Date: Fri, 13 Apr 2001 16:53:07 -0700 From: steve@Watt.COM (Steve Watt) To: questions@freebsd.org Subject: IPsec painful setup... Message-ID: <200104132353.f3DNr8B82866@wattres.Watt.COM>
next in thread | raw e-mail | index | archive | help
I've got a situation where I'm trying to set up an IPsec ESP tunnel
to a box that's on the far side of a NAT box. I've successfully set
up an IPsec tunnel to my box at home, but it's smart enough to have
a routable IP address on one interface, unlike this other situation.
Here's a picture of what I'm trying; maybe someone can help:
(internal net A) (DSL line)
+---------+ | +---------+ | +-------------+
| FreeBSD | v | | v | Other IPsec |
| box +---+ NAT rtr +-- inet --+ capable +--- internal net B
| ("A") | | | | router |
+---------+ +---------+ +-------------+
Because it's a DSL line from the NATing router, I can't just hook up
the network interface with the routable address to box A.
The starting configuration is pretty much as described in the IPsec
mini-howto on DaemonNews.
So, the questions are as follows:
1. What address should I configure the local part of gif0 with? The one
associated with the DSL line, or the (static) NATted address of box A?
2. Same question, but in the SPD
3. Will I need to consume an extra subnet for the internal address of
gif0, or put it on internal net B's range (with a proxy arp), or ...?
I can't seem to locate anything that provides adequate clues in this
area; maybe I'm just SOL and need to upgrade the NAT rtr?
Thanks,
--
Steve Watt KD6GGD PP-ASEL-IA ICBM: 121W 56' 57.8" / 37N 20' 14.9"
Internet: steve @ Watt.COM Whois: SW32
Free time? There's no such thing. It just comes in varying prices...
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200104132353.f3DNr8B82866>