Re: Netfilter+IPsec patches

[Stephen Frost <sfrost@snowman.net>]

[-- Attachment #1: Type: text/plain, Size: 2106 bytes --]

* Alexander Samad (alex@samad.com.au) wrote:
> On Thu, May 27, 2004 at 02:56:46AM +0200, Patrick McHardy wrote:
> > Please give some more details on the configuration, like:
> > 
> > Are you using NAT ?
> > Are you marking the packets in the mangle table ?
> > Are the packets forwarded when they get out of the tunnel ?
> > 
> > When you see the packets in the INPUT chain, does their source- and
> > destination address match your policy ?
> I did some futher testing, I was in NAT-T mode, when I removed the
> nat'ing it started to work.

I've run into a rather annoying problem.  I'm not sure if it's due to
the IPSEC patches, but I have some suspicion that it is.  Basically the
story goes like this:

I've got a bunch of network cards in my gateway, in this example we're
concerned w/ 3 of them- two connections to the internet, one internal.
For this to work I have to have source-based routing working (which it
used to, back when I was using 2.4).  It appears to still work fine for
connections which are *not* NAT'd.  For connections which are NAT'd it
goes like this:

eth0 - internet1 (has the 'default' route going out it)
eth1 - internet2 (has a seperate route table w/ a default route)
eth2 - internal

SYN comes in on eth0, NAT'd, goes out eth2, SYN+ACK comes back, that
gets NAT'd and goes out eth0.  All's happy there.

SYN comes in on eth1, NAT'd, goes out eth2, SYN+ACK comes back, that
gets NAT'd to the eth1 address but then gets sent out *eth0* instead.

pings (which aren't NAT'd) to the eth1 address work fine.  So do
traceroute's (again, not NAT'd).  If NAT'ing is turned off and the
machine accepts connections directly then TCP connections also work
fine.

Policy-based routing is in effect, and is working for things which are
not NAT'd.  Things which are NAT'd appear to be going out the main
table's default route though instead of being properly routed.

This is using 2.6.7 w/ recent (week-old) CVS iptables/pom-ng, the 
IPSEC patches and some others (though *not* the new conntrack code).

Thoughts?

	Thanks,

		Stephen

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]