From owner-freebsd-stable@FreeBSD.ORG Sat Jan 23 10:10:08 2010 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6F97110656A4 for ; Sat, 23 Jan 2010 10:10:08 +0000 (UTC) (envelope-from bzeeb-lists@lists.zabbadoz.net) Received: from mail.cksoft.de (mail.cksoft.de [IPv6:2001:4068:10::3]) by mx1.freebsd.org (Postfix) with ESMTP id 072398FC26 for ; Sat, 23 Jan 2010 10:10:08 +0000 (UTC) Received: from localhost (amavis.fra.cksoft.de [192.168.74.71]) by mail.cksoft.de (Postfix) with ESMTP id 7F95941C751; Sat, 23 Jan 2010 11:10:06 +0100 (CET) X-Virus-Scanned: amavisd-new at cksoft.de Received: from mail.cksoft.de ([192.168.74.103]) by localhost (amavis.fra.cksoft.de [192.168.74.71]) (amavisd-new, port 10024) with ESMTP id d-hcNr3RnObD; Sat, 23 Jan 2010 11:10:05 +0100 (CET) Received: by mail.cksoft.de (Postfix, from userid 66) id DB44941C712; Sat, 23 Jan 2010 11:10:05 +0100 (CET) Received: from maildrop.int.zabbadoz.net (maildrop.int.zabbadoz.net [10.111.66.10]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.int.zabbadoz.net (Postfix) with ESMTP id D5B744448EC; Sat, 23 Jan 2010 10:09:01 +0000 (UTC) Date: Sat, 23 Jan 2010 10:09:00 +0000 (UTC) From: "Bjoern A. Zeeb" X-X-Sender: bz@maildrop.int.zabbadoz.net To: Nat Howard In-Reply-To: Message-ID: <20100123100713.X50938@maildrop.int.zabbadoz.net> References: X-OpenPGP-Key: 0x14003F198FEFA3E77207EE8D2B58B8F83CCF1842 MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: freebsd-stable@freebsd.org Subject: Re: IPSec NAT-T in transport mode X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Jan 2010 10:10:08 -0000 On Fri, 22 Jan 2010, Nat Howard wrote: > I'm very interested in this problem -- I want to run an L2TP server myself. Is anyone actually working on this? I might be able to chip in a few bucks... > > But I'm not seeing bad checksums. Here's my setup: > > > L2tp server A<---------------->B Freebsd NAT box C <-----------internal network----------->D my mac > > Where should I be seeing the bad checksums? A, B, C, or D? > > > Looking only at B, I don't see any bad udp checksums, but I'm seeing a bunch of these (IP numbers changed to bracketed names): This doesn't say if you are using IPsec but I will asume so, that would mean that you D "my mac" would initiate the connection and the A node "L2tp server" would then be the other end. If that's a FreeBSD box as well, you should check statistics there. The NAT gateway in between has nothing to do with this, only the IPsec ends. /bz -- Bjoern A. Zeeb It will not break if you know what you are doing.