Date: Wed, 20 Mar 2002 12:21:07 -0800 From: Lars Eggert <larse@ISI.EDU> To: =?ISO-8859-1?Q?Rickard_Borgm=E4ster?= <doktorn@realworld.nu> Cc: freebsd-net@freebsd.org Subject: Re: IPSec tunnel FreeBSD<->OpenBSD using isakmp Message-ID: <3C98EF33.6090207@isi.edu> References: <20020320205735.0851b080.doktorn@realworld.nu>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Rickard Borgmster wrote: > I've established a tunnel between my home FreeBSD host and a corporate > OpenBSD firewall. IPsec tunnel I assume? > I can see this at OpenBSD box: > # netstat -rn > [...] > Port Destination Port Proto SA(Address/Proto/Type/Direction) > 192.168.2/24 0 10.0.0/24 0 0 > 130.236.218.63/50/use/in 10.0.0/24 0 192.168.2/24 0 > 0 130.236.218.63/50/require/out > > However, on the FreeBSD side, netstat -rn won't show anything about > 10.0.0.0/24. Maybe Encap routes won't show in the ordinary routing table > on FreeBSD? It looks like the OpenBSD IPsec implementation integrates IPsec tunnel mode SAs with the routing table (good!) FreeBSD's KAME doesn't (yet; more recent KAME SNAPs have "device sec" which looks promising). > From either the OpenBSD or FreeBSD box, I am unable to reach the private > net behind the other IPSec node. Ie, from FreeBSD box, I cannot reach > 10.0.0.0/24. And from OpenBSD box, I cannot reach 192.168.2.0/24. I bet your boxes pick the wrong source address when you generate packets on them to go to the other net, because you don't have any interfaces configured on these nets (IPsec SAs aren't interfaces, at least on FreeBSD). Try tcpdumping and tell me what you get. Lars -- Lars Eggert <larse@isi.edu> Information Sciences Institute http://www.isi.edu/larse/ University of Southern California [-- Attachment #2 --] 0 *H 01 0 + 0 *H 00 G0 *H 01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.300 010824164000Z 020824164000Z0T10 UEggert1 0 U*Lars10U Lars Eggert1 0 *H larse@isi.edu00 *H 0 |\Pw v~~ FDooӦA\- Cˀ4.)&{肋 ,z (ܷر߈T7_'txGH^tt/ҹB8%t<#ֲN V0T0*+e!0 00L2uMyffBNUbNJJcdZ2s0U 0 larse@isi.edu0 U 0 0 *H aJPMՒ ]cѭC+kS+wZ1gY",YT41 j 6:~℩ D~Kؚl=u(ՎM?cF7@}T00 G0 *H 01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.300 010824164000Z 020824164000Z0T10 UEggert1 0 U*Lars10U Lars Eggert1 0 *H larse@isi.edu00 *H 0 |\Pw v~~ FDooӦA\- Cˀ4.)&{肋 ,z (ܷر߈T7_'txGH^tt/ҹB8%t<#ֲN V0T0*+e!0 00L2uMyffBNUbNJJcdZ2s0U 0 larse@isi.edu0 U 0 0 *H aJPMՒ ]cѭC+kS+wZ1gY",YT41 j 6:~℩ D~Kؚl=u(ՎM?cF7@}T0)0 0 *H 01 0 UZA10U Western Cape10U Cape Town10U Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *H personal-freemail@thawte.com0 000830000000Z 020829235959Z01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.3000 *H 0 32c %E>nx'gڈD)c5*mp<ܮto034qmOe KaU5u'rװ |CBPQ<9TIf - ki N0L0)U "0 0 10UPrivateLabel1-2970U 0 0 U 0 *H so&e4KYbDI j&*b ct mSK8P:l4撜n# KrgPo.X PW Ո9[9}4%MjÑ/<RbH10001 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.30G0 + a0 *H 1 *H 0 *H 1 020320202107Z0# *H 1 ZS 0R *H 1E0C0 *H 0*H 0 *H @0+0 *H (0 *H 101 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.30G0 *H {mjm.ǐ/i PֹЅCyVç@c`Jڞy, IZo\_]]SnAk٭&$lѩt B_<o6
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3C98EF33.6090207>