From: Patrick McHardy <kaber@trash.net>
To: Friedrich Euler <friedrich.euler@googlemail.com>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: do not nat gre packets
Date: Mon, 25 Feb 2008 13:08:37 +0100 [thread overview]
Message-ID: <47C2AFC5.7060408@trash.net> (raw)
In-Reply-To: <47c1bfc1.0637560a.59d2.ffffbd8b@mx.google.com>
Friedrich Euler wrote:
> I am currently using iptables version 1.2.7a and encountered the following
> issue. When using a GRE (over ipsec) tunnel without the optional GRE key
> field, Netfilter cannot find a unique tupel for all GRE packets. This makes
> the connection tracking fail. The source code shows only a GRE over PPTP
> implementation. My understanding is that I need to extend the iptables
> implementation of version 1.2.7a to enable the connection tracking. Is this
> true? Was this fixed in a version following 1.2.7a?
>
> I would appreciate any information on this.
Without the gre key there is no way to distinguish two gre tunnels
between the same pair of hosts, so the connection tracking helper
behaves similar to ip_conntrack_proto_generic. It does not fail,
it simply doesn't work with multiple tunnels with equal endpoints.
prev parent reply other threads:[~2008-02-25 12:08 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-02-24 19:04 do not nat gre packets Friedrich Euler
2008-02-25 12:08 ` Patrick McHardy [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=47C2AFC5.7060408@trash.net \
--to=kaber@trash.net \
--cc=friedrich.euler@googlemail.com \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.