<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.23532">
<STYLE></STYLE>
</HEAD>
<BODY dir=auto bgColor=#ffffff>
<DIV><FONT color=#0000ff size=2 face=Verdana>Hi Sirs,</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>I setup a openswan VPN
client behind the NAT.The test environment is as below.</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>It did not work.The traffic did not
seem to pass to server.</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>I got a message like
"NAT-Traversal: ESPINUDP(1) not supported by kernel for family
IPv4".</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>It seem the NAT Traversal
issue.</FONT><FONT color=#0000ff size=2 face=Verdana>What kernel feature do I
need to enable?or anything else I need to check?</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>Can someone point me in the
right direction?Please help,Thank's.</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana> 2.6.38
client--------------------NAT------------------ 2.6.38 Server</FONT></DIV>
<DIV><FONT color=#0000ff size=2
face=Verdana>192.168.15.x 192.168.11.x
192.17.200.x
192.168.12.x</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>Nov 5 10:01:11 daemon err
ipsec_setup: Starting Openswan IPsec U2.6.38/K2.6.30...<BR>Nov 5 10:01:11
daemon err ipsec_setup: Using NETKEY(XFRM) stack<BR>Nov 5 10:01:13
authpriv err ipsec__plutorun: Starting Pluto subsystem...<BR>Nov 5
10:01:13 user warn syslog: adjusting ipsec.d to /var/ipsec.d<BR>Nov 5
10:01:13 authpriv warn pluto[11706]: WARNING: 1DES is enabled<BR>Nov 5
10:01:13 authpriv warn pluto[11706]: LEAK_DETECTIVE support
[disabled]<BR>Nov 5 10:01:13 authpriv warn pluto[11706]: OCF support for
IKE [disabled]<BR>Nov 5 10:01:13 authpriv warn pluto[11706]: NSS support
[disabled]<BR>Nov 5 10:01:13 authpriv warn pluto[11706]: HAVE_STATSD
notification support not compiled in<BR>Nov 5 10:01:13 authpriv warn
pluto[11706]: Setting NAT-Traversal port-4500 floating to on<BR>Nov 5
10:01:13 authpriv warn pluto[11706]: port floating activation
criteria nat_t=1/port_float=1<BR>Nov 5 10:01:13 authpriv warn
pluto[11706]: NAT-Traversal support
[enabled]<BR>Nov 5 10:01:13 authpriv warn pluto[11706]: using /dev/urandom
as source of random entropy<BR>Nov 5 10:01:13 daemon err ipsec__plutorun:
adjusting ipsec.d to /var/ipsec.d<BR>Nov 5 10:01:13 authpriv warn
pluto[11706]: starting up 1 cryptographic helpers<BR>Nov 5 10:01:13
authpriv warn pluto[11711]: using /dev/urandom as source of random
entropy<BR>Nov 5 10:01:13 authpriv warn pluto[11706]: started helper
pid=11711 (fd:6)<BR>Nov 5 10:01:13 daemon err ipsec_setup: ...Openswan
IPsec started<BR>Nov 5 10:01:15 authpriv warn pluto[11706]: Could not
change to directory '/var/ipsec.d/cacerts': No such file or
directory<BR>Nov 5 10:01:15 authpriv warn pluto[11706]: Could not change
to directory '/var/ipsec.d/aacerts': No such file or directory<BR>Nov 5
10:01:15 authpriv warn pluto[11706]: Could not change to directory
'/var/ipsec.d/ocspcerts': No such file or directory<BR>Nov 5 10:01:15
authpriv warn pluto[11706]: Could not change to directory '/var/ipsec.d/crls': 2
No such file or directory<BR>Nov 5 10:01:15 authpriv warn pluto[11706]:
added connection description "test"<BR>Nov 5 10:01:15 daemon err
ipsec__plutorun: 002 added connection description "test"<BR>Nov 5 10:01:15
authpriv warn pluto[11706]: listening for IKE messages<BR>Nov 5 10:01:15
authpriv warn pluto[11706]: NAT-Traversal: ESPINUDP(1) not supported by kernel
for family IPv4<BR>Nov 5 10:01:15 authpriv warn pluto[11706]: adding
interface eth0.1/eth0.1 192.168.11.2:500<BR>Nov 5 10:01:15 daemon err
ipsec__plutorun: 003 NAT-Traversal: ESPINUDP(1) not supported by kernel for
family IPv4<BR>Nov 5 10:01:15 authpriv warn pluto[11706]: NAT-Traversal:
ESPINUDP(2) not supported by kernel for family IPv4<BR>Nov 5 10:01:15
authpriv warn pluto[11706]: NAT-Traversal port floating turned off<BR>Nov
5 10:01:15 daemon err ipsec__plutorun: 003 NAT-Traversal: ESPINUDP(2) not
supported by kernel for family IPv4<BR>Nov 5 10:01:15 authpriv warn
pluto[11706]: NAT-Traversal is turned OFF due to lack of KERNEL support:
0/0<BR>Nov 5 10:01:15 authpriv warn pluto[11706]: adding interface
eth0.1/eth0.1 192.168.11.2:4500<BR>Nov 5 10:01:15 authpriv warn
pluto[11706]: adding interface br0/br0 192.168.15.254:500<BR>Nov 5
10:01:15 authpriv warn pluto[11706]: adding interface lo/lo
127.0.0.1:500<BR>Nov 5 10:01:15 authpriv warn pluto[11706]: adding
interface lo/lo ::1:500<BR>Nov 5 10:01:15 authpriv warn pluto[11706]:
loading secrets from "/var/ipsec.secrets"<BR>Nov 5 10:01:17 authpriv warn
pluto[11706]: "test": deleting connection<BR>Nov 5 10:01:17 authpriv warn
pluto[11706]: added connection description "test"<BR>Nov 5 10:01:18
authpriv warn pluto[11706]: "test" #1: initiating Main Mode<BR>Nov 5
10:01:18 authpriv warn pluto[11706]: "test" #1: received Vendor ID payload
[Openswan (this version) 2.6.38 ]<BR>Nov 5 10:01:18 authpriv warn
pluto[11706]: "test" #1: received Vendor ID payload [Dead Peer
Detection]<BR>Nov 5 10:01:18 authpriv warn pluto[11706]: "test" #1:
transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<BR>Nov 5
10:01:18 authpriv warn pluto[11706]: "test" #1: STATE_MAIN_I2: sent MI2,
expecting MR2<BR>Nov 5 10:01:18 authpriv warn pluto[11706]: "test" #1:
transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<BR>Nov 5
10:01:18 authpriv warn pluto[11706]: "test" #1: STATE_MAIN_I3: sent MI3,
expecting MR3<BR>Nov 5 10:01:18 authpriv warn pluto[11706]: "test" #1:
ignoring informational payload, type INVALID_ID_INFORMATION
msgid=00000000<BR>Nov 5 10:01:18 authpriv warn pluto[11706]: "test" #1:
received and ignored informational message</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana> </DIV>
<DIV><BR>config
setup<BR>
nat_traversal=yes<BR>
keep_alive=60<BR>
oe=off<BR>
protostack=netkey<BR>
interfaces=%defaultroute</FONT></DIV>
<DIV> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>conn
test<BR>
left=192.168.11.2<BR>
leftsubnet=192.168.15.0/24<BR>
rightsubnet=192.168.12.0/24<BR>
connaddrfamily=ipv4<BR>
right=192.17.200.110<BR>
ike=3des-md5;modp1024!<BR>
ikelifetime=480m<BR>
type=tunnel<BR>
salifetime=60m<BR>
phase2alg=3des-hmac_md5!<BR>
pfs=no<BR>
phase2=esp<BR>
keyexchange=ike<BR>
authby=secret<BR>
auto=add</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>Best Regards,</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>Ozai</FONT></DIV></BODY></HTML>