Date: Wed, 19 Jul 2017 16:03:09 +0200 From: "Muenz, Michael" <m.muenz@spam-fetish.org> To: freebsd-net@freebsd.org Subject: Re: NAT before IPSEC - reply packets stuck at enc0 Message-ID: <ada273d7-d223-acc3-093c-ee84868fdc04@spam-fetish.org> In-Reply-To: <15e6eb38-ef0c-7bfd-5f2c-d2acc8ea1af4@yandex.ru> References: <459d59f7-2895-8aed-d547-be46a0fbb918@spam-fetish.org> <a082662c-145e-0132-18ef-083adaa59c33@yandex.ru> <1c0de616-91ff-a6f9-d946-f098bc1a709f@spam-fetish.org> <911903d1-f353-d5d6-d400-d86150f88136@yandex.ru> <2d607e1a-a2c0-0f85-1530-c478962a76cd@spam-fetish.org> <3344e189-cdf0-a2c9-3a2a-645460866f2d@yandex.ru> <1279753e-9ad1-2c02-304e-5001e2bbc82f@spam-fetish.org> <15e6eb38-ef0c-7bfd-5f2c-d2acc8ea1af4@yandex.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
Am 19.07.2017 um 15:35 schrieb Andrey V. Elsukov: >> Check what you will see if you set net.enc.in.ipsec_bpf_mask=3. >> You should see the reply two times, the second one should be with >> translated address. >> Correct: 16:01:02.222400 (authentic,confidential): SPI 0xd544e311: IP 10.26.1.1 > 10.24.66.25: ICMP echo request, id 64725, seq 0, length 8 16:01:02.230544 (authentic,confidential): SPI 0xc5769504: IP 81.24.1.1 > 213.244.2.2: IP 10.24.66.25 > 10.26.1.1: ICMP echo reply, id 64725, seq 0, length 8 (ipip-proto-4) 16:01:02.230553 (authentic,confidential): SPI 0xc5769504: IP 10.24.66.25 > 10.26.1.1: ICMP echo reply, id 64725, seq 0, length 8
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?ada273d7-d223-acc3-093c-ee84868fdc04>