Date: Wed, 19 Jul 2017 14:46:03 +0200 From: "Muenz, Michael" <m.muenz@spam-fetish.org> To: freebsd-net@freebsd.org Subject: Re: NAT before IPSEC - reply packets stuck at enc0 Message-ID: <1279753e-9ad1-2c02-304e-5001e2bbc82f@spam-fetish.org> In-Reply-To: <3344e189-cdf0-a2c9-3a2a-645460866f2d@yandex.ru> References: <459d59f7-2895-8aed-d547-be46a0fbb918@spam-fetish.org> <a082662c-145e-0132-18ef-083adaa59c33@yandex.ru> <1c0de616-91ff-a6f9-d946-f098bc1a709f@spam-fetish.org> <911903d1-f353-d5d6-d400-d86150f88136@yandex.ru> <2d607e1a-a2c0-0f85-1530-c478962a76cd@spam-fetish.org> <3344e189-cdf0-a2c9-3a2a-645460866f2d@yandex.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
Am 19.07.2017 um 14:22 schrieb Andrey V. Elsukov: > > Different NAT instances will not work for the same flow, because they > have different state tables. Packets in both direction should pass > trough the same NAT instance. > > What you see in tcpdump on the enc0 interface? > Ok, also tried with one nat instance, same result: ipfw nat 1 config ip 10.26.1.1 log reverse ipfw add 179 nat 1 log all from 10.26.2.0/24 to 10.24.66.0/24 ipfw add 179 nat 1 log all from 10.24.66.0/24 to 10.26.1.1 in recv enc0 LAN Interface: 14:40:32.441506 IP 10.26.2.11 > 10.24.66.25: ICMP echo request, id 45314, seq 256, length 8 14:40:33.441565 IP 10.26.2.11 > 10.24.66.25: ICMP echo request, id 45314, seq 512, length 8 14:40:34.441635 IP 10.26.2.11 > 10.24.66.25: ICMP echo request, id 45314, seq 768, length 8 enc0 interface 14:40:32.441553 (authentic,confidential): SPI 0x8fe95b44: IP 10.26.1.1 > 10.24.66.25: ICMP echo request, id 64122, seq 256, length 8 14:40:32.449671 (authentic,confidential): SPI 0xcbc867ea: IP 10.24.66.25 > 10.26.1.1: ICMP echo reply, id 64122, seq 256, length 8 14:40:33.441613 (authentic,confidential): SPI 0x8fe95b44: IP 10.26.1.1 > 10.24.66.25: ICMP echo request, id 64122, seq 512, length 8 14:40:33.450623 (authentic,confidential): SPI 0xcbc867ea: IP 10.24.66.25 > 10.26.1.1: ICMP echo reply, id 64122, seq 512, length 8 14:40:34.441683 (authentic,confidential): SPI 0x8fe95b44: IP 10.26.1.1 > 10.24.66.25: ICMP echo request, id 64122, seq 768, length 8 14:40:34.449786 (authentic,confidential): SPI 0xcbc867ea: IP 10.24.66.25 > 10.26.1.1: ICMP echo reply, id 64122, seq 768, length 8 ipfw -ta list 00179 4 112 Wed Jul 19 14:40:34 2017 nat 1 log ip from 10.26.2.0/24 to 10.24.66.0/24 00179 4 112 Wed Jul 19 14:40:34 2017 nat 2 log ip from 10.24.66.0/24 to 10.26.1.1 in recv enc0 Thanks, Michael
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1279753e-9ad1-2c02-304e-5001e2bbc82f>