From owner-freebsd-net@FreeBSD.ORG Thu Nov 13 15:17:59 2008 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3B2051065672 for ; Thu, 13 Nov 2008 15:17:59 +0000 (UTC) (envelope-from rnoland@FreeBSD.org) Received: from gizmo.2hip.net (gizmo.2hip.net [64.74.207.195]) by mx1.freebsd.org (Postfix) with ESMTP id D4E2A8FC1B for ; Thu, 13 Nov 2008 15:17:58 +0000 (UTC) (envelope-from rnoland@FreeBSD.org) Received: from [10.63.4.100] (gw1.cox.com [24.248.74.254]) (authenticated bits=0) by gizmo.2hip.net (8.14.3/8.14.3) with ESMTP id mADFHtoL092916 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 13 Nov 2008 10:17:55 -0500 (EST) (envelope-from rnoland@FreeBSD.org) From: Robert Noland To: sclark46@earthlink.net In-Reply-To: <491C2235.4090509@earthlink.net> References: <491B2703.4080707@earthlink.net> <491B31F7.30200@elischer.org> <491B4345.80106@earthlink.net> <491B47D2.6010804@elischer.org> <491C2235.4090509@earthlink.net> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-oqrMt4NQs0se7ZPtGUVB" Organization: FreeBSD Date: Thu, 13 Nov 2008 10:17:48 -0500 Message-Id: <1226589468.1976.12.camel@wombat.2hip.net> Mime-Version: 1.0 X-Mailer: Evolution 2.22.3.1 FreeBSD GNOME Team Port X-Spam-Status: No, score=0.7 required=5.0 tests=AWL,BAYES_00,RCVD_IN_XBL autolearn=no version=3.2.5 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on gizmo.2hip.net Cc: freebsd-net@freebsd.org, Julian Elischer Subject: Re: FreeBSD 6.3 gre and traceroute X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Nov 2008 15:17:59 -0000 --=-oqrMt4NQs0se7ZPtGUVB Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Thu, 2008-11-13 at 07:48 -0500, Stephen Clark wrote: > Julian Elischer wrote: > > Stephen Clark wrote: > >> Julian Elischer wrote: > >=20 > >>> you will need to define the setup and question better. > >=20 > > thanks.. cleaning it up a bit more... > >=20 > > 10.0.129.1 FreeBSD workstation > > ^ > > | > > | ethernet > > | > > v > > 10.0.128.1 Freebsd FW "A" > > ^ > > | > > | gre / ipsec > > | > > v > > 192.168.3.1 FreeBSD FW "B" > > ^ > > | > > | ethernet > > | > > v > > 192.168.3.86 linux workstation > >=20 > >> $ sudo traceroute 192.168.3.86 > >> traceroute to 192.168.3.86 (192.168.3.86), 64 hops max, 40 byte packet= s > >> 1 HQFirewallRS.com (10.0.128.1) 0.575 ms 0.423 ms 0.173 ms > >> 2 * * * > >> 3 192.168.3.86 (192.168.3.86) 47.972 ms 45.174 ms 49.968 ms > >> > >> No response from the FreeBSD "B" box. > >> > >> When I do a tcpdump on "B" of the gre interface I see UDP packets > >> with a TTL of 1 but no ICMP response packets being sent back. > >=20 > >> > >> If I do the traceroute from the linux workstation 192.168.3.86 I get > >> similar results - I don't see a response from the FreeBSD "A" box. > >=20 > > could you try using just GRE encasulation? > > (i.e. turn off IPSEC for now) > >=20 > > I think that is much more likely to be where the problem is.. > >=20 > >=20 > I'll have to set this up to test it. The ttl exceeded is triggered from one of two places. Either netinet/ip_fastfwd.c if fast_forwarding is enabled or in netinet/ip_input.c. Look for the code relating to IPTTLDEC. This isn't your problem though... If ttl were not being decremented, the packet would just be forwarded on to the next hop (IP_STEALTH), which would just make the firewalls invisible. The fact that you are seeing * * * indicates that you are not receiving the ttl exceeded message for the packet sent with that particular ttl. I still think that the issue you are seeing is that one way or another the generated ICMP response isn't making it back onto the tunnel. Either via security policy, firewall or routing. robert. > What code in the FreeBSD kernel is responsible for generating the respons= e ICMP=20 > dest unreachable message? >=20 --=-oqrMt4NQs0se7ZPtGUVB Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (FreeBSD) iEYEABECAAYFAkkcRRwACgkQM4TrQ4qfROMI2ACdHE8Aj5kP7FihhhkWLqZ/UCcy QpMAniijaIpVOjoRmzwEt3uUE9jmoZV3 =maqq -----END PGP SIGNATURE----- --=-oqrMt4NQs0se7ZPtGUVB--