From owner-freebsd-security Wed Jan 3 21:16: 7 2001 From owner-freebsd-security@FreeBSD.ORG Wed Jan 3 21:16:05 2001 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from dragon.awen.com (dragon.awen.com [208.176.22.138]) by hub.freebsd.org (Postfix) with ESMTP id 0C56B37B400 for ; Wed, 3 Jan 2001 21:16:05 -0800 (PST) Received: (from mburgett@localhost) by dragon.awen.com (8.11.1/8.11.1) id f045G4j61054; Wed, 3 Jan 2001 21:16:04 -0800 (PST) Message-ID: X-Mailer: XFMail 1.4.0 on FreeBSD X-Priority: 3 (Normal) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit MIME-Version: 1.0 Date: Wed, 03 Jan 2001 21:16:04 -0800 (PST) Reply-To: Mike Burgett Sender: mburgett@smaug.awen.com From: Mike Burgett To: security@freebsd.org Subject: IPSec tunnels and natd Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hi, I've a fairly recent -stable box (dec 19) that I use for natd/firewalling for my internal net. It has a static default route, to the outside world. Recently, I added IPSec into the equation, and setup tunnels to three networks on the other side of a Gauntlet GVPN box. The ipsec tunnels are statically keyed, so setkey is only run at init. Every thing works, _most_ of the time, and I'm able to access the remote nets from any machine in my internal net, with everything appearing on the remotes as if it came from my tunnel-end. Every so often, though, I start getting messages from natd: "failed to write packet back (No route to host)" If I go to another window, and start pinging the external IP of the GVPN box, (the other tunnel-end), it may, or may not drop a few packets, and then start working, and at that point, my IPSec tunnels seem to be working again. If I'm watching with tcpdump during this time, I don't see any ip traffic going out to the other tunnel-end. If I leave a 'ping' running to the other tunnel-end, I don't seem to see the problem. I'm game for sticking in some diag lines, to try and gather more info about the circumstances surrounding these events, but don't really know where to start. Constructive suggestions welcome. Thanks, Mike ---------------------------------- E-Mail: Mike Burgett Date: 03-Jan-01 Time: 20:52:50 This message was sent by XFMail ---------------------------------- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message