2.6.16-rc1-mm3 XFRM+NAT issue

[Christophe Saout]

Hi,

I'm very glad that you found some time to get these patches into the
mainline kernel. Unfortunately I think I'm running into a case where
it's not working (it's working with 2.6.12 + the old unofficial IPSEC
+NAT patches).

          .--- gateway host ---.            .-- pub. host -.
priv net -|NAT + IPSEC endpoint|- internet -|IPSEC endpoint|
          '--------------------'            '--------------'

ping ----->---*NAT*---*XFRM*********>*********XFRM*--------.
                                                           v
                   ???.....*********<*********XFRM*- pong -'

Without IPSEC turned on I can reach the host on the far right from any
host in the private network on the left without problem. The private
address is source-NATted (masqueraeded) at the gateway.

When turning on the IPSEC connection between the gateway and the
internet host, the host in the private network can't reach the internet
host (on the right) anymore. It's still reachable from the gateway
itself though.

When pinging from the host behind the gateway the packet passes through
the gateway, gets to the internet host, which responds to the ping and
sends an encrypted packet back through the IPSEC connection which then
arrives at the gatway. But then the gateway simply ignores the packet
instead of decapsulating and DNATting it back to the host in the private
network. At least that's what I can gather from tcpdump. If I run
tcpdump on ppp0 on the gateway I can see encrypted packets go out to the
host on the right and encrypted packets coming back and that's it.

I couldn't exactly keep track with all the changes since 2.6.12 and I
was hoping that this kernel would just work and fulfill my needs... and
I still don't really "get" the networking stack I have no clue where to
start looking what could go wrong.

So, do you perhaps have any ideas?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Dies ist ein digital signierter Nachrichtenteil
Url : /pipermail/netfilter-devel/attachments/20060129/95d986e1/attachment.pgp