From owner-freebsd-net Mon Sep 10 8:42: 5 2001 Delivered-To: freebsd-net@freebsd.org Received: from Awfulhak.org (gw.Awfulhak.org [217.204.245.18]) by hub.freebsd.org (Postfix) with ESMTP id 385C737B40A for ; Mon, 10 Sep 2001 08:41:49 -0700 (PDT) Received: from hak.lan.Awfulhak.org (root@hak.lan.Awfulhak.org [172.16.0.12]) by Awfulhak.org (8.11.6/8.11.6) with ESMTP id f8AFfhi71375; Mon, 10 Sep 2001 16:41:43 +0100 (BST) (envelope-from brian@freebsd-services.com) Received: from hak.lan.Awfulhak.org (brian@localhost [127.0.0.1]) by hak.lan.Awfulhak.org (8.11.6/8.11.6) with ESMTP id f8AFfVJ61047; Mon, 10 Sep 2001 16:41:31 +0100 (BST) (envelope-from brian@freebsd-services.com) Message-Id: <200109101541.f8AFfVJ61047@hak.lan.Awfulhak.org> X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4 To: Matthew Emmerton Cc: Brian Somers , JINMEI Tatuya / =?ISO-2022-JP?B?GyRCP0BMQEMjOkgbKEI=?= , freebsd-net@FreeBSD.ORG, brian@freebsd-services.com Subject: Re: Forward: Re: ping gif0 In-Reply-To: Message from Matthew Emmerton of "Mon, 10 Sep 2001 10:54:20 EDT." Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Mon, 10 Sep 2001 16:41:31 +0100 From: Brian Somers Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org > On Mon, 10 Sep 2001, Brian Somers wrote: > > > > >>>>> On Mon, 10 Sep 2001 11:54:49 +0100, > > > >>>>> Brian Somers said: > > > > > > > The local endpoint can't be pinged unless you've got a route for > > > > it... that's just the way the routing code works. > > > > > > > You can ping the local address for an Ethernet interface, but that's > > > > just because the hardware returns such packets. > > > > > > > Adding a loopback route or address alias is the way to handle this. > > > > > > Correct, but in this case, pinging the other end of the link also > > > failed: > > > > > > gif0: flags=8011 mtu 1280 > > > inet 10.0.2.130 --> 10.0.2.2 netmask 0xffffffff > > > physical address inet 209.167.75.123 --> 209.167.75.124 > > > > > > waterloo.heers.on.ca# ping 10.0.2.2 > > > PING 10.0.2.2 (10.0.2.2): 56 data bytes > > > ^C > > > --- 10.0.2.2 ping statistics --- > > > 15 packets transmitted, 0 packets received, 100% packet loss > > > > > > I don't get the reason for this part. This is perhaps due to some > > > IPsec issues? netstat gave us an interesting result: > > > > > > 34 inbound packets violated process security policy > > > > This rings bells. I have been having difficulties with an IPSEC over > > gif setup recently, but they went away with the latest racoon update > > in the ports collection. They *may* have appeared with the previous > > racoon update - I'm not sure. The symptoms were bizarre. > > However, I'm not using racoon. Static keys, using '-E simple ""' as the > encryption algorithm. (This helps me figure out whats going on with > tcpdump and ethereal much more easily.) > > LAN1 machines can talk to LAN2 machines and vice versa with absolutely no > problems. However, the LAN1 gateway can't talk to the LAN2 gateway and > vice versa. As was pointed out, I need to set up some localhost routes in > order to ping the local end of the tunnel. > > What remains is a) why can't I ping the remote end of the tunnel without > receiving these "violated process security policy" messages, and b) why > can't I connect to the remote end of the tunnel. The latter breaks > DNS forwarding / HTTP proxy / sendmail forwarding, and is becoming a real > problem. What does your security policy say ? I have this on the LAN1 gateway: spdadd LAN2PUB/32 LAN1PUB/32 ip4 -P in ipsec esp/transport//require; spdadd LAN1PUB/32 LAN2PUB/32 ip4 -P out ipsec esp/transport//require; and of course the in/out bits reversed on the LAN2 gateway. The important bit is the ``ip4'' bit. I don't expect connections to/from the public IP numbers to be caught by the policy - and in fact run NAT on both gateways. > -- > Matt Emmerton -- Brian http://www.freebsd-services.com/ Don't _EVER_ lose your sense of humour ! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message