[Openswan Users] Openswan, iptables (fiaif) and 2.6.16 kernel

Laurent CARON lcaron at apartia.fr
Fri Apr 14 12:52:24 CEST 2006


I'm running an openswan gateway for quite a long time now.

I have used 2.4.X and 2.6.X kernels without any problem until i decided 
to upgrade to 2.6.16 kernel.

Summary of problem:

Under 2.6.15 everything is fine

Under 2.6.16 my tunnels establish well, but i can't even ping a single 
computer located on the other end of the tunnel when the firewall is up.
Disabling the firewall solves the problem (but is not an option for me).

$ cat ip_conntrack | grep 192.168.10
icmp     1 8 src= dst= type=8 code=0 id=793 
packets=4 bytes=116 [UNREPLIED] src= dst=XXX.XXX.XXX.XXX 
type=0 code=0 id=793 packets=0 bytes=0 mark=0 use=1 is my lan subnet (natted so that lan computers can access 
the internet through the public ip address) is a workstation on my lan is the other subnet
XXX.XXX.XXX.XXX is my public ip address

If i disable the nat of, i can ping the other end.

Re-enabling the nat however disables the ability to ping the other end.

Seems iptables is trying to nat packets the wrong way :$, or that I 
missed a major change in 2.6.16.

Do anyone have any clue about this weiredness?



More information about the Users mailing list