From: "pupilla@libero.it" <pupilla@libero.it>
To: <jengelh@inai.de>
Cc: <netdev@vger.kernel.org>
Subject: R: Re: mtu issue with ipsec tunnel and netfilter snat
Date: Thu, 10 Jan 2013 17:46:57 +0100 (CET) [thread overview]
Message-ID: <8364295.258481357836417891.JavaMail.defaultUser@defaultHost> (raw)
jengelh@inai.de wrote:
>On Wednesday 2013-01-09 10:01, pupilla@libero.it wrote:
>
>>As you can see there are incoming 1500 bytes packets (these are the
>>decrypted ipsec packets) with DF bit set. These packets are never
>>delivered to the final client 10.81.128.176 (the destination address
>>is 172.16.128.1 which is the ip used for SNATing the original ip
>>10.81.128.176).
>>
>>IMHO this is a mtu issue: 1500 bytes packets cannot be routed inside
>>the ipsec tunnel.
>>
>>But why linux_gw_snat is not sending icmp need to frag packets to
>>10.148.12.23?
>
>Perhaps because ICMP was blocked erroneously?
well, I don't see the icmp packets
because tcpdump 'see' only the incoming
ipsec clear packets. Is there a way to
see the outgoing clear ipsec packets
with tcpdump?
next reply other threads:[~2013-01-10 16:46 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-10 16:46 pupilla [this message]
2013-01-10 17:57 ` R: Re: mtu issue with ipsec tunnel and netfilter snat Jan Engelhardt
-- strict thread matches above, loose matches on Subject: below --
2013-01-09 9:55 pupilla
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8364295.258481357836417891.JavaMail.defaultUser@defaultHost \
--to=pupilla@libero.it \
--cc=jengelh@inai.de \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.