[Openswan Users] Kernel 2.6 + IPSEC + SNAT

[Alexander Samad]

On Sun, Apr 18, 2004 at 05:12:27PM +0200, alain sabban wrote:
> Hi,
> 
> This is to share my experience.
> 
> For several years I've a working IPSEC connection from home to my company's 
> office. Currently at home, I have an ADSL connection + a Wifi router and I'm 
> running Mdk 9.2 (kernel 2.4.22) + superfreeswan 1.99. In order to access my 
> company's network (x.y.0.0) I had to have an iptable rule :
> 
> iptables -t nat -A POSTROUTING  -d x.y.0.0/16 -j SNAT --to-source virtual-IP
> 
> To access my company network I have to snat all packets to a virtual-IP that 
> is routed in the company's network.
> 
> Recently, I've installed Mdk 10 Community which is based on kernel 2.6.3. I've 
> installed openswan 2.1.1, modified a bit my ipsec.conf, fixed the "modprobe 
> modules" bug in _startklips (test -f instead of test -d) thanks to people in 
> #openswan freenode irc channel. Finally I was successfull to establish the 
> ipsec tunnel, but no way to do anything : no ping, nothing.
> 
> There are several long threads in the netfilter mailing list about problems 
> with kernel 2.6 + IPSEC + SNAT (see 
> http://www.uwsg.iu.edu/hypermail/linux/net/0310.0/0005.html). From what I 
> understand, the problem is mainly due to the disappearance of the ipsecX 
> devices in ipsec native code in kernel 2.6. It seems a patch is currently 
> under testing !? Does anybody know more on that ?
> 
> The first thing I wanted is to make sure that my problem is really that one. 
> So here is what I did :
> 0/ Removed the SNAT iptables rule
> 1/ I configured a virtual device. For me wlan0:1
> 2/ I gave the virtual-IP address to this device
> 3/ I enabled ip_forward
> 4/ Once my IPSEC tunnel is up, I sent pings like :
> ping -I virtual-IP x.y.a.b
> 5/ Ping responses are received !

There is a patch in the pom-ng to handle this.

SNAT and IPSEC + 2.6 doesn't work with out this patch.

> 
> Finally I use this workaround (virtual ip) in my ipsec.conf. I've changed the 
> following lines :
> interfaces=%defaultroute by interfaces="ipsec0=wlan0:1"
> right=%defaultroute by right=ip.of.wlan0 (not wlan0:1 !)
> 
> With that, when the tunnel is established, I have to manually add the route 
> (the _updown script does not add it !?):
> route add -net x.y.0.0 netmask 255.255.0.0 dev wlan0:1
> 
> Hope this helps / AS
> _______________________________________________
> Users mailing list
> Users at lists.openswan.org
> http://lists.openswan.org/mailman/listinfo/users
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.openswan.org/pipermail/users/attachments/20040419/c5e3f01b/attachment-0001.bin