* Internet satellite link.
@ 2004-05-05 9:29 Carles Xavier Munyoz Baldó
2004-05-05 12:43 ` Alistair Tonner
0 siblings, 1 reply; 3+ messages in thread
From: Carles Xavier Munyoz Baldó @ 2004-05-05 9:29 UTC (permalink / raw)
To: users; +Cc: netfilter
Hi,
I have two lilnux boxes with FreeS/WAN and NAT-Traversal compiled in.
One of them is behind a NAT router that connects to the Internet using a
satellite link, and the other has its own public IP behind a DSL router.
I have tried the connection of the NATed linux box using a DSL router and all
goes fine, but when I use the satellite link router, I get the errors:
[...]
May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: received
Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignoring
Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignori
ng Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
May 4 13:54:21 FW1 [16116]: "vpn1"[9] 81.47.250.201:1623 #40: responding to
Main Mode from unknown peer 81.47.250.201:1623
May 4 13:54:22 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40:
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
May 4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40: max number
of retransmissions (2) reached STATE_MAIN_R2
May 4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623: deleting
connection "vpn1" instance with peer 81.47.250.201 {isakmp=3D#0/ipsec=3D#0}
[...]
I believe that there is no difference between the DSL NAT router and the
satellite link NAT router, isn't it ?
Which may be the problem ?
Greetings.
---
Carles Xavier Munyoz Baldó
carles@unlimitedmail.org
http://www.unlimitedmail.net/
---
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: Internet satellite link.
2004-05-05 9:29 Internet satellite link Carles Xavier Munyoz Baldó
@ 2004-05-05 12:43 ` Alistair Tonner
2004-05-05 15:28 ` John A. Sullivan III
0 siblings, 1 reply; 3+ messages in thread
From: Alistair Tonner @ 2004-05-05 12:43 UTC (permalink / raw)
To: netfilter
On May 5, 2004 05:29 am, Carles Xavier Munyoz Baldó wrote:
> Hi,
> I have two lilnux boxes with FreeS/WAN and NAT-Traversal compiled in.
> One of them is behind a NAT router that connects to the Internet using a
> satellite link, and the other has its own public IP behind a DSL router.
>
> I have tried the connection of the NATed linux box using a DSL router and
> all goes fine, but when I use the satellite link router, I get the errors:
> [...]
> May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: received
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
>
> May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignoring
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
>
> May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignori
> ng Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
>
> May 4 13:54:21 FW1 [16116]: "vpn1"[9] 81.47.250.201:1623 #40: responding
> to Main Mode from unknown peer 81.47.250.201:1623
>
> May 4 13:54:22 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40:
> NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
>
> May 4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40: max
> number of retransmissions (2) reached STATE_MAIN_R2
>
> May 4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623: deleting
> connection "vpn1" instance with peer 81.47.250.201 {isakmp=3D#0/ipsec=3D#0}
> [...]
>
> I believe that there is no difference between the DSL NAT router and the
> satellite link NAT router, isn't it ?
> Which may be the problem ?
I sincerely doubt the two work identically on a mechanical level, however if
they are both connected to the iptables hosts with ethernet cable, the
product should be the same. Keep in mind that routers/switches between you
and the internet can indeed mangle/NAT/alter/twist/bend/fold/mutilate packets
based on their objectives. As I've been given to understand, this can indeed
cause havoc with VPN tunnels. At a guess, the connecting VPN client is
behind a NAT itself, and -THAT- appears to be the problem -- There are
FAR more experienced VPN people on this list than I, but I believe that there
are patches that make this possible.
Alistair.
>
> Greetings.
> ---
> Carles Xavier Munyoz Baldó
> carles@unlimitedmail.org
> http://www.unlimitedmail.net/
> ---
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: Internet satellite link.
2004-05-05 12:43 ` Alistair Tonner
@ 2004-05-05 15:28 ` John A. Sullivan III
0 siblings, 0 replies; 3+ messages in thread
From: John A. Sullivan III @ 2004-05-05 15:28 UTC (permalink / raw)
To: Alistair Tonner; +Cc: netfilter
On Wed, 2004-05-05 at 08:43, Alistair Tonner wrote:
> On May 5, 2004 05:29 am, Carles Xavier Munyoz Baldó wrote:
> > Hi,
> > I have two lilnux boxes with FreeS/WAN and NAT-Traversal compiled in.
> > One of them is behind a NAT router that connects to the Internet using a
> > satellite link, and the other has its own public IP behind a DSL router.
> >
> > I have tried the connection of the NATed linux box using a DSL router and
> > all goes fine, but when I use the satellite link router, I get the errors:
> > [...]
> > May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: received
> > Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
> >
> > May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignoring
> > Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
> >
> > May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignori
> > ng Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
> >
> > May 4 13:54:21 FW1 [16116]: "vpn1"[9] 81.47.250.201:1623 #40: responding
> > to Main Mode from unknown peer 81.47.250.201:1623
> >
> > May 4 13:54:22 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40:
> > NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
> >
> > May 4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40: max
> > number of retransmissions (2) reached STATE_MAIN_R2
> >
> > May 4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623: deleting
> > connection "vpn1" instance with peer 81.47.250.201 {isakmp=3D#0/ipsec=3D#0}
> > [...]
> >
> > I believe that there is no difference between the DSL NAT router and the
> > satellite link NAT router, isn't it ?
> > Which may be the problem ?
>
>
> I sincerely doubt the two work identically on a mechanical level, however if
> they are both connected to the iptables hosts with ethernet cable, the
> product should be the same. Keep in mind that routers/switches between you
> and the internet can indeed mangle/NAT/alter/twist/bend/fold/mutilate packets
> based on their objectives. As I've been given to understand, this can indeed
> cause havoc with VPN tunnels. At a guess, the connecting VPN client is
> behind a NAT itself, and -THAT- appears to be the problem -- There are
> FAR more experienced VPN people on this list than I, but I believe that there
> are patches that make this possible.
>
> Alistair.
<snip>
This is probably better posted to one of the *swan mailing lists. There
are some issues with Satellite but they are usually related to
performance rather than establishing a connection. There is typically
high latency on a satellite link. Many satellite providers compensate
for this by spoofing the tcp ACKs (I believe) but since the real packets
cannot be seen in the ESP encapsulation, the spoofing doesn't work and
one must live with the real latency. This can really kill latency
sensitive (ping-pongy) applications but should not prevent connection.
It would be helpful to see what the logs look like on the other side to
see what the complaints are there - John
> > ---
--
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2004-05-05 15:28 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-05-05 9:29 Internet satellite link Carles Xavier Munyoz Baldó
2004-05-05 12:43 ` Alistair Tonner
2004-05-05 15:28 ` John A. Sullivan III
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.