<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I don't think you should be able to see any unencrypted packets on
the WAN interface at all. Unfortunately I've deleted all earlier
e-mails and you've cut everything from your reply so I have no
picture of your set up any more.<br>
<br>
In my mind I can't wither see how you can have 192.168.5.100 > <a
moz-do-not-send="true" href="http://192.168.1.101">192.168.1.101</a>:
ICMP echo reply, id 1, seq 1348, length 40 on your WAN. Is your
ipsec server not the gateway to your LAN?<br>
<br>
<div class="moz-cite-prefix">On 24/06/2016 06:02, xue tao wrote:<br>
</div>
<blockquote
cite="mid:CALpqaBZr6Fx29+m0z+AqV=AVYU6TpJ_5U5YWo184W1XbHvZLgA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>yeah, every time updated ipsec.conf I will try this two
iptables rules. Now I found this two rules maybe have the
same function. Issuing ping from PC1 still only capture
reply on ONT1.<br>
</div>
So there is two question need to be solved:<br>
</div>
1. I capture data on wan interface, each time two esp packet
and one icmp reply packets , Is this correct with plain text
icmp packets?<br>
</div>
2. To find a way let reply packets forward to PC1. Now my
environment only setup ipsec tunnel.<br>
<div>
<div>
<div>
<div><br>
01:18:48.897899 IP 135.251.199.83 > <a
moz-do-not-send="true" href="http://135.251.205.188">135.251.205.188</a>:
ESP(spi=0x1baa58c3,seq=0xb), length 100<br>
01:18:48.899898 IP 135.251.205.188 > <a
moz-do-not-send="true" href="http://135.251.199.83">135.251.199.83</a>:
ESP(spi=0xc51ef3c2,seq=0xb), length 100<br>
01:18:48.900199 IP 192.168.5.100 > <a
moz-do-not-send="true" href="http://192.168.1.101">192.168.1.101</a>:
ICMP echo reply, id 1, seq 1348, length 40<br>
01:18:53.898650 IP 135.251.199.83 > <a
moz-do-not-send="true" href="http://135.251.205.188">135.251.205.188</a>:
ESP(spi=0x1baa58c3,seq=0xc), length 100<br>
01:18:53.900291 IP 135.251.205.188 > <a
moz-do-not-send="true" href="http://135.251.199.83">135.251.199.83</a>:
ESP(spi=0xc51ef3c2,seq=0xc), length 100<br>
01:18:53.900534 IP 192.168.5.100 > <a
moz-do-not-send="true" href="http://192.168.1.101">192.168.1.101</a>:
ICMP echo reply, id 1, seq 1349, length 40<br>
01:18:58.899278 IP 0.0.0.0 > <a
moz-do-not-send="true" href="http://0.0.0.0">0.0.0.0</a>:
ESP(spi=0x00000000,seq=0x0), length 100<br>
01:18:58.901227 IP 135.251.205.188 > <a
moz-do-not-send="true" href="http://135.251.199.83">135.251.199.83</a>:
ESP(spi=0xc51ef3c2,seq=0xd), length 100<br>
01:18:58.901552 IP 192.168.5.100 > <a
moz-do-not-send="true" href="http://192.168.1.101">192.168.1.101</a>:
ICMP echo reply, id 1, seq 1350, length 40<br>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
</body>
</html>