Date: Fri, 27 Dec 2013 09:22:01 +0200 From: "Zeus Panchenko" <zeus@ibs.dn.ua> To: <freebsd-pf@freebsd.org> Subject: Re: nat before ipsec ... Message-ID: <20131227092201.7029@relay.ibs.dn.ua> In-Reply-To: Your message of Wed, 25 Dec 2013 20:09:50 %2B0200 <20131225200950.21787@relay.ibs.dn.ua> References: <20131225200950.21787@relay.ibs.dn.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
=2D----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > target <-> world <--> em0 - freebsd - vlanA <--> LAN > ^ ^ net A > | | > +- netC -.-.-.-.- IPSec -.-.-.-.- net B -+ > ... > where: > A1 is some address from net A > B2 is some address from net B > C3 is some address from net C > > I can see incoming packets from A1 to C3 on interface vlanA, but after > that, packets "disappears", I can not find them any other interface and > no return packets finally I was able to get the packets redirected (actually after pf restart, not just reload) and now I have A1 packet going to C3 on vlanA # tcpdump -ni tun10 host C3 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tun10, link-type NULL (BSD loopback), capture size 65535 bytes 07:10:57.641536 IP A1 > C3: ICMP echo request, id 59179, seq 8913, length 64 07:10:58.641467 IP A1 > C3: ICMP echo request, id 59179, seq 8914, length 64 07:10:59.641882 IP A1 > C3: ICMP echo request, id 59179, seq 8915, length 64 and further I can see them on the interface, IPSec configured on: # tcpdump -ni em1 host C3 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on em1, link-type EN10MB (Ethernet), capture size 65535 bytes 07:12:28.638456 IP A1 > C3: ICMP echo request, id 59179, seq 9004, length 64 07:12:29.636961 IP A1 > C3: ICMP echo request, id 59179, seq 9005, length 64 07:12:30.637647 IP A1 > C3: ICMP echo request, id 59179, seq 9006, length 64 but these packets *does not passing through the nat* ... in pf.conf I do: rdr pass on $if_vpn from A1 to C -> $target-side-of-ipsec binat on $if_vpn from A1 to C3 -> B2 and net.inet.ipsec.filtertunnel is set to 1 is bellow URL the answer? http://forum.pfsense.org/index.php/topic,49800.msg265106.html#msg265106 =2D --=20 Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) =2D----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlK9KpgACgkQr3jpPg/3oyrcbgCfe7+k8VGcoqpQkbjg5uTmGn/A xTUAoLLjMCD0GEcRWcAD61mXWMNZ+4ZQ =3D2rY3 =2D----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20131227092201.7029>