From mboxrd@z Thu Jan 1 00:00:00 1970 From: Philip Craig Subject: Re: protocol 50 unreachable Date: Fri, 03 Dec 2004 16:35:59 +1000 Message-ID: <41B0094F.2010602@snapgear.com> References: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Helge Weissig Cc: Netfilter Mailing List Helge Weissig wrote: > I mean with "incomplete" that the tcpdump traffic I see does not show up > in the logs. I used your rules at the end of your reply and see the same > thing: ESP from VPN_SERVER hits $EXTIF, triggers the "protocol 50 > unreachable" icmp response and no log entry ever shows up in the kernel > log from the iptables log rule. I am suspecting that your option 3) is > indeed the problem. > > h. It is possible that a conntrack already exists, or the packet can't be conntracked, so the packet doesn't pass through nat PREROUTING. Try putting the log rule in the mangle PREROUTING chain. If they do match a log rule here, check if they are invalid with -m conntrack --ctstate INVALID. Also check if there are any esp conntracks in /proc/net/ip_conntrack -- Philip Craig - SnapGear, A CyberGuard Company - http://www.SnapGear.com