netdev - RE: IP forwarding on a linux IPSec gateway

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <B97B134FACB2024DB45F524AB0A7B7F205B93C54@XMB-BGL-419.cisco.com>
Date:	Tue, 31 Jan 2012 23:41:07 +0530
From:	"Prashant Batra (prbatra)" <prbatra@...co.com>
To:	"Andrew Beverley" <andy@...ybev.com>
Cc:	<netdev@...r.kernel.org>
Subject: RE: IP forwarding on a linux IPSec gateway

-----Original Message-----
From: Andrew Beverley [mailto:andy@...ybev.com] 
Sent: Tuesday, January 31, 2012 11:18 PM
To: Prashant Batra (prbatra)
Cc: netdev@...r.kernel.org
Subject: Re: IP forwarding on a linux IPSec gateway

On Fri, 2012-01-27 at 15:31 +0530, Prashant Batra (prbatra) wrote:
> So, it's clear that linux gateway is able to protect the data and send
> to the connected gateway (ESP packets to outer IPs). And the second
> gateway is responding with ESP packet which is decoded on linux gateway
> and sent to the ip stack again by linux kernel (ICMP reply). But the
> reply doesn't reach the host on left subnet.

Didn't somebody else have a similar problem recently? He found that it
worked using one internet provider but not another. If you're not seeing
anything received in tcpdump in the left subnet, then I would suspect
that the packet is getting lost in the WAN somewhere. What happens when
you ping in the other direction?
[Prashant] Hi Andy,

Thanks, for the reply, but I got it to work by adding "fwd" policy, after investigating some stats in proc.

Now, I am facing another issue with 2.6.38 kernel, when it started working on 2.6.34 kernel.  
Any links to understand the flow in the kernel for this kind of forwarding with IPSec to analyze where the problem could be
will be really helpful.

Andy