Thanks Paul.<div><br></div><div>As you mentioned,I just find out iptables have a ipsec policy module,insert this rule:</div><div>iptables -t nat -A POSTROUTING -m policy --dir out --pol ipsec -j ACCEPT</div><div>before anything in nat postrouting.</div>
<div><br></div><div><br></div><div>--multiple -j RETURN statements for each remote network</div><div>if i add/delete a tunnel,i have to change the iptables rules,module policy is cool...</div><div>Everything is ok now.</div>
<div><br><br><div class="gmail_quote">2010/1/21 Paul Wouters <span dir="ltr"><<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">On Thu, 21 Jan 2010, Zhiping Liu wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi list, i have setup up an ipsec tunnel with another gateway,using NETKEY,my linux box access the internet<br>
with an ADSL cable.so i have to enable MASQUERADE like this:<br>
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE.<br>
<br>
but with the nat rule,all package on my side never get into the ipsec tunnel(but package from the other<br>
side is fine),so i have to change my rule like this:<br>
<br>
iptables -t nat -A¡¡POSTROUTING -d ! PEER NETWORK -o ppp0 -j MASQUERADE #PEER NETWORK set<br>
<br>
This is not good,because if i add another ipsec tunnel on my box ,i have to change the nat rule,i wonder if<br>
there is a way that i can tell iptables :<br>
iptables -t nat -A POSTROUTING (NOT IPSEC PACKAGE) -o ppp0 -j MASQUERADE.<br>
</blockquote>
<br></div>
You can use multiple -j RETURN statements for each remote network,<br>
followed by -j MASQUERADE. Or you can use the ipsec policy matching<br>
(-m ipsec i believe?)<br><font color="#888888">
<br>
Paul<br>
</font></blockquote></div><br><br clear="all"><br>-- <br>from Romeo<br>
</div>