Date: Sun, 2 Mar 2003 15:55:32 +0100 (CET) From: "Kirill Ponazdyr" <lists@codeangels.com> To: <lists@codeangels.com> Cc: <freebsd-questions@freebsd.org> Subject: Re: FreeBSD 4.6 and funky IPF/IPNat problem. Message-ID: <3610.192.168.1.236.1046616932.squirrel@www.codeangels.com> In-Reply-To: <1703.192.168.1.236.1046473162.squirrel@www.codeangels.com> References: <1703.192.168.1.236.1046473162.squirrel@www.codeangels.com>
next in thread | previous in thread | raw e-mail | index | archive | help
After doing some research, I found out that it is the rfc1323 option which causes this problem. If we disable the net.inet.tcp.rfc1323 the problems dissapear. Anyone has an idea why IPSec causes the rfc1323 extended connections to stall ? Best Regards Kirill > Hi, > > We have a quite wierd problem which I would like to find an answer for, > here is a schema of the network: > > > <---- Internet ----> !1 Firewall A !2 <----- Intranet segment 1 -----> > | !3 | > | | | > Host A | Host B > | > Leased Line/IPSec Tunnel > | > | > | > !1 > Firewall B !2 <----- Intranet Segment 2 -----> > | > | > Host C > > Firewalls A/B and Host B are running FreeBSD 4.6 > Host C is a dual boot machine with FreeBSD 4.6 and W2K > > Firewall A performs IPNat for all "inside" packets leaving trough the > "outside" !1 interface. The ipnat statement is: > > map dc0 from 192.168.0.0/16 to any -> 0/32 > > What works: > > Host B (Any OS) -> Host A > Host C (NT) -> Host A > > What does not work: > > Host C (FreeBSD) -> Host A > > After a period of testing I have found out that by some unknown reason > IPNat on Firewall A will flatly refuse to NAT packets which come from > IPSec Tunnel and go to Internet and if the communicating host is > FreeBSD. Not only that, but IPFilter will will also fail to keep state > of those connections which went trough it. This is even more confusing > because we use DHCP on Segment 2 and it delivers the same IP to the Host > C regardless of its OS, when it is NT, everything works like a charm but > when it is FreeBSD connections fail. This is a really funky problem I > have no explanation for, did anyone ever seen something like that before > ? > > To add more to confusion: We also have an IRIX host on the Segment 2 and > its packets get natted without any problems. > > Best Regards > > Kirill > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3610.192.168.1.236.1046616932.squirrel>