Re: protocol 50 unreachable

[Jason Opperisano <opie@817west.com>]

On Thu, Dec 02, 2004 at 11:26:22AM -0800, Helge Weissig wrote:
> I mean with "incomplete" that the tcpdump traffic I see does not show up 
> in the logs. I used your rules at the end of your reply and see the same 
> thing: ESP from VPN_SERVER hits $EXTIF, triggers the "protocol 50 
> unreachable" icmp response and no log entry ever shows up in the kernel 
> log from the iptables log rule. I am suspecting that your option 3) is 
> indeed the problem.
> 
> h.

what kernel are you running on this firewall [*]?  the only plausible
explanation at this point (and i'm not even sure that this is possible)
is that you're running an IPsec-enabled kernel that has SPD entries in
it that is scarfing up the ESP packets prior to the PREROUTING netfilter
hooks.  i'm not sure that the last part is even possible though, as i
was under the impression that ESP packets fully travel through PREROUTING
and INPUT before they get processed by the kernel IPsec code...

[*] if the answer is 2.6, the output of "setkey -aPD" should be:
    No SPD entries.

-j

--
"I hope I didn't brain my damage."
        --The Simpsons