up to nat on it.
> I have a custom kernel, but I do have enc0. It just wasn't up.
> Anyways, added a nat rule like that, and what do you know, it
> works. Almost. Now the connection is 50% encrypted :-/
> tcpdumping on enc0 gives:
> 20:23:13.246779 (authentic,confidential): SPI 0x1f644dae:
> 126.96.36.199.1747 > 188.8.131.52.1494: . ack 1681 win 33304
> <nop,nop,timestamp 6070771 6142364> (DF) (encap)
> while tcpdumping on xl1 gives:
> 20:23:13.809282 0:10:4b:cf:1f:e0 0:c0:7b:a3:71:b6 0800 66:
> 184.108.40.206.1494 > 220.127.116.11.1747: . ack 16099 win 16122
> <nop,nop,timestamp 6142370 6070827> (DF)
> Seems as the return traffic wont go through the tunnel :-/
Add an outbound flow for your private network..
ipsecadm flow -proto esp -src <your ip> -dst <remote endpoint ip> \
-addr <private net>/<mask> <remote net>/<mask> -out \
The tunnel will then pick up the traffic, then NAT it, then encrypt it.