Could somebody enlighten me ;o)

Hello...

I'm trying to make a firewall/accesspoint, and I want to be able to take 
my tcp connectionsw with me, when I go from cable to wireless. So I've 
bridged the eth2 (lan) and ath0 (wifi). Then security kicks in. I then 
want to make an ipsec tunnel to the firewall to secure my wireless. This 
part works too.. However I cannot get packages routed from the bridge out 
the primary interface to go through the nat POSTROUTING iptable


 eth0=x.x.x.x/24
 br_lan:[ath0, eth2]=y.y.y.50/28

simplified rules ;o)

+ iptables -t mangle -A PREROUTING -p ah -j MARK --set-mark 1
+ iptables -t mangle -A PREROUTING -p esp -j MARK --set-mark 1

+ iptables -A FORWARD -i br_lan -m mark --mark 1 -j ACCEPT
+ iptables -A FORWARD -i br_lan -m physdev --physdev-in eth2 -j ACCEPT
+ iptables -A FORWARD -i br_lan -m physdev --physdev-in ath0 -j DROP

+ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

+ ebtables -P FORWARD DROP
+ ebtables -A FORWARD -p ARP -j ACCEPT

+ ebtables -t nat -A PREROUTING --logical-in br_lan -p arp -j ACCEPT
+ ebtables -t nat -A PREROUTING --logical-in br_lan -p ipv4 -j redirect --redirect-target ACCEPT

On the firewall (y.y.y.50)
I have a racoon listening to interface x.x.x.x
And ipsec (setkey) saying anything to or from x.x.x.x should not be encrypted

On the laptop (y.y.y.53):
Everything should be encrypted
Except anything to or from x.x.x.x

This works like a charm on the bridge:
# ping y.y.y.52
tcpdump:
23:44:52.652905 IP y.y.y.53 > x.x.x.x: ESP(spi=0x0acdda0e,seq=0x104)
23:44:52.656517 IP x.x.x.x > y.y.y.y.53: ESP(spi=0x0ad3a55e,seq=0x110)
23:44:52.656517 IP y.y.y.52 > y.y.y.53: icmp 64: echo reply seq 28929

However when going out eth0 does not get natted on the way out of the
firewall.
e.g:
lap# ping slashdot.org
fw# iptables -t mangle -I POSTROUTING -j LOG --log-prefix 'mangle:POSTROUTING '
fw# iptables -t nat -I POSTROUTING -j LOG --log-prefix 'nat:POSTROUTING '
fw# tcpdump -i eth0 -n -p 
23:47:16.022751 IP x.x.x.53 > 66.35.250.150: icmp 64: echo request seq 0
fw# dmesg
mangle:POSTROUTING IN= OUT=eth0 PHYSIN=ath0 SRC=172.19.1.53 DST=66.35.250.150 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=51259 SEQ=0 

I was expecting both mangle & nat chains in the syslog as well as x.x.x.x 
instead of y.y.y.53 in the tcpdump. The funny part is that everyting woeks 
as expected from y.y.y.52 (which does not go through the ipsec).

Does anybody have any idea why I don't hit the nat POSTROUTING table when 
using ipsec over the bridge?

When I make a setup with ath0 an individual interface (not enslaved by a 
bridge) it works like a charm¹ (except I get an ip number that doesn't 
suit me ;o)


¹) ath0 192.168.1.1/24
   laptop 192.168.2.1/24 gateway 192.168.1.1
   ipsec setup like before
   ping slashdot.org works
   ping y.y.y.52 works

Yours
--
  Morten Bøgeskov (email: morten-jGWyxZGbRXZknbxzx/[email protected])

Maybe you just don't care about your sensitive data as much as I do:
all my important textual data has been encrypted into a binary format
according to the American Standard Code for Information Interchange.


-------------------------------------------------------
This SF.Net email is sponsored by Yahoo.
Introducing Yahoo! Search Developer Network - Create apps using Yahoo!
Search APIs Find out how you can build Yahoo! directly into your own
Applications - visit http://developer.yahoo.net/?fr=offad-ysdn-ostg-q22005