From: Alistair Tonner <Alistair@nerdnet.ca>
To: netfilter@lists.netfilter.org
Subject: Re: Internet satellite link.
Date: Wed, 5 May 2004 08:43:00 -0400 [thread overview]
Message-ID: <200405050843.00628.Alistair@nerdnet.ca> (raw)
In-Reply-To: <200405051129.16104.carles@unlimitedmail.org>
On May 5, 2004 05:29 am, Carles Xavier Munyoz Baldó wrote:
> Hi,
> I have two lilnux boxes with FreeS/WAN and NAT-Traversal compiled in.
> One of them is behind a NAT router that connects to the Internet using a
> satellite link, and the other has its own public IP behind a DSL router.
>
> I have tried the connection of the NATed linux box using a DSL router and
> all goes fine, but when I use the satellite link router, I get the errors:
> [...]
> May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: received
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
>
> May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignoring
> Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
>
> May 4 13:54:21 FW1 pluto[16116]: packet from 81.47.250.201:1623: ignori
> ng Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
>
> May 4 13:54:21 FW1 [16116]: "vpn1"[9] 81.47.250.201:1623 #40: responding
> to Main Mode from unknown peer 81.47.250.201:1623
>
> May 4 13:54:22 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40:
> NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
>
> May 4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623 #40: max
> number of retransmissions (2) reached STATE_MAIN_R2
>
> May 4 13:55:32 FW1 pluto[16116]: "vpn1"[9] 81.47.250.201:1623: deleting
> connection "vpn1" instance with peer 81.47.250.201 {isakmp=3D#0/ipsec=3D#0}
> [...]
>
> I believe that there is no difference between the DSL NAT router and the
> satellite link NAT router, isn't it ?
> Which may be the problem ?
I sincerely doubt the two work identically on a mechanical level, however if
they are both connected to the iptables hosts with ethernet cable, the
product should be the same. Keep in mind that routers/switches between you
and the internet can indeed mangle/NAT/alter/twist/bend/fold/mutilate packets
based on their objectives. As I've been given to understand, this can indeed
cause havoc with VPN tunnels. At a guess, the connecting VPN client is
behind a NAT itself, and -THAT- appears to be the problem -- There are
FAR more experienced VPN people on this list than I, but I believe that there
are patches that make this possible.
Alistair.
>
> Greetings.
> ---
> Carles Xavier Munyoz Baldó
> carles@unlimitedmail.org
> http://www.unlimitedmail.net/
> ---
next prev parent reply other threads:[~2004-05-05 12:43 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-05-05 9:29 Internet satellite link Carles Xavier Munyoz Baldó
2004-05-05 12:43 ` Alistair Tonner [this message]
2004-05-05 15:28 ` John A. Sullivan III
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200405050843.00628.Alistair@nerdnet.ca \
--to=alistair@nerdnet.ca \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox