From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jason Opperisano" Subject: RE: [OT] Was: ESP does not hit the nat table Date: Tue, 3 Aug 2004 08:42:45 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org > Hi all, > Thanks for the reply, I know I messed up the iptables syntax - I did = not include the chain... > > My main problem however was that ESP packets do not hit the nat table, = but it does traverse mangle/filter table. Is this normal? I am mainly = looking at SNAT/MASQUERADING ipsec traffic and I am not able to find any = documentation on doing this, especially since there is no point in = putting a "iptables -t nat -A PREROUTING -p 50 -j SNAT --to-source = ". -p 50 means ESP as you can already guess. > Am I missing something here? How do I masquerade ipsec traffic? = (assuming my ipsec-VPN client/server is fine with it...) it would be helpful if you a) posted your rules (iptables -vxnL && iptables -vxnL -t nat && = iptables -vxnL -t mangle) b) explained what you're trying to do specifically c) describe how you're testing as far as the generic "can i nat ESP traffic with iptables" the answer = is "surely." i do it on one of my gateways where it's necessary for the = LAN behind the gateway to appear differently when it goes through the = VPN tunnel. if i had to take a stab in the dark as to why you're having trouble--i = would say that it's related to the fact that the outbound interface of = your IPSec traffic needs to be specified as "-o ipsec0" (or whatever = number your actual ipsec interface is), not ethX... you *did* say you were using frees/wan, right? -j