Re: 2.6.2 issues (IPSec+NAT, RFC2684 bridge)

[Michal Ludvig <mludvig@suse.cz>]

Samofatov, Nickolay told me that:
> Here is a list of minor issues I encountered when migrated my AMD64
> machine to 2.6.2 kernel (64-bit).
> 
> 1) Attempts to combine IPSec and NAT result in various kinds of
> failures. The easiest to reproduce is reliable hard system lock-up when
> IKE session needs to be initiated because of request from masqueraded
> machine.
> (workaround is to run cron job keeping IPSec connection active)

You probably hit the same bug as I did. When a SPD policy expires the 
notification to userspace fails. Please try the patch from here and let 
me know if it helps:
http://marc.theaimsgroup.com/?l=linux-netdev&m=107761652405761&w=2

> 2) I had to add following line to my routing rules to get IPSec working
> locally:
> --
> route add -m 172.20.0.0 netmask 255.255.0.0 gw 172.21.113.1
> --
> 172.20.0.0 here is VPN subnet I'm interested in. 172.21.113.1 is the
> address assigned to eth0 interface which is also IP address of this
> machine in VPN.
> Before I added this rule TCP connections from localhost failed with no
> route to host. The result works for most applications, but not all. For
> example, SSH fails.
> (my workaround is to use SOCKS5 proxy running locally for local SSH
> connections over IPSec tunnels)

Try to specify source address as well:
ip route add 172.20.0.0/16 via 172.21.113.1 src 172.21.x.x

> If there is interest, I may provide as much information as required to
> resolve the problems.

If the IPsec issues still remain, send me more information so that I 
could reproduce it here.

Michal Ludvig
-- 
SUSE Labs                    mludvig@suse.cz | Cray is the only computer
(+420) 296.545.373        http://www.suse.cz | that runs an endless loop
Personal homepage http://www.logix.cz/michal | in just four hours.